Date: Wed, 30 Mar 2011 18:15:50 -0400 (EDT)
From: Ryan Sears <rdsears@....edu>
To: noloader@...il.com
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Vulnerabilities in *McAfee.com

Agreed, If you put your site on the open internet, you have to take into account the inherent hostilities that go along with that action. 

A security firm like Mcafee /knows/ about these vulnerabilities. Guaranteed. If they offer services to make other's sites 'hacker proof', their first order of business should make sure that their infrastructure doesn't have blatantly obvious security holes. I'm not saying that they should catch EVERYTHING, but these are bugs that an automated scanner could easily pick up. I do understand that  a large infrastructure like theirs has pages that have been created by people with varying degrees of competence, but that's why they need to do inclusive penetration tests of their own network. At the very least they need to have some mechanism in place to detect (and possibly defer) these sorts of attacks. 

The way I see it, when a company hides behind legal threats to deter people from finding and reporting bugs, all they're doing is hurting themselves. Look at how Microsoft has turned around. 10 years ago they weren't dealing with people reporting issues in the right way, but they soon came to realize that by listening to the hackers that ARE coming forward with issues, they not only help themselves, but help the community as well. It's a win/win scenario for EVERYONE. 

You can tell a vast amount about how an infrastructure is run from just a bit of poking. If there are blatant security holes everywhere, then they clearly don't take security seriously. If they filter for SQL injections in javascript, then the dev's have no clue what they're actually trying to do. If you see SQL errors, chances are there are more serious issues to boot. I usually limit my poking to the very basic of basics when I do use a new service, and the more transparent they are (think reddit) the more I trust them. They even have a full subreddit devoted to finding and learning about XSS attacks. One word, awesome. 

Simply put, in my opinion you can't blame a pen-tester for looking for bugs in a site. The only time it should be considered malicious is when it's used in a malicious way. If I find a XSS in a webform, and I report it along with re-mediation suggestions I feel as though I'm doing the site a favor. It's unfortunate to think that some see this as a criminal activity. 

Ryan

----- Original Message -----
From: "Jeffrey Walton" <noloader@...il.com>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: "Ryan Sears" <rdsears@....edu>, "full-disclosure" <full-disclosure@...ts.grok.org.uk>
Sent: Wednesday, March 30, 2011 5:28:59 PM GMT -05:00 US/Canada Eastern
Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor@...merofgod.com> wrote:
> I have that very strip printed and on the wall in my office :)    You make several points, but the response that immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding vulnerabilities, and entering data in a search box.  I don't know if there is any basis for this legally, but I feel that if you put a box up and I can search for something, then I can put whatever I want in that box.  You (the royal you) are basically soliciting people to put data in the box.   However, you are not asking anyone to spider your site or run scans against it.
>
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists