bugtraq - RE: DJB's students release 44 *nix software vulnerability advisories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <190178C01A8E02418A6CA9FB57AF3DD534C1FA@RED-EXCH01.redmond.3sharp.com>
Date: Tue, 21 Dec 2004 13:20:09 -0800
From: "Devin Ganger" <DevinG@...arp.com>
To: <bugtraq@...urityfocus.com>
Subject: RE: DJB's students release 44 *nix software vulnerability advisories

Jonathan T Rockway writes:

> Regarding local versus remote, look at it this way:  You have 
> a 100% secure system.  Then you install NASM.  Now a user 
> FROM THE NETWORK can send you some tainted assembly code for 
> you to assemble and he can compromise your account.  That is 
> why it is considered remote.  Local would mean that I, the 
> attacker, need an account on the target machine to compromise 
> the target account.  In this nasm case, I do not need an 
> account.  That is why the wording "remote" was chosen.

By that logic, *no* exploit can ever be considered local. A truly remote
exploit doesn't rely on manual interaction from a local user on the
system.

> Now in regards to full disclosure, I think you should all be 
> happy that we bothered to tell you all about these exploits.  
> We could have selfishly used them to compromise machines,

When you're trying to argue that your actions were ethical and moral,
pointing out that you could have committed crimes isn't the way to do
it.

> but instead we wrote them up and mailed them off to the users and 
> the authors!  That is very nice of us.

No, it's the absolute minimum level of ethical behavior one expects from
serious security researchers. Nothing nice about it.

> If you would like notification sooner than the "public", find 
> the exploit yourself.  If I can find them, then surely anyone can.

One day, when you are writing software for distribution, someone will
find an error in your code. When that day comes, remember this attitude.
While those who discover those bugs and exploits in your software have
no obligation to give you advanced warning of your bugs, I'm certain
you'd be grateful to have that warning so you have time to fix the bug
before word goes public.

-- 
Devin L. Ganger             Email: deving@...arp.com
3Sharp LLC                  Phone: 425.882.1032 x 109
15311 NE 90th Street        Cell: 425.239.2575
Redmond, WA  98052          Fax: 425.702.8455