| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <E95018E7B576744B8385F6753FB84A8D112CE4@ex9.asurite.ad.asu.edu> Date: Thu, 30 Jun 2005 13:02:43 -0700 From: Marvin Simkin <Marvin.Simkin@....edu> To: Aviram Jenik <aviram@...ondsecurity.com>, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: RE: Publishing exploit code - what is it good for While performing penetration testing at the request of a Fortune 500 financial services company, I discovered a vulnerability that, if abused, could have been used to initiate fraudulent funds transfers, stock market transactions, etc. The client was skeptical when told the exploit could occur in a matter of two or three seconds, go unnoticed by the victim, and gain such comprehensive unauthorized access. At the client's request, I wrote a proof-of-concept exploit that demonstrated everything except the final fraudulent action, but made it clear that exposure was only one more tiny step away. The client overcame their skepticism. While this particular exploit was not published, it shows a real-world "end-user organization [with] legitimate needs for exploit code" resulting in greater security for all customers of this organization. Another penetration tester in similar circumstances might be able to use or adapt a published exploit instead of writing a new one from scratch. Marvin Simkin http://simkin.asu.edu/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists