From: aliver at xexil.com (aliver@...il.com)
Subject: Re: HP Full Disclosure Story

On Sun, 25 Aug 2002, Jonathan Rickman wrote:
> I think it is also very important to keep all parts of the conversation
> intact. There is a significant portion of this particular conversation
> that was not included, which I suspect, sent the conversation on the
> downward spiral.

It'd be interesting. However, I think it really comes down to two things.
Initially Tamer was fair with HP, and pretty much throughout, HP acted
with a typical corporate snootyness. It occurs to me that you are somewhat
of an apologist for the HP attitude.

> No offense to Tamer, but this strikes me as a case of a researcher who
> insisted on setting HP's rules for them "on the fly" as it were.

They'd better get used to it. Researchers, hackers, blackhats and script
kiddies simply don't give a damn about some "rules" or corporate policies
inside of some megacorp. This is something that suits can't seem to get
into their heads. You find a vulnerability then you set the rules on how
it gets released. Period. This is why things like the "responsible
disclosure" RFC are practically worthless in this regard. That is, of
course, unless the megacorp in question thinks it's better to have every
kidiot on the block know about their vulnerabilities before they do (which
happens quite a bit).
	IMHO, they are damn lucky that I don't have any of their hardware
or software around here, because if I find vulnerabilities they'll be the
dead last people to know about it.

> HP has a policy in place. Flawed or not, they have to work within the
> confines of that policy.

	I'm sure all script kids ask themselves "I'm I going to violate
this company's policy by owning them?" Seriously, do you think hackers
give a proverbial flying fuck about policies? HP's "policies" have already
created a lot of animosity toward them, and put them at a disadvantage
when compared to another company that is more friendly to vulnerability
disclosure. They are so stupid, they can't even see the value of the free
work being done for them by folks like Tamer. Stupid people often get
what's coming to them. I'd suspect that HP has pretty well pissed off the
small whitehat researcher community, and now that leaves he field a bit
more open to those who can use the opportunity to break them off some in a
more proper fashion.
	Personally, the only criticism of Tamer I can make is that he
wasn't cautious enough. HP could have responded by suing him or if he's
in some 3rd world country perhaps bribe the local authorities to act on
their "complaint".

> "Let me be very candid here, you are not the first to assume
> that a $50 billion corporation will drop all the other security
> issues we are working on in order to work on yours because
> you threaten to publish. It has never changed the course of
> our work internally; we will continue to work on the issue
> until it is tested and finished."
>
> Honestly, that sounds pretty reasonable to me,

	It sounds like typical corporate bureaucratic nonsense to me.
Again, you sound like a corporate apologist (albeit a weak one). First
off, let's take the $50 billion part and rewind back to the point when
they developed their crappy networking gear in the first place. Perhaps if
they spent more of that money on research, engineering, and quality
assurance, then they wouldn't be dealing with such situations at all.
Instead I see an awful lot of advertising and you can bet that HP is no
different than any other megacorp where the scientists and engineers make
peanuts compared to the executives, and in many cases even their
first-line managers.
	Another thing is that this HP cocksmoker has a very bad attitude.
Things might have been different if he said "Thanks for the info Tamer, we
are slammed right now but I know we can get this fixed in 30 days." What's
he do instead? He acts like a haughty prick and then when Tamer goes
public they scramble to release their own "advisory" ASAP. Sounds like he
dictated the rules after all.

> considering that we do not have the privilege of reading the
> communication from you. For all we know, your email to them, consisted
> of "ph33r m3 HP, eye will dr0p dis 0day b0mb on yo @z in 10 minutes if
> joo do not r3zpect my skillz!!!"

Well if you are some vice president of security or whatever BS title you
want to pick from this guy's sig, then you should be able to maintain your
cool when you see that the person you are dealing with has a legitimate
vulnerability and they've _at least_ given you the opportunity to address
it before they do drop it on the public. Like I said, it's more than I'd
have done for them. It reminds me of "... because he's holding a thermal
detonator!"

> Once again, Tamer, no offense intended, but that part of the
> conversation does seem to be critical, since that's where things turned
> south.

Nope, I disagree. It's not critical. We've seen the critical elements that
relate to our ongoing discussion of vulnerability disclosure. Again, even
if Tamer antagonized the guy he should still keep a level head enough to
do is job properly (which is to protect HP's security interests which he
is clearly not doing by antagonizing Tamer).

> As for their September 11th remarks, I consider that pretty tasteless
> and cliche,

... and pretty homogeneous with the rest of his attitude and remarks.

> and I seriously doubt that that is the "Company Line", but rather the
> work of one individual who has not learned to toe that "Company Line"
> quite right.

We are discussing a company that has been known to get lawyers involved
when exploits are published. Don't be so sure that jerks like this guy
aren't rampant in the "industry" end of security, and especially HP.
They've given plenty of evidence to make it seem like as a company they
are hostile to even "legitimate" vulnerability researchers.

> Another possibility is that the folks at HP were slow to pick up on the
> fact that English is obviously not your first language, and ask for
> further clarification. Sometimes that is a source of confusion, even
> when dealing with someone who writes fairly well, such as yourself.

So what? That gives them the right to be rude as hell and try to jerk
someone around?

> I think Dan at HP summed the whole thing up best when he said, "We did
> reply, and you are making the assumption that your issue is the only one
> we have to work on, and that it is the most important." I suspect that
> he hit the proverbial nail right on the head with that one.

Well first off as I read it Tamer made no such assumption. His only flawed
assumption was that they'd cooperate and act like professionals if he
disclosed this vulnerability to them. If they were truly too busy to work
on his issue they could have just been honest about that fact in a more
polite manner and it'd have been more professional. Furthermore, if they
don't have enough resources to fix vulnerabilities in a timely fashion and
hire professional folks then they should _get those resources_, instead of
some trite, inflammatory whining which insinuates that they can't be
bothered with yet another vulnerability which someone researched for them
for _free_.

aliver

Powered by blists - more mailing lists