Message-ID: <1043784585.3925.57.camel@localhost.localdomain>
From: recon at snosoft.com (Strategic Reconnaissance Team)
Subject: [Secure Network Operations, Inc.] Full
	Disclosure != Exploit Release

Nicolas, 
	I think that you should re-read the e-mail that I posted to
full-disclosure. The message had nothing to do with the recent SQL worm,
nor was it even mentioned anywhere. The focus of the message was to help
determine legitimate reasons, if any, to release proof of concept code
to everyone. As I stated, full disclosure is a powerful resource and
helped to educate the possibly vulnerable. However, is proof of concept
code a requirement to educate the possibly vulnerable? My argument is
that a highly detailed advisory would more than suffice. Now, just out
of curiosity, where did I mention worm, virus, or even being stabbed?

	To answer your question: 

Do you prefer to be aware of the exploit like the ones that will use it
after some modifications or do you prefer only some "elite" is able to
harm the systems?

I prefer to be aware of the vulnerability and to know how to fix the
vulnerability. Once the vulnerability is repaired, all of your exploits
are rendered useless. 

As for being "elite", well, I have a hard time considering people elite
when they negatively impact the human race. They are quite literally,
not superior. So, as an argument of opinion,f I'll have to go ahead and
disagree there... Ok... (office space speak)



On Tue, 2003-01-28 at 14:22, Nicolas Villatte wrote:
> I am sorry but people who made this virus does not appear as script
> kiddies to me. Do you prefer to be aware of the exploit like the ones
> that will use it after some modifications or do you prefer only some
> "elite" is able to harm the systems?
> 
> Personally, I prefer to die seeing my enemy than being stabbed.
> 
> 
> -----Message d'origine-----
> De : full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] De la part de Strategic
> Reconnaissance Team
> Envoy? : lundi 27 janvier 2003 3:19
> ? : full-disclosure@...ts.netsys.com
> Objet : [Full-Disclosure] [Secure Network Operations, Inc.] Full
> Disclosure != Exploit Release
> 
> All, 
> 
> I have been following the subject of full disclosure for a while, and as
> most of you know, have dealt with some of the issues that full
> disclosure can cause (HP/Secure Network Operations/DMCA).  While the
> idea of full disclosure is a good idea, and while we support it, we feel
> that the exploit source code should not be released to everyone.
> 
> It is possible to prove a vulnerability exists by releasing well written
> advisories.  Because of this fact, proof of concept code (exploit
> source) is not a requirement for the education of the possibly
> vulnerable. Releasing non-malicious exploit code is also not an option
> as any local script bunny/kiddie can easily render it functional.
> 
> Proof of concept code is useful for legitimate contract based
> penetration tests. It is also useful for study as it demonstrates
> fundamental flaws computers today (not built in security). But again,
> proof of concept code is not for everyone.
> 
> I am interested in hearing the opinions of the people on this list. If
> you are for exploit source disclosure, I would like to hear arguments
> supported by facts, that explain why.  I am equally interested in
> reasons why not to disclose information. 
> 
> With that said, Secure Network Operations, Inc. will no longer be
> releasing functional proof of concept code. We may release sufficiently
> detailed advisories. 
> 
> 	
-- 
Strategic Reconnaissance Team <recon@...soft.com>
Secure Network Operations, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030128/fa1bfdec/attachment.bin

Powered by blists - more mailing lists