full-disclosure - RE: Publishing exploit code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CDA211A5463B564084335139C81FB18AA12B06@onrex2.onr.navy.mil>
Date: Fri Jul  1 13:06:00 2005
From: David_Morales at onr.navy.mil (Morales, David (Seta))
Subject: RE: Publishing exploit code - what is it good for

Hi Aviram,

I use this type of code to ensure that when patches are applied, it does
not "break" any part of the OS and or application which has already been
patched. Also I don't take anyone's word that a system has been patched
or a security hole has been fixed without testing and re-certifying the
application or the OS. 
Without the exploit code I would not be able to verify any of this and
could very well leave my systems wide open.
In a private sector company this code should be used in the same manner,
to ensure compliance with SOX. To leave systems untested would be
hanging your company out to dry.

David Morales
moraled@....navy.mil
703-696-4022

-----Original Message-----
From: Aviram Jenik [mailto:aviram@...ondsecurity.com] 
Sent: Thursday, June 30, 2005 8:14 AM
To: full-disclosure@...ts.grok.org.uk; bugtraq@...urityfocus.com
Subject: Publishing exploit code - what is it good for

Hi,

I recently had a discussion about the concept of full disclosure with
one of 
the top security analysts in a well-known analyst firm. Their claim was
that 
companies that release exploit code (like us, but this is also relevant
for 
bugtraq, full disclosure, and several security research firms) put users
at 
risks while those at risk gain nothing from the release of the exploit.

I tried the regular 'full disclosure advocacy' bit, but the analyst
remained 
reluctant. Their claim was that based on their own work experience, a 
security administrator does not have a need for the exploit code itself,
and 
the vendor information is enough. The analyst was willing to reconsider
their 
position if an end-user came forward and talked to them about their own 
benefit of public exploit codes. Quote: " If I speak to an end-user 
organization and they express legitimate needs for exploit code, then
I'll 
change my opinion."

Help me out here. Full disclosure is important for me, as I'm sure it is
for 
most of the people on these two lists. If you're an end-user
organization and 
are willing to talk to this analyst and explain your view (pro-FD, I
hope), 
drop me a note and I'll put you in direct contact.

Please note: I don't need any arguments pro or against full disclosure;
all 
this has been discussed in the past. I also don't need you to tell me
about 
someone else or some other project (e.g. nessus, snort) that utilizes
these 
exploits. Tried that. Didn't work.

What I need is a security administrator, CSO, IT manager or sys admin
that can 
explain why they find public exploits are good for THEIR organizations.
Maybe 
we can start changing public opinion with regards to full disclosure,
and 
hopefully start with this opinion leader.

TIA.

-- 
Aviram Jenik
Beyond Security

http://www.BeyondSecurity.com
http://www.SecuriTeam.com