full-disclosure - Re: To disclose or not to disclose

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <48F10B86.5080507@pluto.sunn.de>
Date: Sat, 11 Oct 2008 22:24:38 +0200
From: wishi <wishi@...to.sunn.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: To disclose or not to disclose

AaRoNg11 schrieb:
> Well, if you've already warned your client that their software is vulnerable
> and they haven't changed to an alternative, then it's fine to release an
> advisory with all of the details.

Just don't waste my tell jelling aloud there's a problem, when you can
post on a bugtracker, reaching the persons, that need to be reached.

> I really don't understand why they'd pay for a penetration test to not take
> action if their software was vulnerable. 

Because it's tested. Knowing a vulnerability is worth a lot.

>> yet to address the vulnerability in their own network too.
>>
>>        Is it the ethical duity of the security company to release an
>> advisory?
>> Does that advisory put the customer at risk? It is clearly unethical to
>> do nothing and to leave everyone else at risk. How to proceed?

Fact is fact. if you've got valid facts, point them out. If you want a
great show, just mail to Slashdot, point out you're a researcher, say
the Internet will break and have fun.
Many do so. Media are stupid enough to believe, because there are very
few really security minded people. And they usually don't work in press.

Security as a market depends on disclosure, for reconstruction _and_
construction in general. It's future depends on how open security-people
are, on trust, on legitimate processes. Unorganized chaos, conference
disclosure, and advertisement security circus stuff is shit. Do so, and
it fails.

If there's just a small knowing circle, vendor based, blackhats can
cause huge damage, because any reconstruction gets much harder. A
secretive security response in very few cases is constructive. The
blackhats are steps ahead, if you disclosure your small finding or not.
Who really think that botnet owners are dependent on socks-stress or DNS
spoofing, never saw the backend of a huge botnet!

What you need is to address the right motivated people. That's easily
done with leaving out explanations and just posting pure code ;) *g*.
Really: use the bugtracker, not the media.

Thanks,
wishi

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/