mailing list archives
Re: Vulnerabilities in *McAfee.com
From: Ryan Sears <rdsears () mtu edu>
Date: Wed, 30 Mar 2011 18:15:50 -0400 (EDT)
Agreed, If you put your site on the open internet, you have to take into account the inherent hostilities that go along
with that action.
A security firm like Mcafee /knows/ about these vulnerabilities. Guaranteed. If they offer services to make other's
sites 'hacker proof', their first order of business should make sure that their infrastructure doesn't have blatantly
obvious security holes. I'm not saying that they should catch EVERYTHING, but these are bugs that an automated scanner
could easily pick up. I do understand that a large infrastructure like theirs has pages that have been created by
people with varying degrees of competence, but that's why they need to do inclusive penetration tests of their own
network. At the very least they need to have some mechanism in place to detect (and possibly defer) these sorts of
The way I see it, when a company hides behind legal threats to deter people from finding and reporting bugs, all
they're doing is hurting themselves. Look at how Microsoft has turned around. 10 years ago they weren't dealing with
people reporting issues in the right way, but they soon came to realize that by listening to the hackers that ARE
coming forward with issues, they not only help themselves, but help the community as well. It's a win/win scenario for
You can tell a vast amount about how an infrastructure is run from just a bit of poking. If there are blatant security
then the dev's have no clue what they're actually trying to do. If you see SQL errors, chances are there are more
serious issues to boot. I usually limit my poking to the very basic of basics when I do use a new service, and the more
transparent they are (think reddit) the more I trust them. They even have a full subreddit devoted to finding and
learning about XSS attacks. One word, awesome.
Simply put, in my opinion you can't blame a pen-tester for looking for bugs in a site. The only time it should be
considered malicious is when it's used in a malicious way. If I find a XSS in a webform, and I report it along with
re-mediation suggestions I feel as though I'm doing the site a favor. It's unfortunate to think that some see this as a
----- Original Message -----
From: "Jeffrey Walton" <noloader () gmail com>
To: "Thor (Hammer of God)" <thor () hammerofgod com>
Cc: "Ryan Sears" <rdsears () mtu edu>, "full-disclosure" <full-disclosure () lists grok org uk>
Sent: Wednesday, March 30, 2011 5:28:59 PM GMT -05:00 US/Canada Eastern
Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com
On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor () hammerofgod com> wrote:
I have that very strip printed and on the wall in my office :) You make several points, but the response that
immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding
vulnerabilities, and entering data in a search box. I don't know if there is any basis for this legally, but I feel
that if you put a box up and I can search for something, then I can put whatever I want in that box. You (the royal
you) are basically soliciting people to put data in the box. However, you are not asking anyone to spider your site
or run scans against it.
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.
It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: Vulnerabilities in *McAfee.com Thor (Hammer of God) (Mar 30)
Re: Vulnerabilities in *McAfee.com Ryan Sears (Mar 30)
Re: Vulnerabilities in *McAfee.com Cal Leeming (Mar 31)