Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: Pentester convicted..
From: bofn <bofn () irq org>
Date: Fri, 12 May 2006 16:22:02 +0200

Hi Craig,

I rather not get into nasty and costly fights with corp's & govt's.
mostly since i simply don't have the money to defend my self in their self protection tailored system.

I was thinking more of public humiliation of sorts.
like putting the name of the company/organisation and the number and severity of issues in a public place,
 putting a day counter next to it to show how long they leave it un-resolved after being notified, 
 with giving them 24h or so hours grace period to push the message past a few desks up the chain.

and thus politely forcing them take responsibility for the protection of privacy of the data they carry.
this method seems to work better then any other i've seen so far, but only works if its backed by a group of 
individuals, so they cant single out one person to pick on with brute force. 

Because i could not care less if they lose their systems and loads of money when they chose to ignore the facts.
But I Do Care a lot about innocent people getting to pay the price for their neglect. 

Cheers
*Anna.

To the moderator:
 this discussion hits the core issues of our profession, i think.
 if you need to censor opinions, then at least put in the effort to extract the relevant parts from possible flames and 
other deemed irrelevant communication, and publish just those sections !

this is a rather emotional subject since it threatens us all, so some forms of rants and tears are to be expected, 
after all , we are still human.




#-----------------------------------#


On Fri, 12 May 2006 09:27:11 -0400
"Soderland, Craig" <craig.soderland () sap com> wrote:

What is the option? 

      Take back the streets. Inform said company of the flaw, note to
them that they have been put on notice and if the flaw is not fixed
within a reasonable amount of time that you will hold them liable for
any use or misuse of your information. 

      Now if they do not do anything to correct the situation and your
information gets exposed, they are guilty of negligence/gross negligence
which should be easy to prove. 

      At this point hire a lawyer and sue sue sue the bastards, if
enough people take this tack, then companies will take notice and
actually do something. 

      Remember no company is motivated by altruistic reasons, unless
there is a clear ROI to do something then they simply will not as there
is no benefit to the cost put forth to fix the issue. 

      They on the other hand do understand money and when you go and
take it away from them they tend to take notice. 

      Cheers. 

-----Original Message-----
From: bofn [mailto:bofn () irq org] 
Sent: Thursday, May 11, 2006 4:33 AM
To: pen-test () securityfocus com
Cc: bill.hancock () isthmusgroup com
Subject: Re: Pentester convicted..

On Wed, 10 May 2006 09:20:22 -0500
William Hancock <bill.hancock () isthmusgroup com> wrote:

Hey there pen-testers, take this with a grain of salt, it just got me
excited.  I am really interested in everyones opinion on the matter or
corporate responsibility and ownership.


Hello Welliam,

<my rant>
I'm afraid that this a sign of the times.
the motto these days is "Shoot the messenger!"
the corporates have taught the governments who have shown the people in
the street.
the fact is that one can get jailed for picking up a wallet that is not
clearly yours by many laws these days, and the intention of returning it
to either the owner or the law enforcers is made irrelevant. 
mostly because the enforcers are taught that nobody can be trusted and
is to be deemed guilty of the worse case scenario until he/she can prove
innocence.
and when is the last time we have seen a CEO or equivalent figure
voluntary take ownership of an embarrassing issue?
</my rant>

I have had many cases where the company/organisation simply does not
want to know that there is a flaw or wide open door.
one of my recent ones was with this lists sponsor, who after repeatedly
informing of a flaw in their website scripts replied with just a one
line PR answer "We are investigating the issue and should have it
resolved very soon.".
they are simply not interested in the details of whats wrong with their
systems, and ignored the first 2 reports.
only after getting a bit more pushy the 3rd time their PR person
responded.
i got more pushy because the flaw still existed weeks after i reported
it the first time and the flaw can be used in a way that affects me.

This is very typical
. most organisations don't respond at all when someone reports a flaw /
open door.
. some give a Public Relations "All is fine on the western front, go
back to sleep" reponse.
. some get very aggressive, and respond with threads and insults.

until now i've only had positive responses from tiny organisations with
no more then 5 people.
even organisations like unions, human rights, nonprofit and local public
interest  react like the multinational companies.
<rant>
Their view seems to be "that person must want something from us, Or
she/he must be a lunatic".
they simply cant seem to understand that there are still people who use
their knowledge for the good of their environment without wanting to
financially better them selves from it.
This sums up the monolithic doctrine of the Corporates which these days
include the 'privatised' governments.
</rant>

What are we to do as a community I ask?
Maybe a public forum, which can become an authority to be renowned for
its integrity, can have some positive impact.
Something like a guild, so its no longer the voice of single dissident. 



With friendly greetings 
*Anna.

Ps.
;-) the guild's motto could be "Free means Free for all" but then in
fancy latin with a cute logo. 




--
"The disappearance of a sense of responsibility is the most far-reaching
consequence of submission to authority."


#--------------------------------# 
<RANT>
In an article posted to slashdot today
(http://it.slashdot.org/article.pl?sid=06/05/10/112259&from=rss) a man
has been convicted of hacking when he casually and helpfully reported
a
security vulnerability to the owners of a web site, in this case The
University of Southern California.  It reads like it was some sort of
simple SQL injection and upon gleaning the information he reported it.

What are we to do as a community I ask?  We should we, the good guys,
who are paid for our knowledge and ability to exploit mistakes,
oversights, and weaknesses then professionally report them to aid in
the
securing of information capital (or anyone who reports the flaw for
that
matter) worry about prosecution.  It lends itself to a forcing the
technical community to sit on their laurels and wait for the people
who
don't report issues to exploit them.  Further it sounds very clear
that
had he not notified them, they would have never known.

A security pro notices a flaw, checks to make sure he is not on crack
by
'flipping a bit', deems the threat viable and is likely to be
exploited,
notifies the owners, then get arrested and charged with unauthorized
access.  We, as a or even The security community, should push
corporations, governments, and organized body's to take responsibility
and ownership of their problems.  If they publish a site that is
flawed
or exposing information then they are authorizing the retrieval of
that
information.  I'm not advocating that they laws should allow any jerk
to
try and brute his or her way in to a public or private web site, but
come on.

If someone leaves their wallet in the park with no guard or
protection,
I pick it up and bring it back to the owner, the owner didn't want me
to
have it but I brought it back to him.  Why in the hell should I have
to
go to jail for returning it to him, why should I/we be punished for
doing the right thing?

I acknowledge this to be a rant but there must but some way to insist
that when people make something available to the public that it is
their
responsibility to safeguard it and appreciate not persecute someone
who
let's them know (for free I might add) that a weakness exists.  This
is
simple scapegoating, the University did something not advisable as a
good practice and instead of owning up to it they villafied a
professional pen-tester for offering valid advice.

</RANT>


Thanks,
Bill

------------------------------------------------------------------------
------
This List Sponsored by: Cenzic

------------------------------------------------------------------------
------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the
Analyst's 
Choice Award from eWeek. As attacks through web applications continue to
rise, 
you need to proactively protect your applications from hackers. Cenzic
has the 
most comprehensive solutions to meet your application security
penetration 
testing and vulnerability management needs. You have an option to go
with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service
can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm
your 
results from other product. Contact us at request () cenzic com for
details.
------------------------------------------------------------------------
------


------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault