Penetration Testing mailing list archives
Re: Pentester convicted..
From: "Jason Ross" <algorythm () gmail com>
Date: Thu, 11 May 2006 07:26:10 -0400
On 5/10/06, William Hancock <bill.hancock () isthmusgroup com> wrote:
In an article posted to slashdot today (http://it.slashdot.org/article.pl?sid=06/05/10/112259&from=rss) a man has been convicted of hacking when he casually and helpfully reported a security vulnerability to the owners of a web site, in this case The University of Southern California.
As I understand it (from the article), he did not report it to the owners of the web site at all, rather, he sent it anonymously to a journalist at SecurityFocus. SecurityFocus contacted the owners. I am admittedly new to the security side of IT (officially anyway) but in my opinion, that was a bad move on his part. Had he notified the site owners directly, my guess is this would have gone a different way. The fact that he made an anonymous report to SecurityFocus instead is in itself a bit suspect in my opinion. The article says "he made no effort to hide his tracks" which isn't quite true if he's making an anonymous report. It makes me wonder if there is more to this story than it seems, and whether perhaps the person reporting the vulnerability had some form of a relationship with the site owners. (That said, it may be the case that he had contacted USC and gotten nowhere with them, and then turned to SecurityFocus, in which case I'd rethink my position. But based solely on what information is provided in the article, I really don't have a lot of sympathy for him. )
We should we, the good guys, who are paid for our knowledge and ability to exploit mistakes, oversights, and weaknesses then professionally report them to aid in the securing of information capital (or anyone who reports the flaw for that matter) worry about prosecution.
The key word there is "professionally". In this particular case (again imo and based solely on the information available in the article) the vulnerability was not handled in a professional manner at all. I do have concerns that a number of laws that have already been passed (and are currently being considered) will cause no end of potential problems for security professionals. How to deal with that issue is unfortunately not something I have an answer for. It really depends on educating lawmakers about the issues involved, which is not likely to be easy, as that implies an understanding of computing and network technologies that is quite apparently lacking in the institutions we rely on to make and enforce laws.
We, as a or even The security community, should push corporations, governments, and organized body's to take responsibility and ownership of their problems.
agreed. But how one goes about 'pushing' is critical.
If they publish a site that is flawed or exposing information then they are authorizing the retrieval of that information.
So, by this logic, if you leave your front door unlocked I am free to come inside and rifle through your desk and take a picture of anything I find interesting ?
I'm not advocating that they laws should allow any jerk to try and brute his or her way in to a public or private web site, but come on.
How do you differentiate between 'any jerk' and a 'security professional' over the internet ?
If someone leaves their wallet in the park with no guard or protection, I pick it up and bring it back to the owner, the owner didn't want me to have it but I brought it back to him. Why in the hell should I have to go to jail for returning it to him, why should I/we be punished for doing the right thing?
But what if instead you took their wallet to the newspaper and said "hey, check it out. John Doe is irresponsible and has left their wallet laying around" and then the newspaper contacts John Doe and says "we hear you're leaving valuable stuff out there for anyone to pick up, what do you have to say about that" ... is that still the right thing ?
I acknowledge this to be a rant but there must but some way to insist that when people make something available to the public that it is their responsibility to safeguard it and appreciate not persecute someone who let's them know (for free I might add) that a weakness exists.
Again, how one goes about letting them know is critical.
This is simple scapegoating, the University did something not advisable as a good practice and instead of owning up to it they villafied a professional pen-tester for offering valid advice.
I'm not sure I agree at all with this statement. One thing I am curious about is how they traced it back to an individual? It's one thing to get an IP address or such out of the web logs, but tracking that back to an individual is not necessarily a trivial task. Just my 2bits. -- Jason Ross gpg key: 0xF80C38B6 ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- Re: Pentester convicted.., (continued)
- Re: Pentester convicted.. Davide Carnevali (May 11)
- Re: Pentester convicted.. Karyn Pichnarczyk (May 11)
- Re: Pentester convicted.. Stuart Thomas (May 11)
- Re: Pentester convicted.. Jason Mayer (May 11)
- Re: Pentester convicted.. Art Cooper (May 11)
- Re: Pentester convicted.. lee . e . rian (May 12)
- Re: Pentester convicted.. Art Cooper (May 12)
- Re: Pentester convicted.. Karyn Pichnarczyk (May 12)
- Re: Pentester convicted.. Art Cooper (May 12)
- Re: Pentester convicted.. Phoebe Tunstall (May 12)
- Re: Pentester convicted.. lee . e . rian (May 12)
- Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Michael Sierchio (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Dana (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Jeremiah Cornelius (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Dotzero (May 12)
- Re: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Paul Asadoorian (May 12)
- RE: Get out of jail cards (Statement of work authorizing access, was Re: Pentester convicted..) Clement Dupuis (May 12)