league to one who is exhausted. Long is samsara1 for the foolish who do not know saddhamma2.” -from the Dhammapada 1 Endless cycle of suffering caused by birth and death 2 The highest truth
flaw, or vulnerability Pro: More information for workarounds; can pressure vendors/providers; public scrutiny Con: Quicker time to exploit development; 0-day buffet!
(minimal disclosure?) Pro: May reduce likelihood of exploit development; may increase time-to-publish Con: “Relevant” is totally subjective; may miss important details
a vulnerability; “security through obscurity” Pro: “Almost zero likelihood of exploit development” (well, it’ll probably happen anyway) Con: Less public scrutiny may reduce trust if/when disclosure does occur; “Many eyes make bugs shallow”
Late last night, an independent security researcher released exploit code for a previously unknown buffer overflow that leads to remote code execution. What Would You Do?
wherein you can find local tasting events and participate in a forum for fellow connoisseurs. You discover that the whole site is riddled with SQL injection and cross-site scripting vulnerabilities. What Would You Do?
just received an email from a small security consultancy suggesting that they’ve discovered a privilege escalation bug in the web services API of your flagship application. What Would You Do?
• “Accident” led to password file being displayed in the MOTD • From OSVDB vuln #23257: • Multics CTSS on IBM 7094 contains a flaw that may disclose the contents of the password file...when multiple instances of the system text editor were invoked, causing the editor to create temporary files with a constant name...cause the contents of the system CTSS password file to display to any user logging into the system.
ballpoint pen • Video circulated in 2004 • Kryptonite knew 12 years earlier; did nothing. Medeco M3 vulnerabilities • Picking and “bumping” • Disclosed in 2008 by Mark Tobias
forebear to modern responsible full disclosure. Current incarnation says: • Vendor/provider must respond within five (5) days, and maintain contact no less than every five (5) days • Researcher and vendor/provider can agree upon delayed disclosure • Five (5) days w/o initial response from vendor/provider -> full, public disclosure
Culp, makes statements suggesting that full disclosure is like “following a practice that's best described as information anarchy.” On the heels of eEye’s disclosure of a vulnerability that may have benefited Code Red and Nimda authors Community counters that eEye disclosed details at least one month before Code Red emerged
stop Billy Hoffman and Virgil Griffith’s presentation on vulnerabilities July 2005: Michael Lynn plans to present on Cisco IOS vulnerabilities at BlackHat; threatened with lawsuit, investigated by the FBI August 2008: MIT students prepare to talk about MBTA vulnerabilities at DEFCON; gag order issued (later lifted)
remotely exploitable vulnerability in the SRV2.SYS driver in Windows Vista, Windows Server 2008, and Windows 7 Vulnerability initially leads to Blue Screen of Death; as of September 17, remote code execution is possible Microsoft says Gaffié was irresponsible for not notifying them; Gaffié counters, saying MS was irresponsible for bad QA
to say the same things: “Disclosure is evil!” “Disclosure is vital!” “Screw the vendor! Disclose all the way!” “Screw the industry! Keep vulnerabilities for yourself! This happens like clockwork, year in, year out.
• What do you do when the vulnerability and exploit are one in the same? (Think SQLi and XSS.) Process control and SCADA vulnerabilities • These things often run critical infrastructure
playing the “Bad researcher! Bad!” song Provide a facility for encouraging responsible disclosure Said facility would aim to give mutual benefit to research and vendor/provider
plan for a solution to the bug or flaw (and keep parties from stalling) • crafting a sensible timeline for public disclosure of the bug or flaw Document vendor-researcher interaction and disclosure process (for others to learn from)
quine
laysakura
yukiar
kampersanda
daimoriwaki
tam1110
hirachan
datascientistsociety
hponka
.png){kind=avatar}
satai
sansan_randd
monochromegane
masatoto
chriscoyier
rocio
lara
iamctodd
addyosmani
bryan
tammielis
mza
mongodb
aarron
marktimemedia
paulrobertlloyd
![Contact [email protected] http://n0where.org/ http://boston.midnightresearch.com/ http://identi.ca/quine http://twitter.com/quine](https://files.speakerdeck.com/presentations/103a68d0dbdc013120db6ac6a01a1f60/slide_36.jpg){kind=link}