Jure Koren
27/02/06, 03:00
--nextPart3101647.FAstZAkubt
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Monday 20 February 2006 22:39, Bigby Findrake wrote:
> Perhaps this is beating a dead horse, but could someone explain to me why
> the addition of a $50 computer found at a garage sale, a $10 NIC, and a
> $20 switch or hub to any would-be-infosec's arsenal wouldn't suffice for
> this purpose? We're not trying to brute force 4 kilobit pgpkeys, we're
> trying to present a host to attack. FreeBSD, NetBSD, OpenBSD, Linux...
> all free operating systems. Isn't there an x86 version of solaris that's
> free? $500 computers aren't needed for this testing. I suggest that the
> necessity for more expensive hardware is the exception, and not the rule.
> Bochs may not be speedy, but it works.
This is only OK for examining stuff you _can_ get your hands on.
> I would also suggest that anyone who finds that money is an obstacle is
> looking for excuses. I have often found ways to make outdated hardware
> useful in a variety of situations.
Money can't buy you software an online content provider has made themselves=
=2E I=20
have discovered a vulnerability in an online public telephone directory onc=
e.=20
The vulnerability was definitely not discovered by accident. I had browsed=
=20
through their HTML sources and found a number of things suggesting the=20
completely braindead way to do security without any real checking of user=20
input. I have written an exploit, sent it to them, waited to no avail, and=
=20
then published it. I never let myself run that exploit, but somebody must=20
have, because after publication, the site was down for three full days, and=
=20
when it was back it wasn't vulnerable anymore.
Whoever fixed it was actually a good, security conscious programmer and I h=
ope=20
he made a lot of money. I was trying to protect subscriber customers whose=
=20
accounts were trivial to compromise (and this was already happening on a=20
regular basis) to gain access to their own personal address books.
If the service provider couldn't provide the security, the customers had no=
=20
choice (since there is only one telephone services provider in the entire=20
country) and there is no way to tell the provider that they have a problem=
=20
without getting busted, well, what do you suggest?
I think it's not a case of "breaking and entering", but rather a case of "y=
our=20
windowsill flowerpot is about to fall on one of your customers, and I'm goi=
ng=20
to move it". I make no mistake that this is in fact illegal tampering with=
=20
someone else's property, but I can tell it's quite ethical to politely forc=
e=20
the provider in question to fix their security, because security experts'=20
responsibility lies with everyone adversely affected by a particular proble=
m,=20
not just the owner of a service.
I think this is a good example of when you just can't do a wholly responsib=
le=20
thing. Walking away is not an option because users are at risk. Talking to=
=20
the provider is only an option when they talk back. Proof of concept is,=20
unfortunately, one of the few options left open. I would like to hear from=
=20
anyone who can tell me another, less invasive, and if possible less illegal=
=20
way of dealing with this.
Regards,
=2D-=20
Jure Koren, n.i.
--nextPart3101647.FAstZAkubt
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQBD/Wv59iFCvmuhrCIRAnEfAJ48oHrC/08BAOS6EADMGFHE/1UJcwCeP990
u0TNr6unOLzo5I0RbJH8rH0=
=dlcN
-----END PGP SIGNATURE-----
--nextPart3101647.FAstZAkubt--
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Monday 20 February 2006 22:39, Bigby Findrake wrote:
> Perhaps this is beating a dead horse, but could someone explain to me why
> the addition of a $50 computer found at a garage sale, a $10 NIC, and a
> $20 switch or hub to any would-be-infosec's arsenal wouldn't suffice for
> this purpose? We're not trying to brute force 4 kilobit pgpkeys, we're
> trying to present a host to attack. FreeBSD, NetBSD, OpenBSD, Linux...
> all free operating systems. Isn't there an x86 version of solaris that's
> free? $500 computers aren't needed for this testing. I suggest that the
> necessity for more expensive hardware is the exception, and not the rule.
> Bochs may not be speedy, but it works.
This is only OK for examining stuff you _can_ get your hands on.
> I would also suggest that anyone who finds that money is an obstacle is
> looking for excuses. I have often found ways to make outdated hardware
> useful in a variety of situations.
Money can't buy you software an online content provider has made themselves=
=2E I=20
have discovered a vulnerability in an online public telephone directory onc=
e.=20
The vulnerability was definitely not discovered by accident. I had browsed=
=20
through their HTML sources and found a number of things suggesting the=20
completely braindead way to do security without any real checking of user=20
input. I have written an exploit, sent it to them, waited to no avail, and=
=20
then published it. I never let myself run that exploit, but somebody must=20
have, because after publication, the site was down for three full days, and=
=20
when it was back it wasn't vulnerable anymore.
Whoever fixed it was actually a good, security conscious programmer and I h=
ope=20
he made a lot of money. I was trying to protect subscriber customers whose=
=20
accounts were trivial to compromise (and this was already happening on a=20
regular basis) to gain access to their own personal address books.
If the service provider couldn't provide the security, the customers had no=
=20
choice (since there is only one telephone services provider in the entire=20
country) and there is no way to tell the provider that they have a problem=
=20
without getting busted, well, what do you suggest?
I think it's not a case of "breaking and entering", but rather a case of "y=
our=20
windowsill flowerpot is about to fall on one of your customers, and I'm goi=
ng=20
to move it". I make no mistake that this is in fact illegal tampering with=
=20
someone else's property, but I can tell it's quite ethical to politely forc=
e=20
the provider in question to fix their security, because security experts'=20
responsibility lies with everyone adversely affected by a particular proble=
m,=20
not just the owner of a service.
I think this is a good example of when you just can't do a wholly responsib=
le=20
thing. Walking away is not an option because users are at risk. Talking to=
=20
the provider is only an option when they talk back. Proof of concept is,=20
unfortunately, one of the few options left open. I would like to hear from=
=20
anyone who can tell me another, less invasive, and if possible less illegal=
=20
way of dealing with this.
Regards,
=2D-=20
Jure Koren, n.i.
--nextPart3101647.FAstZAkubt
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQBD/Wv59iFCvmuhrCIRAnEfAJ48oHrC/08BAOS6EADMGFHE/1UJcwCeP990
u0TNr6unOLzo5I0RbJH8rH0=
=dlcN
-----END PGP SIGNATURE-----
--nextPart3101647.FAstZAkubt--