Duncan Simpson
24/05/06, 20:00
I think a more useful rating would be "how hard is this bug to exploit?",=
=
which could range from almost impossible (e.g. ssh v1 CRC32 checksum expl=
oit) =
to trivial (e.g. script kiddie exploit avialable). I know it would change=
over =
time, but it might give us some indication of the ETA for an exploit for =
the =
script kiddies.
Another measure that might be worth something is the level of tools requi=
red =
to find and exploit the bug. Plain AAAA....x10000 in obvious places sugge=
sts =
more problems than mishandling well crafted invalid HTTP requests.
Specially crafting your own word document to apply a buffer overrun explo=
it =
rates as quite hard IMHO. Factors that would boost the difficult rating w=
ould =
include requiring a valid user name and passowrd. (It is often easy to ki=
ck =
the backsides of those with a valid user name and password.)
While it might be possible to write a web server with A1 (formally verifi=
ed) =
security, I suspect the cost would be prohibitive and benefit small if th=
e =
underlying OS is less secure. The formal methods I know do not scale to =
anything of a significant size .
Just my $0.03
I have a PhD thesis featuring some of these methods (including a CSP =
anmlaysis of any network of the specified components). Related software a=
nd a =
copies are publically avialable.
-- =
Duncan (-:
"software industry, the: unique industry where selling substandard goods =
is
legal and you can charge extra for fixing the problems."
=
which could range from almost impossible (e.g. ssh v1 CRC32 checksum expl=
oit) =
to trivial (e.g. script kiddie exploit avialable). I know it would change=
over =
time, but it might give us some indication of the ETA for an exploit for =
the =
script kiddies.
Another measure that might be worth something is the level of tools requi=
red =
to find and exploit the bug. Plain AAAA....x10000 in obvious places sugge=
sts =
more problems than mishandling well crafted invalid HTTP requests.
Specially crafting your own word document to apply a buffer overrun explo=
it =
rates as quite hard IMHO. Factors that would boost the difficult rating w=
ould =
include requiring a valid user name and passowrd. (It is often easy to ki=
ck =
the backsides of those with a valid user name and password.)
While it might be possible to write a web server with A1 (formally verifi=
ed) =
security, I suspect the cost would be prohibitive and benefit small if th=
e =
underlying OS is less secure. The formal methods I know do not scale to =
anything of a significant size .
Just my $0.03
I have a PhD thesis featuring some of these methods (including a CSP =
anmlaysis of any network of the specified components). Related software a=
nd a =
copies are publically avialable.
-- =
Duncan (-:
"software industry, the: unique industry where selling substandard goods =
is
legal and you can charge extra for fixing the problems."