Full Disclosure mailing list archives
RE: Sapphire worm POC that fulldisclosure policies hurt everyone
From: "Jason Coombs" <jasonc () science org>
Date: Sun, 26 Jan 2003 09:43:33 -1000
Wait, it just occurred to me that you're missing a critical technical point in your knowledge of this debate. It's worth a couple paragraphs to help you understand. When a vendor releases compiled code (or source code, and which one is easier to analyze is at times debatable) everyone has a baseline starting point from which to conduct vulnerability analysis. This baseline is usually pretty large, but with a debugger and some knowledge it is very easy to find the most important parts of the software that control key input parsing and decision-making. This is because a debugger, combined with the ability to understand assembly language and knowledge of the structure of a process (stack, heap, values and purpose of CPU registers, etc.) gives infosec analysts everything they need to fully comprehend what the program is capable of doing and where it fails to properly manifest security precautions. This analysis takes time. Analyzing the whole baseline takes a lot of time. When a vendor releases a security patch or a service pack that includes some security bug fixes and some non-security bug fixes, it is very easy to compare the original baseline code with the updated code and pick out just those bytes that have changed -- it is here that the analyst now focuses their attention. This analysis takes far less time. Publishing security fixes without full disclosure of what's being fixed is absurd because it results in a few security analysts (some wearing white hats and some wearing black hats) having full knowledge of the vulnerability anyway. And then tools get built that exploit the vulnerability and the reverse engineering security analysis process results in full disclosure to the very small number of people who actually care and who can tolerate reading white papers written by black hats. According to your logic, vendors should never release security patches because doing so reveals the points of vulnerability in unpatched software. You've got a very good point, and I like it. No security patches = no full disclosure = everyone is safer. Should we publish full disclosure concurrent with the release of patches or should we publish full disclosure in advance of patches? This is the only point that is debatable, and there is no right answer -- it's a rhetorical question asked and answered merely to help people who have the power to publish full disclosure to decide which approach they prefer and follow it. Sincerely, Jason Coombs jasonc () science org -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of methylketone () hushmail com Sent: Saturday, January 25, 2003 1:10 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] Sapphire worm POC that fulldisclosure policies hurt everyone -----BEGIN PGP SIGNED MESSAGE----- THE FULLDISCLOSURE PHILOSOPHY: Vulnerability gets released on mailing lists Admins patch machines <- IMPORTANT PART! Internet is secure! I hear alot of arguments put out by the naive in favor of fulldisclosure of vulnerability information. But the fact is, fulldisclosure policies hurt everyone, and this time, they have wreaked havoc across the entire internet. The ms-sql vulnerability has been known to the public for six months. If the fulldisclosure philosophy were correct, the vulnerability would have been patched by the vast majority of admins out there. However, that isn't what happened. Thousands of machines were compromised and it lead to a massive internet-wide loss of service. There are alot of attacks against the competency of administrators who failed to put their databases behind their firewall, and also failed to patch their machines, but fulldisclosure operates on the assumption that all administrators are going to find out about the bug and patch their machines. The fulldisclosure philosophy is flawed. The vast majority of those reading this message probably won the scriptkid/admin race of patching vs being compromised. But today, that didn't stop the destructive power of this worm. Today's denial of service was mostly caused by smaller enterprises with less competent administrators. The message is "pay up to the security consultants or your machines get owned". I would be more okay with this if it were just the machine's owners that got affected, but it's the entire internet. Get a clue, your actions have consequences. If the ms-sql bug had never been disclosed, and was slipped quietly to Microsoft, this never would have happened, and the same responsible administrators would have upgraded their software. The odds are, those same responsible administrators have had their database servers behind a firewall anyways, so this is all irrelavant. This catastrophe was caused solely by the disclosure of vulnerability information. I urge you to be more responsible with your actions in the future. The stability of the entire internet is at stake. -----BEGIN PGP SIGNATURE----- Version: Hush 2.2 (Java) Note: This signature can be verified at https://www.hushtools.com/verify wmEEARECACEFAj4zGT0aHG1ldGh5bGtldG9uZUBodXNobWFpbC5jb20ACgkQsX0pyCcw k+BI0ACgh/KwGDbK2C2EH7rszBKQ+yHKOp4AoLPlppnkMg1Tw2pB7dqq46pWGQox =ym30 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Sapphire worm POC that fulldisclosure policies hurt everyone methylketone (Jan 26)
- Re: Sapphire worm POC that fulldisclosure policies hurt everyone KF (Jan 26)
- RE: Sapphire worm POC that fulldisclosure policies hurt everyone Jason Coombs (Jan 26)
- Re: Sapphire worm POC that fulldisclosure policies hurt everyone Simon Richter (Jan 26)
- RE: Sapphire worm POC that fulldisclosure policies hurt everyone Jason Coombs (Jan 26)
- Re: Sapphire worm POC that fulldisclosure policies hurt everyone yossarian (Jan 26)