RE: Publishing exploit code - what is it good for

[Marvin Simkin <Marvin.Simkin () asu edu>]

While performing penetration testing at the request of a Fortune 500
financial services company, I discovered a vulnerability that, if
abused, could have been used to initiate fraudulent funds transfers,
stock market transactions, etc.

The client was skeptical when told the exploit could occur in a matter
of two or three seconds, go unnoticed by the victim, and gain such
comprehensive unauthorized access. At the client's request, I wrote a
proof-of-concept exploit that demonstrated everything except the final
fraudulent action, but made it clear that exposure was only one more
tiny step away. The client overcame their skepticism.

While this particular exploit was not published, it shows a real-world
"end-user organization [with] legitimate needs for exploit code"
resulting in greater security for all customers of this organization.
Another penetration tester in similar circumstances might be able to use
or adapt a published exploit instead of writing a new one from scratch.

Marvin Simkin
http://simkin.asu.edu/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/