Re: Vulnerabilities in *McAfee.com

[Ryan Sears <rdsears () mtu edu>]

Agreed, If you put your site on the open internet, you have to take into account the inherent hostilities that go along 
with that action. 

A security firm like Mcafee /knows/ about these vulnerabilities. Guaranteed. If they offer services to make other's 
sites 'hacker proof', their first order of business should make sure that their infrastructure doesn't have blatantly 
obvious security holes. I'm not saying that they should catch EVERYTHING, but these are bugs that an automated scanner 
could easily pick up. I do understand that  a large infrastructure like theirs has pages that have been created by 
people with varying degrees of competence, but that's why they need to do inclusive penetration tests of their own 
network. At the very least they need to have some mechanism in place to detect (and possibly defer) these sorts of 
attacks. 

The way I see it, when a company hides behind legal threats to deter people from finding and reporting bugs, all 
they're doing is hurting themselves. Look at how Microsoft has turned around. 10 years ago they weren't dealing with 
people reporting issues in the right way, but they soon came to realize that by listening to the hackers that ARE 
coming forward with issues, they not only help themselves, but help the community as well. It's a win/win scenario for 
EVERYONE. 

You can tell a vast amount about how an infrastructure is run from just a bit of poking. If there are blatant security 
holes everywhere, then they clearly don't take security seriously. If they filter for SQL injections in javascript, 
then the dev's have no clue what they're actually trying to do. If you see SQL errors, chances are there are more 
serious issues to boot. I usually limit my poking to the very basic of basics when I do use a new service, and the more 
transparent they are (think reddit) the more I trust them. They even have a full subreddit devoted to finding and 
learning about XSS attacks. One word, awesome. 

Simply put, in my opinion you can't blame a pen-tester for looking for bugs in a site. The only time it should be 
considered malicious is when it's used in a malicious way. If I find a XSS in a webform, and I report it along with 
re-mediation suggestions I feel as though I'm doing the site a favor. It's unfortunate to think that some see this as a 
criminal activity. 

Ryan

----- Original Message -----
From: "Jeffrey Walton" <noloader () gmail com>
To: "Thor (Hammer of God)" <thor () hammerofgod com>
Cc: "Ryan Sears" <rdsears () mtu edu>, "full-disclosure" <full-disclosure () lists grok org uk>
Sent: Wednesday, March 30, 2011 5:28:59 PM GMT -05:00 US/Canada Eastern
Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor () hammerofgod com> wrote:
> I have that very strip printed and on the wall in my office :)    You make several points, but the response that 
> immediately comes to mind is that I actually see a difference between actively scanning content for structural/coding 
> vulnerabilities, and entering data in a search box.  I don't know if there is any basis for this legally, but I feel 
> that if you put a box up and I can search for something, then I can put whatever I want in that box.  You (the royal 
> you) are basically soliciting people to put data in the box.   However, you are not asking anyone to spider your site 
> or run scans against it.
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/