Re: Pentester convicted..

[bofn <bofn () irq org>]

On Wed, 10 May 2006 09:20:22 -0500
William Hancock <bill.hancock () isthmusgroup com> wrote:

> Hey there pen-testers, take this with a grain of salt, it just got me
> excited.  I am really interested in everyones opinion on the matter or
> corporate responsibility and ownership.


Hello Welliam,

<my rant>
I'm afraid that this a sign of the times.
the motto these days is "Shoot the messenger!"
the corporates have taught the governments who have shown the people in the street.
the fact is that one can get jailed for picking up a wallet that is not clearly yours by many laws these days, and the 
intention of returning it to either the owner or the law enforcers is made irrelevant. 
mostly because the enforcers are taught that nobody can be trusted and is to be deemed guilty of the worse case 
scenario until he/she can prove innocence.
and when is the last time we have seen a CEO or equivalent figure voluntary take ownership of an embarrassing issue?
</my rant>

I have had many cases where the company/organisation simply does not want to know that there is a flaw or wide open 
door.
one of my recent ones was with this lists sponsor, who after repeatedly informing of a flaw in their website scripts 
replied with just a one line PR answer "We are investigating the issue and should have it resolved very soon.".
they are simply not interested in the details of whats wrong with their systems, and ignored the first 2 reports.
only after getting a bit more pushy the 3rd time their PR person responded.
i got more pushy because the flaw still existed weeks after i reported it the first time and the flaw can be used in a 
way that affects me.

This is very typical
. most organisations don't respond at all when someone reports a flaw / open door.
. some give a Public Relations "All is fine on the western front, go back to sleep" reponse.
. some get very aggressive, and respond with threads and insults.

until now i've only had positive responses from tiny organisations with no more then 5 people.
even organisations like unions, human rights, nonprofit and local public interest  react like the multinational 
companies.
<rant>
Their view seems to be "that person must want something from us, Or she/he must be a lunatic".
they simply cant seem to understand that there are still people who use their knowledge for the good of their 
environment without wanting to financially better them selves from it.
This sums up the monolithic doctrine of the Corporates which these days include the 'privatised' governments.
</rant>

> What are we to do as a community I ask?
Maybe a public forum, which can become an authority to be renowned for its integrity, can have some positive impact.
Something like a guild, so its no longer the voice of single dissident. 



With friendly greetings 
*Anna.

Ps.
;-) the guild's motto could be "Free means Free for all" but then in fancy latin with a cute logo. 




--
"The disappearance of a sense of responsibility is the most far-reaching consequence of submission to authority."


#--------------------------------# 
> <RANT>
> In an article posted to slashdot today
> (http://it.slashdot.org/article.pl?sid=06/05/10/112259&from=rss) a man
> has been convicted of hacking when he casually and helpfully reported a
> security vulnerability to the owners of a web site, in this case The
> University of Southern California.  It reads like it was some sort of
> simple SQL injection and upon gleaning the information he reported it.
>
> What are we to do as a community I ask?  We should we, the good guys,
> who are paid for our knowledge and ability to exploit mistakes,
> oversights, and weaknesses then professionally report them to aid in the
> securing of information capital (or anyone who reports the flaw for that
> matter) worry about prosecution.  It lends itself to a forcing the
> technical community to sit on their laurels and wait for the people who
> don't report issues to exploit them.  Further it sounds very clear that
> had he not notified them, they would have never known.
>
> A security pro notices a flaw, checks to make sure he is not on crack by
> 'flipping a bit', deems the threat viable and is likely to be exploited,
> notifies the owners, then get arrested and charged with unauthorized
> access.  We, as a or even The security community, should push
> corporations, governments, and organized body's to take responsibility
> and ownership of their problems.  If they publish a site that is flawed
> or exposing information then they are authorizing the retrieval of that
> information.  I'm not advocating that they laws should allow any jerk to
> try and brute his or her way in to a public or private web site, but
> come on.
>
> If someone leaves their wallet in the park with no guard or protection,
> I pick it up and bring it back to the owner, the owner didn't want me to
> have it but I brought it back to him.  Why in the hell should I have to
> go to jail for returning it to him, why should I/we be punished for
> doing the right thing?
>
> I acknowledge this to be a rant but there must but some way to insist
> that when people make something available to the public that it is their
> responsibility to safeguard it and appreciate not persecute someone who
> let's them know (for free I might add) that a weakness exists.  This is
> simple scapegoating, the University did something not advisable as a
> good practice and instead of owning up to it they villafied a
> professional pen-tester for offering valid advice.
>
> </RANT>
>
>
> Thanks,
> Bill

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------