Re: Pentester convicted..

[bofn <bofn () irq org>]

Hi Craig,

I rather not get into nasty and costly fights with corp's & govt's.
mostly since i simply don't have the money to defend my self in their self protection tailored system.

I was thinking more of public humiliation of sorts.
like putting the name of the company/organisation and the number and severity of issues in a public place,
 putting a day counter next to it to show how long they leave it un-resolved after being notified, 
 with giving them 24h or so hours grace period to push the message past a few desks up the chain.

and thus politely forcing them take responsibility for the protection of privacy of the data they carry.
this method seems to work better then any other i've seen so far, but only works if its backed by a group of 
individuals, so they cant single out one person to pick on with brute force. 

Because i could not care less if they lose their systems and loads of money when they chose to ignore the facts.
But I Do Care a lot about innocent people getting to pay the price for their neglect. 

Cheers
*Anna.

To the moderator:
 this discussion hits the core issues of our profession, i think.
 if you need to censor opinions, then at least put in the effort to extract the relevant parts from possible flames and 
other deemed irrelevant communication, and publish just those sections !

this is a rather emotional subject since it threatens us all, so some forms of rants and tears are to be expected, 
after all , we are still human.




#-----------------------------------#


On Fri, 12 May 2006 09:27:11 -0400
"Soderland, Craig" <craig.soderland () sap com> wrote:

> What is the option? 
>
>       Take back the streets. Inform said company of the flaw, note to
> them that they have been put on notice and if the flaw is not fixed
> within a reasonable amount of time that you will hold them liable for
> any use or misuse of your information. 
>
>       Now if they do not do anything to correct the situation and your
> information gets exposed, they are guilty of negligence/gross negligence
> which should be easy to prove. 
>
>       At this point hire a lawyer and sue sue sue the bastards, if
> enough people take this tack, then companies will take notice and
> actually do something. 
>
>       Remember no company is motivated by altruistic reasons, unless
> there is a clear ROI to do something then they simply will not as there
> is no benefit to the cost put forth to fix the issue. 
>
>       They on the other hand do understand money and when you go and
> take it away from them they tend to take notice. 
>
>       Cheers. 
>
> -----Original Message-----
> From: bofn [mailto:bofn () irq org] 
> Sent: Thursday, May 11, 2006 4:33 AM
> To: pen-test () securityfocus com
> Cc: bill.hancock () isthmusgroup com
> Subject: Re: Pentester convicted..
>
> On Wed, 10 May 2006 09:20:22 -0500
> William Hancock <bill.hancock () isthmusgroup com> wrote:
>
> > Hey there pen-testers, take this with a grain of salt, it just got me
> > excited.  I am really interested in everyones opinion on the matter or
> > corporate responsibility and ownership.
>
>
> Hello Welliam,
>
> <my rant>
> I'm afraid that this a sign of the times.
> the motto these days is "Shoot the messenger!"
> the corporates have taught the governments who have shown the people in
> the street.
> the fact is that one can get jailed for picking up a wallet that is not
> clearly yours by many laws these days, and the intention of returning it
> to either the owner or the law enforcers is made irrelevant. 
> mostly because the enforcers are taught that nobody can be trusted and
> is to be deemed guilty of the worse case scenario until he/she can prove
> innocence.
> and when is the last time we have seen a CEO or equivalent figure
> voluntary take ownership of an embarrassing issue?
> </my rant>
>
> I have had many cases where the company/organisation simply does not
> want to know that there is a flaw or wide open door.
> one of my recent ones was with this lists sponsor, who after repeatedly
> informing of a flaw in their website scripts replied with just a one
> line PR answer "We are investigating the issue and should have it
> resolved very soon.".
> they are simply not interested in the details of whats wrong with their
> systems, and ignored the first 2 reports.
> only after getting a bit more pushy the 3rd time their PR person
> responded.
> i got more pushy because the flaw still existed weeks after i reported
> it the first time and the flaw can be used in a way that affects me.
>
> This is very typical
> . most organisations don't respond at all when someone reports a flaw /
> open door.
> . some give a Public Relations "All is fine on the western front, go
> back to sleep" reponse.
> . some get very aggressive, and respond with threads and insults.
>
> until now i've only had positive responses from tiny organisations with
> no more then 5 people.
> even organisations like unions, human rights, nonprofit and local public
> interest  react like the multinational companies.
> <rant>
> Their view seems to be "that person must want something from us, Or
> she/he must be a lunatic".
> they simply cant seem to understand that there are still people who use
> their knowledge for the good of their environment without wanting to
> financially better them selves from it.
> This sums up the monolithic doctrine of the Corporates which these days
> include the 'privatised' governments.
> </rant>
>
> > What are we to do as a community I ask?
> Maybe a public forum, which can become an authority to be renowned for
> its integrity, can have some positive impact.
> Something like a guild, so its no longer the voice of single dissident. 
>
>
>
> With friendly greetings 
> *Anna.
>
> Ps.
> ;-) the guild's motto could be "Free means Free for all" but then in
> fancy latin with a cute logo. 
>
>
>
>
> --
> "The disappearance of a sense of responsibility is the most far-reaching
> consequence of submission to authority."
>
>
> #--------------------------------# 
> > <RANT>
> > In an article posted to slashdot today
> > (http://it.slashdot.org/article.pl?sid=06/05/10/112259&from=rss) a man
> > has been convicted of hacking when he casually and helpfully reported
> a
> > security vulnerability to the owners of a web site, in this case The
> > University of Southern California.  It reads like it was some sort of
> > simple SQL injection and upon gleaning the information he reported it.
> >
> > What are we to do as a community I ask?  We should we, the good guys,
> > who are paid for our knowledge and ability to exploit mistakes,
> > oversights, and weaknesses then professionally report them to aid in
> the
> > securing of information capital (or anyone who reports the flaw for
> that
> > matter) worry about prosecution.  It lends itself to a forcing the
> > technical community to sit on their laurels and wait for the people
> who
> > don't report issues to exploit them.  Further it sounds very clear
> that
> > had he not notified them, they would have never known.
> >
> > A security pro notices a flaw, checks to make sure he is not on crack
> by
> > 'flipping a bit', deems the threat viable and is likely to be
> exploited,
> > notifies the owners, then get arrested and charged with unauthorized
> > access.  We, as a or even The security community, should push
> > corporations, governments, and organized body's to take responsibility
> > and ownership of their problems.  If they publish a site that is
> flawed
> > or exposing information then they are authorizing the retrieval of
> that
> > information.  I'm not advocating that they laws should allow any jerk
> to
> > try and brute his or her way in to a public or private web site, but
> > come on.
> >
> > If someone leaves their wallet in the park with no guard or
> protection,
> > I pick it up and bring it back to the owner, the owner didn't want me
> to
> > have it but I brought it back to him.  Why in the hell should I have
> to
> > go to jail for returning it to him, why should I/we be punished for
> > doing the right thing?
> >
> > I acknowledge this to be a rant but there must but some way to insist
> > that when people make something available to the public that it is
> their
> > responsibility to safeguard it and appreciate not persecute someone
> who
> > let's them know (for free I might add) that a weakness exists.  This
> is
> > simple scapegoating, the University did something not advisable as a
> > good practice and instead of owning up to it they villafied a
> > professional pen-tester for offering valid advice.
> >
> > </RANT>
> >
> >
> > Thanks,
> > Bill
>
> ------------------------------------------------------------------------
> ------
> This List Sponsored by: Cenzic
>
> ------------------------------------------------------------------------
> ------
> This List Sponsored by: Cenzic
>
> Concerned about Web Application Security? 
> Why not go with the #1 solution - Cenzic, the only one to win the
> Analyst's 
> Choice Award from eWeek. As attacks through web applications continue to
> rise, 
> you need to proactively protect your applications from hackers. Cenzic
> has the 
> most comprehensive solutions to meet your application security
> penetration 
> testing and vulnerability management needs. You have an option to go
> with a 
> managed service (Cenzic ClickToSecure) or an enterprise software 
> (Cenzic Hailstorm). Download FREE whitepaper on how a managed service
> can 
> help you: http://www.cenzic.com/news_events/wpappsec.php 
> And, now for a limited time we can do a FREE audit for you to confirm
> your 
> results from other product. Contact us at request () cenzic com for
> details.
> ------------------------------------------------------------------------
> ------

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------