Re: Exploit Ease Level

[vision () WHITEHATS COM (Max Vision)]

On Tue, 25 Apr 2000, Rory Savage wrote:
> I wish there was an `Exploit Ease Refrence Level`, so when one posts an
> exploit, they would also post an `Easebility` level to let others know
> if it's an easy trick, or a drawn-out project that involves alot of
> time.  This is just a suggestion, but I think it would really work out well,
> especially for these mailing lists. But I know I am farting in the wind
> again... and nobody cares... but in a few months, somebody will steal my
> idea anyway (and call it their own).
>
> In fact, I just might draft up a proposal... and see that the `scene`
> think about it.
>
> Cheers!
Rory,

This is actually a really old idea that has been around at least in
commercial security scanners (such as Ballista/Cybercop) for some number
of years (sometimes refered to as "complexity").  I believe several
security groups are working these sorts of values into metrics of overall
risk levels for various vulnerabilities (alongside impact, popularity,
ease of fix, etc) - so when a hole is found, it gets a certain score for
these traits and an overall threat level is determined.

IMHO many times these values are dangerously wrong and can lead to
problems.  In some products I've seen "ease of exploit" listed as very
complex when I know it to be push-button easy.

Max