Date: Fri, 23 Jun 2006 20:30:54 -0500 (CDT)
From: Gadi Evron <ge@linuxbox.org.>
To: [email protected]Subject: Amazon, MSN vulns and.. Yes, we know! Most sites have vulnerabilities
Message-ID: <Pine.LNX.4.21.0606232023040.10824-100000@linuxbox.org.>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.7.5 (linuxbox.org [127.0.0.1]); Fri, 23 Jun 2006 20:30:54 -0500 (CDT)
X-Virus-Scanned: antivirus-gw at tyumen.ru
In this post I link to a blog entry by a guy (dcrab) who does some show
and tell about Amazon and MSN. You gotta love Full Disclosure. Full
Disclosure and why bugtraq is here is what I talk about. Just skip my text
to the end for that information.
So, yes, we know. Thanks. Yes, we know. Most sites have
vulnerabilities. Most sites don't fix them. All you have to do is pick one
arbitrarily and find them after a second to a few minutes of search.
Recently I exchanged some words on exactly this subject with Scott Chasin
(started bugtraq back in `93). This is why Full Disclosure was originally
done and part of why bugtraq was originally created. People don't often
remember why, and today attack the concept of Full Disclosure and say that
it is irresponsible to disclose vulnerabilities that way.
On some levels, I agree, but nothing is black and white even if I often
think it is.
Some companies take security seriously. Reporting to them works. Some
companies (at BEST) ignore you. Back then most companies ignored. Back
then Full Disclosure was THE silver bullet and THE solution. I recently
had the chance to discuss this with Aleph1 as well. He who strongly
believes in Full Disclosure agrees it's a different world now.
Today, the same situation is repeated with new fields. Game companies,
critical infrastructure (such as with SCADA systems), etc. who now
discover the world of vulnerability research don't know how to deal with
it. It is interesting to watch how the world of security repeats its
history.
When someone releases the information it is a fact that everyone goes and
attacks the site or builds a POC. When someone provides only with the name
of the site or skeleton details of vulnerabilities... everyone goes and
looks for what they know is there.
Back a few months ago a kiddie tried to sell an Excel vulnerability on
FD. Now, I am not sure if this is completely related but a few months
after that Microsoft released several patches for Excel. This month we
have had Excel 0days.
In the world of web security the situation is more extreme. Release the
bug? Everyone will exploit it. Release the site name? Everyone will find a
bug there TODAY.
The point is, though, that these vulnerabilities have always been there,
and they have been exploited before. We just didn't know about them. And
people are surprised when corporations and sites are broken into and their
personal data is stolen?
Here is a blog post of a guy who got sick of reporting vulnerabilities,
and after years of trying (look at the dates), finally made a small
release about MSN and Amazon (although other interesting sites are listed
there.
http://blogs.hackerscenter.com/dcrab/?p=19
Noam Rathaus recently wrote about a similar issue ("From Flaw to
Exploit"):
http://blogs.securiteam.com/index.php/archives/449
I contacted both Amazon and MS, but this is out there and once it's out
there - it's, well; out there. Full disclosure, y'know.
Gadi Evron.
