A very important link...

Normally I save links for my "Mubix Links" blog to keep the clutter down on this one, but I think this is one that I would like to highlight as important. The NFO, credits and summary to this copyrighted video is what I wish to highlight.

http://thepiratebay.org/torrent/5573874/Hackers_Wanted_%282008%29

I am against the misuse of copyrighted material, and it is a violation of laws in many countries, including my own.

I really wish this video would have been published, I'm sure it would have been a very interesting video, that I definitely would have purchased.

Vuln Disclosure Summarized

I have an admittedly limited view of the exploit dev world. However, from what I've seen devs have very few options: (Please correct me if I'm wrong)

"Responsible Disclosure" =>

- Direct Contact => depending on the size of the vendor and their view on security, this could result in anything from a simple thanks, a reward, to a court hearing.

- Exploit Broker => possibly sell, possibly not, depends on the broker. The vuln could die on the table or stolen due to too much information being given during negotiations. This route has the same financial risk as direct contact, but a lot less risk of getting sued.

- ZDI (or other vuln clearing house) => "instant" cash, but admittedly less than an Exploit Broker could possible get based on the financial risk to ZDI. Close to zero risk of court time (they may come after you for selling the exploit). And a lot less financial risk since (IIRC) they pay up front. But then the vulns go to also undisclosed parties, potentially the highest bidder which is probably not the vendor.

- "other" secretive groups who share vulns for different reasons...

- Just to friends => No cash, no judicial risk, but you do risk them stealing/selling your exploit.

"Full Disclosure"

- Posting it to the web for all to see/user => Possible court time, but the definite upside is the vendor is forced to react. A very quick way to make enemies.

- Releasing at a conference => Probable court time.

"No Disclosure"

- Keeping it to yourself => Working under the assumption that your the only one that has found that same bug is still semi relevant due to the incredibly small size of the exploit dev community. However, as Dave said, they'll be toasting to their sleeping dead 0days some day.

"No More Free Bugs"

- My stance on this is split, while I think people should get paid for their work, I relate this movement to mowing someone's lawn and then ringing their doorbell and asking for money. However I'm sure Robert Graham's punch in the face metaphor also works.

//

Like, I have stated above, I am far and away a newbie to the vuln disclosure world and this debate has been going on since before I owned my own computer, but with the brilliant minds working at it, why doesn't anyone offer up a solid solution to it?

My solution? Create a standard, something that we all abide by. I know as hackers we rebel against such things but in the interest of getting better security out there (yes, that's what we are here for right?.... right?) we should should really work together on this. What sounds right?

I mean, what is the right way to approach someone who's lawn you've mowed for the work you have done? Maybe free for open source projects, and a price based on exploitability and market share of the affected product?

For reference:

Vuln Trading Markets and You by Michal Zalewski (lcamtuf):
=> http://lcamtuf.blogspot.com/2010/04/vulnerability-trading-markets-and-you.html

Vuln Disclosure is Rude by Robert Graham:
=> http://erratasec.blogspot.com/2010/04/vuln-disclosure-is-rude.html

No More Free Bugs movement by Charlie Miller, Alex Sotirov and Dino Dai Zovi:
=> http://trailofbits.com/2009/03/22/no-more-free-bugs/

Dailydave Post by Dave Aitel:
=> http://lists.immunitysec.com/pipermail/dailydave/2010-April/006100.html

--
Rob Fuller | Mubix

Security (CAN BE) an ART not a SCIENCE

This is far from a new idea, however it’s not something that is easily provable. So I had an idea this morning. I posed the following question on Twitter:

You know what I got in return? a resounding “No” from everyone. (well I had one outlier but, who doesn’t when you are trying to apply science to prove art) I challenge you to name another non-artistic career that people are so passionate about that they would stay in it even if they won the lottery.

Here are a few that I would like to highlight:

@schuetzdj

@TomSellers

@ethicalhack3r

@dookie2000ca

This was a somewhat surprising outcome. See a trend? Most people wanted to quit their jobs, and start their own infosec company. Why is this? Is it just “The American Dream” or is it because they are unhappy with the current people in leadership? Or is it simply the fact that they are hindered from actually pursuing and learning hacking/security at work? The world may never know, but I do implore firms to look at the retention rate of their _actual_ talent. (No, I don’t buy into the No Infosec Peep left behind bull).

There is a rumor that Google has a practice. 2 hours a day, you (an employee of Google) are REQUIRED to work on a project of your own, that is in no way indebted or owned by Google, even after completion. I can imagine the above answers would change if that were the case where they worked. If their employers fostered learning.

As a result of Infosec / Hacking being an art, do we have our premadonas? Of course. But do we also have our Van Gogh's and Michelangelo's? Definitely.

But, time for a bit of a reality check:

@daveshackleford

 

Ya, you have NO idea what you would really do with millions of instant cash. I think the number is some 80% of lottery winners go BANKRUPT in the first 10 years. This is because you, and EVERYONE you have ANY connection to, goes absolutely crazy. To the point that there are lottery winner support groups.

However, the fact that people say it now, shows that they at least have the passion for the art. (or are just fronting)

Here some honest answers to even out the tide:

@shmoosr

 

@Bolster

@andrewsmhay

In conclusion, I believe that hacking is a science, until passion adds the artistic fire to the mix. At least that’s what I think, draw your own conclusions.

(That’s another thing I love about this field, you are constantly challenged to draw your own conclusions, to think, to learn, to improve, to be… better)

grmn00bs podcast

I was recently on the grmn00bs podcast, I had a great time, and I can't wait to see who they pick up next on their series:

grmn00bs podcast: episode 9

"When they were n00bs Series"

Show Notes:

hak5 is one of the original security shows. Rob has been featured on several segments.
Twit Netcast Network with Leo Laporte is another show that’s been around for a while.
Security Tube is the Youtube of security videos. This is where I’m at when I should be working. You might even find some GRM n00bs stuff rattling around there.
The Academy Pro is another excellent place to go for security training.
milw0rm has lots of exploits. It’s a good place to check out some old papers to brush up on security history.
NewOrder is another resource to get abreast of lessons learned in the past.
Jasager is the “Yes Man” Rob talks about in the show.
Chris Gates’s book list has some good ideas for security reading.
Syngress is a publisher of security texts. They have all my money.
Donate to Johnny Long.

Linked in to Twitter

If you hadn't noticed, LinkedIn has started allowing you to link your Twitter account to your LinkedIn account. So, I didn't know this (since I opted out), but apparently LinkedIn will kick your status updates to Twitter... like when you get a new job...

Privacy settings out the window! Woohoo for Web 2.0!