Printable View
Latley there has been posted a few tutorials explaining how to exploit certain security holes in software and web-sites.
I wonder if AO's members by doing this are helping crackers, making it easier for them to do a successful crack. Perhaps it may be wise to leave out some details, so the tutorial actually wont work the way it's written, but only explains the security hole. Or should all juicy details be included?
May I have your opinion, ladies and gentlemen?
I think it sucks, i have to laugh tho, half of the tuts are so badly written its hilarious - its just lamers trying to show other lamers how to be lame.
I'm thinking if someone writes a 'tutorial' it should be reviewed and cleared (if it's not already, I haven't written anything) by someone on the AO staff, much like the user accounts are. This way, if you write something and it's a "how to hack (name here)", there's a good chance it won't be allowed in, or maybe the reviewer could remove the "here's how to break this" part and keep only the problem part. I don't condone the writing of a how-to-hack tutorial/etc but if it gets an unknown problem out in the open, workarounds can be done. I'd be MUCH more impressed if the person wrote a tutorial on something, said how they broke it, and then said how you can *fix* the problem. THAT would be good. But then again, people trying to learn how to "hack" don't seem to understand that point.
I've noticed a lot of talk about lamers and stuff lately. I don't ask questions just for the fun of reading the replies. I am a college student (NetSysEng) and I am still somewhat of a newbie to security issues. I ask what I need to know; nothing more. I'm not afraid to read the material Ennis or Focmaester or petemcevoy says I should. Not all of us are here for the wrong reasons fellas.:cool:
Well, the problem here is that the door DOES swing both ways. I can see it could cause problems if crackers are able to use the information for their own benefit, but also think that posting the juicy details could help a programmer shape up his or her code, or a SysAdmin lock down his or her network.Quote:
Originally posted by proactive
Latley there has been posted a few tutorials explaining how to exploit certain security holes in software and web-sites.
I wonder if AO's members by doing this are helping crackers, making it easier for them to do a successful crack. Perhaps it may be wise to leave out some details, so the tutorial actually wont work the way it's written, but only explains the security hole. Or should all juicy details be included?
May I have your opinion, ladies and gentlemen?
As long as there are some people benefiting for the good, then I have no problems with having exploits detailed.
I understand though, that in the context of a tutorial, it might be better to write tutorials from the standpoint of 'this is how to prevent these exploits from working', etc..
Personally, I think posting code that is entirely malicious is way over the line. AntiOnline bills itself as a site that is geared towards helping people understand how to protect themselves from crackers, yet it's allowable for malicious code to be posted in the forums with no recourse?
To me, that's only promoting script-kiddies. It's tantamount to saying "Here's a script that will hack hotmail for you. Download it and run it!"
proactive, seeing as how this is a security site, it is necesary that we hear about in detail the exploits available for our computer systems so that we can properly protect against these problems. A good example is the thread of hacking cgi-bins. This is a place where many often times leave password files that cant be protected. By displaying what crackers would do to exploit our systems, we can fix them so that they are more secure, and test the systems using the exploit to be sure that it doesnt have these holes. I believe that most of the exploits posted here have been available for quite some time, and even if not posted here, they could be found using web searches. I am all for full disclosure concerning security threats so that the problem could be fixed as soon as possible.
sorry
I agree 100% with ThePreacher.Full disclosure and discussion (and solutions) is the basis of the open source community that we know and love.
Pete is also right
Quote:
I think it sucks, i have to laugh tho, half of the tuts are so badly written its hilarious - its just lamers trying to show other lamers how to be lame.
Hillbilly75 & thepreacher -- I don't think you fully understood my post, i never mentioned any names but i'm pretty sure anything that ennis or focmaester post is pretty useful. A lot (say, half) of the tutorials are an excellent source of information, however, tutorials telling people how to map windows file/print shares or get someones ip when using instant messaging are a pile scwipt kiddie ****, don't try to tell me these are to give people a greater understanding of security risks, they're just step by step instructions for lameness.
petemcevoy could be right
Yup, I agree with ThePreacher. Most information about security holes is already out there on the net, and it doesn't matter if it's posted here as well. But I hope that if any of you guys find sites or servers out there with a security flaw, you tell the owner before you go post information anywhere! But I spose you all thought of that already. :)
Thats a great attitude - well the stuffs already out there so whats the harm in putting it up here. What a load of **** - if you're not part of the solution you're part of the problem.
Well, I see what you mean to Pete. My attitude is a little like "because there's so much drugs out there, it doesn't matter if I sell some too". But if selling drugs could help some people stay away from drugs, I think I could use that as an excuse.
This is difficult, though.... Maybe we should leave out some juicy details after all?