Where do sites like Cert.org get their exploit information?
I look at www.cert.org just about every day to see what new vulnerabilites are up and about. They seem to update their site about new vulnerabilites fairly quickly (at about the same speed as MS does, maybe a bit sooner) and verify their statements not only via other sources but by claiming that exploit code is publicly available.
Out of curiosity and because I am studying to become a network security professional, I was curious as to how sites such cert discover these exploits and exploit code that is publicly available. Do they have dedicated people focusing on certain aspects of security in the OS constantly hammering away until they find a problem? I'm sure paroozing around for hacker sites is blah and risky, opening yourself up to exploit.
Any thoughts? Maybe I just lack common sense on this topic, but its fascinating I think.
Thanks
toxic.influx
Re: Where do sites like Cert.org get their exploit information?
Quote:
Originally posted here by toxic.influx
I look at www.cert.org just about every day to see what new vulnerabilites are up and about. They seem to update their site about new vulnerabilites fairly quickly (at about the same speed as MS does, maybe a bit sooner) and verify their statements not only via other sources but by claiming that exploit code is publicly available.
Out of curiosity and because I am studying to become a network security professional, I was curious as to how sites such cert discover these exploits and exploit code that is publicly available. Do they have dedicated people focusing on certain aspects of security in the OS constantly hammering away until they find a problem? I'm sure paroozing around for hacker sites is blah and risky, opening yourself up to exploit.
Any thoughts? Maybe I just lack common sense on this topic, but its fascinating I think.
Thanks
toxic.influx
While CERT does a lot of testing on their own and they have found some vulnerabilities most of their information comes from other internet sources, such as bugtraq, or vendor security lists. They will usually confirm the information in their own labs and provide more detail if they can. They also get a lot of information from people emailing vulnerability information directly to them.
They do have people working there full time to look for information that is on the web, or to confirm what is being written on other sites. Their FAQ answers some of the questions. It is a federally funded organization at Carnegie Mellon.
http://www.cert.org/faq/cert_faq.html
