Printable View
Ok what's your opinon about posting vulnerability's. DO they help you patch your system. Or help hackers(crackers) break into them.I don't think it's wrong but, isn't hacking (cracking) all based on finding loophles, vulnerability's. Well it's good to know information, but should it be made available to everyone? I totally believe in free, and sharing so I will say that it does both it helps the hacker(cracker), and it also helps stop them.
This is a good question. I wonder sometimes whether when these security researchers find new loopholes, if they are actually the first person to find it, and have just advertised to everyone that "This is how you get around a software firewall." Their theory is that if they found the loophole, someone else would have found it too. Knowledge is power. If the people who post vulnerabilities didn't tell you about them, you would probably find out when someone uses them on you.
Speaking from personal experience, I think it is a good idea to post information on possible loopholes. If you are in a work environment, I think it is a good idea if your Sysadmin guy is aware of any current threats (having worked in that role I appretiate the warnings :D )
I agree admin's need to keep up-to-date on these matters or the h/cr/acker will be one step ahead at all time.
A good admin is one who keeps up with the h/cr/acker.
Great question. I would have to respond to that by saying that the attackers already have the information and are sharing it within their circles. I believe that security in general would be under much greater risk without the free and open dicusssion of security issues on the horizon, including the methods the exploits could be used to compromise a system. Not doing this borders on the concept of information police, normal law abiding citizens would be clueless, yet the attackers would still have and share their information underground.
In addition I think it has caused software developers to take more proactive steps in dealing with issues in their code. In free open exchange about exploits they really don't have much choice because everyone concerned knows what the problem is and if they fixed it. So, I think it not only aids in improving security as a whole, but also improves the software that we all use.
Quote:
Originally posted by Ennis
I agree admin's need to keep up-to-date on these matters or the h/cr/acker will be one step ahead at all time.
A good admin is one who keeps up with the h/cr/acker.
Admins are fighting a losing battle. Think about it. Most vulnerabilitys are posted by crackers in the first place.
So how do admins fight back to start winning the battle? If posting of vulnerabilities doesn't help even the playing field, what will?Quote:
Originally posted by Conf1rm3d_K1ll
Admins are fighting a losing battle. Think about it. Most vulnerabilitys are posted by crackers in the first place.
I realize that education about the existence of h/cr/ackers is part of the equation as is learning your OS inside out and locking it down but what else? Locking it down doesn't always solve it.
MS has said it will no longer publish vulnerabilities as its giving the h/cr/ackers an edge. I dunno. After reading Cuckoo's Egg, I wonder who the edge would be given to and who it would be taken away from if we revert back to a computer state as it was when security was as Stoll describes.
Quote:
Originally posted by MsMittens
So how do admins fight back to start winning the battle?
Good question. Unfortunatley I'm at a loss for an answer.
My Feelings on the matter is that I'd hope that we are all working towards the same goal and thats to excel the knowledge of our selves further than before. I think that there are some people who take knowledge and expose it for the wrong reasons but these people are always going to exists. However usually the people who make this knowledge available have good reasons behind it.
I like to think that we can grow smarter together rather than alone. Isn't the saying 2 brains are better than 1?
nice q been a while sinse I have found the need to say something about a post here.
i think that system admins just need to patch their comps as soon as it is made available.
It is certainly true that admin people should apply patches as soon as they are available, but in some cases this is too late!
You get quite a few who don't even bother to do that.
I was interested in MsMittens post about MS not publishing info on security loopholes (nothing to do with WindowsXP surely?). IBM tried this approach a few years ago (on their mainframe systems), but changed their policy when their users (mainly large companies) complained.
I strongly support the publishing of vulnerabilities as long as proper protocol is observed.Although true that it may be used in a malicious manner after publishing,chances are it already is being used.Case in point-the debate over the "Code Red" virus and the IIS vulnerabilty.The vulnerabitiy was uncovered,not discovered by Eeye Digital Security and was so stated in their advisory.The advisory was published after the software manufacturer had made public a patch.Thus stressing the importance of admins to keep up to date on security patches(yes,I know,easier said than done-we all are running a heavy work load).It's a catch-22......publish it,and have it used maliciously( which it probably already is or will be) or keeping it quiet and depending on the software manufacturerers to 1.make a patch 2.make the patch available in a timely manner.I think making the problem public expidites the availability of a patch.....stimulates discussion and further analysis about the problem,thus hearing different view points.....and hopefully stresses the importance of good sound security practices,which cannot be ignored any longer-none of us has that luxury any longer.The threats are out there,always have been and probably always will be.....keeping them under wraps and "hush,hush" will not make them go away.
To some degree, yes it is a catch-22. To others its plain ignorance. One of the games I play online uses a Win2K machine with SQL 7/2000 (not sure which) and ISA. Almost two months after Code Red was discovered and being yapped wildly in the news they were just "discovering" this new "virus". I was shocked.Quote:
Originally posted by ronin13
IThus stressing the importance of admins to keep up to date on security patches(yes,I know,easier said than done-we all are running a heavy work load).It's a catch-22......
I suppose I find it hard to understand how admins can be online, running things online and not know about what goes on. My time as admin was busy and I would spend every morning while having breakfast reading through latest happenings. Most of the time it was simply skimming headlines to see what looked interesting and what might be of concern.
But that's just MHO.
I totally agree with you,msmittens.You,I,and many others take the time to try and stay informed.....as you've stated, but unfortunately there are many others who don't as was proved with the whole Code Red mess.I'm certainly not defending them,I'm as aghast as you that this situation exists.This is a subject that no net admin should be remiss in and until all take a more serious interest,these kinds of things will continue to happen......irregardless of full disclosure or not.
it's kind of funny this question even got asked... (no offense intended freeOn) just look at the motto underneath Antionline.com at the top of the page...
what is unfortunate is that not everbody sees the vulnerabilities as soon as they're discovered so they could take immediate countermeasures to negate the window of opportunity that exists to the h/cr/ackers that are usually just discovering the postings themselves and go off on their merry way to try and exploit it. the vast majority of these people aren't good enough to find exploits themselves and are living off the ones that are.