Alerting, Reminding, Reminding,
Reminding and Releasing Vulnerabilities
Thomas Mackenzie
$ whois spiderlabs.tom
$ whois upsploit.tom
Tom



• Web Application Security Consultant - SpiderLabs

• Founder and Creative Director – upSploit Ltd

• OWASP Chapter Leader / Board Member – Birmingham UK

• Podcasting / Greg Evans




 COPYRIGHT TRUSTWAVE 2011    Confidential
About SpiderLabs ®


                            Incident
                            Response            Application
            Pentesting
                                                 Security




          Research &                           Global Security
         Development          Security             Report
                            Conferences


 COPYRIGHT TRUSTWAVE 2011       Confidential
Agenda

• Vulnerability

• Researcher vs. Hacker

• Perfect Disclosure

• Real World Disclosure

• Third Parties

• Conclusion

 COPYRIGHT TRUSTWAVE 2011   Confidential
WARNING!!!!




COPYRIGHT TRUSTWAVE 2011
Vulnerabilities




COPYRIGHT TRUSTWAVE 2011
Vulnerabilities


› What is a vulnerability? – according to wikipedia -
  http://en.wikipedia.org/wiki/Vulnerability_(computing)

› A systems susceptibility or weakness

› Attackers access to the weakness

› Attackers ability to exploit that weakness




 COPYRIGHT TRUSTWAVE 2011    Confidential
Vulnerabilities

› Adobe Coldfusion

    – Weakness = Local File Inclusion

    – Access = Unauthenticated Access

    – Exploit = ../../../../../../etc/passwd%00en




 COPYRIGHT TRUSTWAVE 2011          Confidential
Vulnerabilities

› FCKEditor

    – Weakness = Arbitrary File Upload

    – Access = Unauthenticated Access

    – Exploit = upload shell, command execution.




 COPYRIGHT TRUSTWAVE 2011         Confidential
Vulnerabilities

› What are the common denominators?

    – A systems susceptibility or weakness


    – Attackers access to the weakness


    – Attackers ability to exploit that weakness




 COPYRIGHT TRUSTWAVE 2011           Confidential
Researcher vs. Hacker




COPYRIGHT TRUSTWAVE 2011
Researcher vs. Hacker




                                            • Researcher does it for the greater good
                                              (most of the time…)

                                            • Hackers use the information



Image: digitalart / FreeDigitalPhotos.net

         COPYRIGHT TRUSTWAVE 2011                  Confidential
Researcher vs. Hacker




                                            • Bug Bounties?

                                                 ≈
                                            • Researchers work hard!

                                            • Just need to remember!


Image: digitalart / FreeDigitalPhotos.net

         COPYRIGHT TRUSTWAVE 2011                  Confidential
Researcher vs. Hacker



One thing that a researcher does
over a hacker?

                            ›Alerting the vendor.



 COPYRIGHT TRUSTWAVE 2011   Confidential
The “Perfect” Disclosure




COPYRIGHT TRUSTWAVE 2011
The “Perfect” Disclosure
                              Researcher finds a vulnerability


                               Researcher alerts the vendor


                                     Vendor responds



       • Two biggest factors are fixes two vulnerability
                         Vendor the the parties i.e.


              • Researcher vs. Vendor
                     Researcher and Vendor work together on disclosure
       • If one gets angry with the other, or one doesn’t respond – the
         flow chart breaks
Disclosure occurs and people worldwide now know how to fix the issue that was found



 COPYRIGHT TRUSTWAVE 2011                  Confidential
Vendor vs. Researcher




COPYRIGHT TRUSTWAVE 2011   Confidential
The Chess Game




http://www.flickr.com/photos/yourdon/3405809406/

 COPYRIGHT TRUSTWAVE 2011                          Confidential
Real World Disclosure
Real World Disclosure

›Why were you doing this?

    • You are not one of our customers!

    • Found the information on a pen test

    • Vendor thought that this was us pen testing
      them without permission

    • Threatened by lawyers and lawsuits for unauthorised access

    • LACK OF UNDERSTANDING…



 COPYRIGHT TRUSTWAVE 2011          Confidential
Real World Disclosure

›Your timing is very suspicious.

    •   Company is going through a large change i.e.


          – Acquisition, large scale attack and / or change in a key
            member of personnel

    •   Even once fixed not happy that the vulnerability is going to be disclosed, “why must
        you do this”?


          – To alert people to the fact they may be running vulnerable
            software / services.

    •   Lawyers and / or lawsuit.

    •   LACK OF UNDERSTANDING…

 COPYRIGHT TRUSTWAVE 2011                  Confidential
Real World Disclosure

›This has been fixed in X version.

    • Where is this version?


          • Have to pay!

    • Not made this problem public and therefore no one knows the
      necessity of updating.

    • Having to pay for security updates is not right.

    • LACK OF CARING…



 COPYRIGHT TRUSTWAVE 2011           Confidential
Real World Disclosure

›Where is the security contact?
    • No public way to make the vendor aware

    • Can end up guessing or searching for a long time

    • Twitter accounts are too public

    • Maybe NO WAY AT ALL to submit

    • LACK OF RESOURCES…




 COPYRIGHT TRUSTWAVE 2011          Confidential
Real World Disclosure

›Time-frame
    • How long before you disclose


          • At what point does full disclosure become right?

    • Vendor or Researcher

    • Should time frames even be discussed?

    • Lack Of Communication…




 COPYRIGHT TRUSTWAVE 2011            Confidential
Real World Disclosure

›Others
    • Language Barriers

    • Different Time Zones

    • NO CONTACT

    • Is the bug being exploited in the wild?

    • etc.




 COPYRIGHT TRUSTWAVE 2011           Confidential
Third Parties




COPYRIGHT TRUSTWAVE 2011
Third Parties

›A number of companies exist:

    • Vupen

    • ZDI

    • upSploit

    • Secunia

    • etc




 COPYRIGHT TRUSTWAVE 2011   Confidential
Third Parties

›The aim:

    • Speed up the process.

    • Take away the stress and hassle from the researcher.

    • Co-ordinate fair disclosure

    • Help to distribute to databases

    • General media attention.




 COPYRIGHT TRUSTWAVE 2011           Confidential
Third Parties




 COPYRIGHT TRUSTWAVE 2011   Confidential
Third Parties




 COPYRIGHT TRUSTWAVE 2011   Confidential
Third Parties

›Problems:

    • Vendors don’t want more people involved.

    • Researchers don’t want more people involved.

    • Things can go smoothly and then someone wants to change something.

    • Where is the vulnerability being stored?




 COPYRIGHT TRUSTWAVE 2011           Confidential
Conclusions




COPYRIGHT TRUSTWAVE 2011
Conclusion

›Problems:

    • Vendor contacts

    • Vendor understanding

    • Vendor caring

    • Researcher ethics

    • Co-operation




 COPYRIGHT TRUSTWAVE 2011    Confidential
Conclusion

›How can this be tackled?

    • Not a third party, but a portal / gateway which works to solve these
      problems.

    • i.e. OSVDB have a large list of vendors and contacts, but…

    • Combining?




 COPYRIGHT TRUSTWAVE 2011           Confidential
Conclusion


›Centralized repository for:

    • Contact details

    • Best practices

    • Easy to read information and starter guides

    • Contact details for third parties

    • Maybe some kind of integrations with them




 COPYRIGHT TRUSTWAVE 2011           Confidential
Questions?
tmac@tmacuk.co.uk
thomas.mackenzie@upsploit.com
tmackenzie@trustwave.com

@tmacuk
@upsploit
@spiderlabs

http://www.tmacuk.co.uk
https://www.upsploit.com
http://blog.spiderlabs.com



COPYRIGHT TRUSTWAVE 2011

More Related Content

PPTX
Reinvent Yourself - Preso for Walnut St Labs SUMY 19-Aug-2014
PDF
Dorking & Pentesting with Tacyt
PPTX
CyberCamp 2015: Low Hanging Fruit
PDF
Click and Dragger: Denial and Deception on Android mobile
PDF
Hacking Diversity – Hacker Halted . 2019 – Marcelle Lee
PDF
Analogic Opsec 101
PPTX
Root the Box - An Open Source Platform for CTF Administration
PDF
Opsec for security researchers
Reinvent Yourself - Preso for Walnut St Labs SUMY 19-Aug-2014
Dorking & Pentesting with Tacyt
CyberCamp 2015: Low Hanging Fruit
Click and Dragger: Denial and Deception on Android mobile
Hacking Diversity – Hacker Halted . 2019 – Marcelle Lee
Analogic Opsec 101
Root the Box - An Open Source Platform for CTF Administration
Opsec for security researchers

What's hot (8)

PDF
terry-gilsenan-pie-operating.10433
PPTX
So You Want to be a Hacker?
PPTX
Hacker Halted 2018: Breaking the Bad News: How to Prevent Your IR Messages fr...
PPTX
Global CISO Forum 2017: Privacy Partnership
PDF
Internet security lessons for IoT
PPTX
Knocking Down Blockers: Transforming your company into an open source contrib...
PDF
The Ins and Outs of Accident Investigation
PDF
Privacy is an Illusion and you’re all losers! - Cryptocow - Infosecurity 2013
terry-gilsenan-pie-operating.10433
So You Want to be a Hacker?
Hacker Halted 2018: Breaking the Bad News: How to Prevent Your IR Messages fr...
Global CISO Forum 2017: Privacy Partnership
Internet security lessons for IoT
Knocking Down Blockers: Transforming your company into an open source contrib...
The Ins and Outs of Accident Investigation
Privacy is an Illusion and you’re all losers! - Cryptocow - Infosecurity 2013
Ad

Similar to Alerting, Reminding, Reminding, Reminding And Releasing Vulnerabilities (20)

PDF
Top Security Trends for 2013
PDF
Trustwave 2012 Global Güvenlik Raporu
PDF
Andrew Hay - Chris Nickerson - Building Bridges - Forcing Hackers and Busine...
PDF
Modern Lessons in Security Monitoring
PDF
Why My E Identity Needs Protection
PDF
Garland Group - Top Security Threats of 2011
PPTX
Clinton- Cyber IRT Balto 10_2012
PDF
Scansafe Annual Global Threat Report 2009
PPTX
Risk Management Practices for PCI DSS 2.0
PPTX
Emerging Threats and Trends in Online Security
PPTX
Top Application Security Trends of 2012
PPTX
Carm presentation new logo may 14
PDF
IT Vulnerability & Tools Watch 2011
PPTX
IBM Smarter Business 2012 - IBM Security: Threat landscape
PDF
2016 trustwave global security report
PDF
Choosing the Right Data Security Solution
PPTX
The Endless Wave of Online Threats - Protecting our Community
PDF
VulnerabilityRewardsProgram
PPTX
CyberSecurity Threats in the Digital Age(1).pptx
PPTX
Intersect
Top Security Trends for 2013
Trustwave 2012 Global Güvenlik Raporu
Andrew Hay - Chris Nickerson - Building Bridges - Forcing Hackers and Busine...
Modern Lessons in Security Monitoring
Why My E Identity Needs Protection
Garland Group - Top Security Threats of 2011
Clinton- Cyber IRT Balto 10_2012
Scansafe Annual Global Threat Report 2009
Risk Management Practices for PCI DSS 2.0
Emerging Threats and Trends in Online Security
Top Application Security Trends of 2012
Carm presentation new logo may 14
IT Vulnerability & Tools Watch 2011
IBM Smarter Business 2012 - IBM Security: Threat landscape
2016 trustwave global security report
Choosing the Right Data Security Solution
The Endless Wave of Online Threats - Protecting our Community
VulnerabilityRewardsProgram
CyberSecurity Threats in the Digital Age(1).pptx
Intersect
Ad

Alerting, Reminding, Reminding, Reminding And Releasing Vulnerabilities