Re: [Full-disclosure] Vulnerabilities in *McAfee.com

[Ryan Sears <rdsears@xxxxxxx>]

Agreed, If you put your site on the open internet, you have to take into 
account the inherent hostilities that go along with that action. 

A security firm like Mcafee /knows/ about these vulnerabilities. Guaranteed. If 
they offer services to make other's sites 'hacker proof', their first order of 
business should make sure that their infrastructure doesn't have blatantly 
obvious security holes. I'm not saying that they should catch EVERYTHING, but 
these are bugs that an automated scanner could easily pick up. I do understand 
that  a large infrastructure like theirs has pages that have been created by 
people with varying degrees of competence, but that's why they need to do 
inclusive penetration tests of their own network. At the very least they need 
to have some mechanism in place to detect (and possibly defer) these sorts of 
attacks. 

The way I see it, when a company hides behind legal threats to deter people 
from finding and reporting bugs, all they're doing is hurting themselves. Look 
at how Microsoft has turned around. 10 years ago they weren't dealing with 
people reporting issues in the right way, but they soon came to realize that by 
listening to the hackers that ARE coming forward with issues, they not only 
help themselves, but help the community as well. It's a win/win scenario for 
EVERYONE. 

You can tell a vast amount about how an infrastructure is run from just a bit 
of poking. If there are blatant security holes everywhere, then they clearly 
don't take security seriously. If they filter for SQL injections in javascript, 
then the dev's have no clue what they're actually trying to do. If you see SQL 
errors, chances are there are more serious issues to boot. I usually limit my 
poking to the very basic of basics when I do use a new service, and the more 
transparent they are (think reddit) the more I trust them. They even have a 
full subreddit devoted to finding and learning about XSS attacks. One word, 
awesome. 

Simply put, in my opinion you can't blame a pen-tester for looking for bugs in 
a site. The only time it should be considered malicious is when it's used in a 
malicious way. If I find a XSS in a webform, and I report it along with 
re-mediation suggestions I feel as though I'm doing the site a favor. It's 
unfortunate to think that some see this as a criminal activity. 

Ryan

----- Original Message -----
From: "Jeffrey Walton" <noloader@xxxxxxxxx>
To: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
Cc: "Ryan Sears" <rdsears@xxxxxxx>, "full-disclosure" 
<full-disclosure@xxxxxxxxxxxxxxxxx>
Sent: Wednesday, March 30, 2011 5:28:59 PM GMT -05:00 US/Canada Eastern
Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com

On Wed, Mar 30, 2011 at 4:36 PM, Thor (Hammer of God)
<thor@xxxxxxxxxxxxxxx> wrote:
> I have that very strip printed and on the wall in my office :)    You make 
> several points, but the response that immediately comes to mind is that I 
> actually see a difference between actively scanning content for 
> structural/coding vulnerabilities, and entering data in a search box.  I 
> don't know if there is any basis for this legally, but I feel that if you put 
> a box up and I can search for something, then I can put whatever I want in 
> that box.  You (the royal you) are basically soliciting people to put data in 
> the box.   However, you are not asking anyone to spider your site or run 
> scans against it.
>
If a person or company places a host on the public internet and offers
a service, I don't think its reasonable to claim some input is "fair"
and other input is "unfair". Perhaps the person or company should not
offer public services in the first place.

It seems reasonable (to me) that users of the site expect that the
site is relatively defect free and secure. A tech-savy user who tests
the site through its public interface is simply exercising due
diligence before using the services of the site. I personally feel
that individuals and companies which want to criminalize 'due
diligence' is cowardly at best. I don't want to use the services of
such a site; nor do I want to have an account on such a system.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/