Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Vulnerability Disclosure Deja Vu: Prosecute Crime Not Research
Newest First  |  Oldest First  |  Threaded View
ODA155
ODA155,
 User Rank: Ninja
5/19/2015 | 10:27:36 AM
Re: Defender's point of view
Imagine the PHP code that you write\wrote\sell or provide is being used all over the Internet for whatever reasons people use it for... now imagine it's weak and vulnerble and you missed it during your "code review".... now, wouldn't you want someone to point that out to you no matter how arrogant they were or would you rather some attorney for Company X contact you with a law suit?

Don't take it personal, it's a mistake that someone found, hopefully before it was exploited for ill.
JBauerofPrivacy
JBauerofPrivacy,
 User Rank: Apprentice
5/15/2015 | 3:22:42 PM
An example of a different approach
United Airlines is offering up to a million air miles to hackers who can find security bugs in its network. 

 
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/15/2015 | 8:18:31 AM
Re: Defender's point of view
@Thomas Claburn, love how you expanded on the metaphor of the lock picker at the front door. Perfect! 
Sara Peters
Sara Peters,
 User Rank: Author
5/13/2015 | 12:50:14 PM
Re: Defender's point of view
@AnonymousMan  I see your points, but it's a bit more complicated than that when you're dealing with a public Website, because the safety of that site affects all the people who use it, not just the people who own the domain. And the trouble is that the way the laws are written right now, simply looking for a vulnerability in a website -- not disclosing it or testing it -- is technically a felony crime under U.S. and U.K. law, punishable by fines and even jail time.

Although it doesn't usually turn out that way, there have been cases when good samaritan security researchers have been convicted of cybercrimes under these laws -- like when Daniel Cuthbert got convicted in the UK for executing a single shellcode command after he thought he might have just given his credit card information to a phishing site.

 
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/13/2015 | 11:28:33 AM
Re: I Need that T-Shirt!
The T-shirt is defnitely cool, @ChristianBryant. But your point about the value of vulnerability research -- and the need for lawmakers to protect it -- is critical. Hopefully Katie's message will reach beyond the world of Dark Reading to TPTB in Washington. What we need is intellegient cyber crime legislation. Not a dragnet.
RetiredUser
RetiredUser,
 User Rank: Ninja
5/13/2015 | 5:16:58 AM
I Need that T-Shirt!
OK, so that was a terrible label for my comment (I've been too serious on some of these) but, really, awesome message on the T!

I spend hours a day reading sites like DR, Exploit-DB and PacketStorm.  The imagination that goes into vulnerability research can't be stressed enough.  Without these individuals, teams and organizations (most of whom are either anonymous or feel some security in their visibility and numbers), we would not only be less safe but also our software would be buggier and less enjoyable to use.

The law must catch up, must address cyber-crime intelligently and recognize the value of folks like vulnerability researchers and not simply see them as part of the problem.  Even for those on the "right" side of the law who do recognize this, they then need to fight for them, for they too often get swept up in the nets.
Thomas Claburn
Thomas Claburn,
 User Rank: Ninja
5/12/2015 | 6:01:27 PM
Re: Defender's point of view
>Imagine that you come home one evening to find someone hunched over working on your front door lock with a set of picks. 

This metaphor doesn't quite capture the Internet since there's no real sense of physical location. It would be more accurate to imagine someone opening his or her front door to find the entire population of the Internet outside, with a subset of this group running automated door-hacking attacks.
AnonymousMan
AnonymousMan,
 User Rank: Moderator
5/12/2015 | 5:18:00 PM
Re: Defender's point of view
That is not just a different storyteller, it's a different story.  Not invalid mind you, but not the same situation. I wrote a PHP application and put it on the Internet.  Does anyone have the right to test it for vulnerabilities, as long as their heart is pure?  And my specific point...how does the defender discern intent from the packets.
dritchie
dritchie,
 User Rank: Strategist
5/12/2015 | 4:58:17 PM
Re: Defender's point of view
On the other hand:


You come home from the store, Your neighbor tells  you that he just found out that his front door can be opened by banging on the lock 3 times and since you have the same lock, maybe you should change it.


Do you:

1.  Thank him and go buy a new lock kit

2. Kick him in the soft parts since he was looking at your lock for specifics.

 

Many different ways of looking at it and it depends on who is telling the story.
AnonymousMan
AnonymousMan,
 User Rank: Moderator
5/12/2015 | 3:30:55 PM
Defender's point of view
Imagine that you come home one evening to find someone hunched over working on your front door lock with a set of picks.  Do you:

a) assume they are a security researcher, and politely ask them to let you know if they successfully pick the lock?

b) assume they are a criminal and swing a grocery bag full of avacados into their soft parts?

I generally agree with the idea of not prosecuting security researchers, there is no question IMHO that researchers are often egocentric ideologues who could care less about actual users. Some have a sense of entitlement that is simply dumbfounding....as if putting something on the Internet gives them free reign because, well, it's on the Internet and stuff.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file