RE: DJB's students release 44 *nix software vulnerability advisories
Jonathan T Rockway writes:
> Regarding local versus remote, look at it this way: You have
> a 100% secure system. Then you install NASM. Now a user
> FROM THE NETWORK can send you some tainted assembly code for
> you to assemble and he can compromise your account. That is
> why it is considered remote. Local would mean that I, the
> attacker, need an account on the target machine to compromise
> the target account. In this nasm case, I do not need an
> account. That is why the wording "remote" was chosen.
By that logic, *no* exploit can ever be considered local. A truly remote
exploit doesn't rely on manual interaction from a local user on the
system.
> Now in regards to full disclosure, I think you should all be
> happy that we bothered to tell you all about these exploits.
> We could have selfishly used them to compromise machines,
When you're trying to argue that your actions were ethical and moral,
pointing out that you could have committed crimes isn't the way to do
it.
> but instead we wrote them up and mailed them off to the users and
> the authors! That is very nice of us.
No, it's the absolute minimum level of ethical behavior one expects from
serious security researchers. Nothing nice about it.
> If you would like notification sooner than the "public", find
> the exploit yourself. If I can find them, then surely anyone can.
One day, when you are writing software for distribution, someone will
find an error in your code. When that day comes, remember this attitude.
While those who discover those bugs and exploits in your software have
no obligation to give you advanced warning of your bugs, I'm certain
you'd be grateful to have that warning so you have time to fix the bug
before word goes public.
--
Devin L. Ganger Email: deving@xxxxxxxxxx
3Sharp LLC Phone: 425.882.1032 x 109
15311 NE 90th Street Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.702.8455