In this post I link to a blog entry by a guy (dcrab) who does some show and tell about Amazon and MSN. You gotta love Full Disclosure. Full Disclosure and why bugtraq is here is what I talk about. Just skip my text to the end for that information. So, yes, we know. Thanks. Yes, we know. Most sites have vulnerabilities. Most sites don't fix them. All you have to do is pick one arbitrarily and find them after a second to a few minutes of search. Recently I exchanged some words on exactly this subject with Scott Chasin (started bugtraq back in `93). This is why Full Disclosure was originally done and part of why bugtraq was originally created. People don't often remember why, and today attack the concept of Full Disclosure and say that it is irresponsible to disclose vulnerabilities that way. On some levels, I agree, but nothing is black and white even if I often think it is. Some companies take security seriously. Reporting to them works. Some companies (at BEST) ignore you. Back then most companies ignored. Back then Full Disclosure was THE silver bullet and THE solution. I recently had the chance to discuss this with Aleph1 as well. He who strongly believes in Full Disclosure agrees it's a different world now. Today, the same situation is repeated with new fields. Game companies, critical infrastructure (such as with SCADA systems), etc. who now discover the world of vulnerability research don't know how to deal with it. It is interesting to watch how the world of security repeats its history. When someone releases the information it is a fact that everyone goes and attacks the site or builds a POC. When someone provides only with the name of the site or skeleton details of vulnerabilities... everyone goes and looks for what they know is there. Back a few months ago a kiddie tried to sell an Excel vulnerability on FD. Now, I am not sure if this is completely related but a few months after that Microsoft released several patches for Excel. This month we have had Excel 0days. In the world of web security the situation is more extreme. Release the bug? Everyone will exploit it. Release the site name? Everyone will find a bug there TODAY. The point is, though, that these vulnerabilities have always been there, and they have been exploited before. We just didn't know about them. And people are surprised when corporations and sites are broken into and their personal data is stolen? Here is a blog post of a guy who got sick of reporting vulnerabilities, and after years of trying (look at the dates), finally made a small release about MSN and Amazon (although other interesting sites are listed there. http://blogs.hackerscenter.com/dcrab/?p=19 Noam Rathaus recently wrote about a similar issue ("From Flaw to Exploit"): http://blogs.securiteam.com/index.php/archives/449 I contacted both Amazon and MS, but this is out there and once it's out there - it's, well; out there. Full disclosure, y'know. Gadi Evron.
