Hacker Leaks Unreleased CERT Reports

Call Me Black Cloud writes "A hacker calling himself "Hack4Life" swiped 3 unpublished vulnerability reports from a company working with CERT and posted them to the Full Disclosure mailing list. A couple of days later, he did it again (while promising weekly leaks). Wired also has a story, including a link to one of the postings."

Comments

Maybe it's an inside job.

[no reason to be here]

Maybe someone that's upset with the way CERT is doing things...
or maybe someone joined CERT just so he/she could play uberhacker.

Re:Maybe it's an inside job.

[indiigo]

CERT is a joke, they announce security vulns days late, often skipping arbitrarily vulns that are on a massive scale. Unsubscribed a year ago.

Re:You've spelled Cracker wrong.

[essdodson]

The connotation of the word has changed, deal with it, move on. You lost this war years ago. If you don't like what it now means to everyone but you and a few others, then don't choose it as your label.

Simply put, if the masses see "hackers" as evil criminals then that's what "hackers" are. Language is determined by the masses, not by a small minority who get to determine what's PC or right.

Inherent problems with CERT

[jaywhy]

I've never liked the fact that CERT was more or less an exclusive security club. It's obvious that hackers monitor the mailing list and know the vulnerablities before majority of everyone else in the world.

CERT should instead, stick with helping behind the scenes coordination between security agencies like eEye and software companies; and should stop publishing unfixed problems to a CERT's underground mailing list.

One was supposed to be held back till june???

[malice95]

What concerns me is that one of the vlunerability reports released by this guy wasnt schedualed to be released until June... JUNE??? What the hell are they going to wait till June for. Cant the vendor get their act together before then? This is why we need bugtraq so bad.. IMHO they should get 3 or 4 weeks max to fix the problem otherwise it gets released. If there is even a hint its being exploited on the net it should be released immediatly, fix or no fix.

Malice95

Re:Interesting to note...

[RLiegh]

When truth is outlawed; only outlaws will tell the truth.

Re:Double-edged sword?

[lamontg]

define "the public" and "those who have the capacity to fix them".

I have the sources to the operating system that I prefer to run and all the apps that run on it. I am a unix system engineer of quite a few years experience now. I know how to program C with about 13 years of experience there. I believe very firmly that I am in the category of "those who have the capacity to fix them". I am not, however, in the inner circle of those who get early access to CERT security information.

Re:Double-edged sword?

[legLess]

Quothe the poster:

In my opinion, the only time security vulenrabilities should be released publicly is when they are fixed. ... However, when new vulnerabilities are found, they should only be disclosed to those who have the capacity to fix them, and not to the public, whose only reaction will be panic. Comments?

You're making a dangerous and unwarranted assumption: that "white hat" hackers find vulnerability information before "black hat" crackers. This is not the case. If one person can discover a security flaw, so can another, and a cracker intending to use his knowledge for ill is certainly not going to report it to CERT.

Otherwise, teenage script kiddies worldwide will launch attacks on everything and everyone.

Script kiddies are not the problem. Sure, they might 0wn a couple Windows machines, but their very lack of subtlety is what makes them a second-rate danger. The scary crackers are those that find a single, important flaw themselves and rapidly use that information to compromise systems for their own gain, never telling anyone else. It's well-documented that most digital corporate break-ins are not brought to the attention of the authorities or the security community, so Joe Scary Cracker can continue to use his exploit until a white hat finds it.

Finally, let's use a non-digital example. If (e.g.) Consumer Reports found a flaw in a popular child car seat that could cause severe injury to a child, which path would you prefer they take:

1. Notify the manufacturer, then wait for said manufacturer to discover a fix and write a press release.
2. Loudly notify the entire world so that parents can reduce the risk themselves.

In the above case, the only reason to delay is to protect the manufacturer, so the analogy isn't perfect. Home burglar alarms would be a better analogy, but less vivid.

For many people charged with security, this is an easy question: they want all possible information on vulnerabilities the second that someone discovers them. They can shut off services, craft firewall rules, compile in patches, write their own damn patches. The worst-case scenario for them is that their systems are afflicted with a vulnerability that anyone else but them knows about.

Besides, here's the elephant in the living room that no one wants to address: if one person can somehow acquire this information and post it to a public list, another person can use the information for ill gain. One of these vulnerabilities wasn't due to be announced 'til June?? That's a long fucking time for (e.g.) your bank's online transaction processor to be vulnerable.

Disclose early; disclose often. Anything else multiplies the risk for the people who can least afford it.

CERT is incredibly stupid

[Omnifarious]

That vulnerability is a simple buffer overflow. RedHat had a patch out for it in less than a day. This whole 'wait for the vendor to fix it' thing just results in lazy vendors.

And, as the army breakin shows, the 'bad' guys often have the information whether or not the 'good' guys even know it. There are many script kiddies out there, but there are a few really intelligent people who can do their own research, and won't bother telling CERT before they go and exploit the vulnerability.

Obvious Result

[Ryvar]

If everyone switches to BSD then most of the vulnerabilities found will be for BSD. No OS is flawless, not OpenBSD nor any other - OpenBSD gets more attention than the other BSDs as far as security is concerned in all probability because of their security stance, but there's still a hojillion (I use that term strictly in the technical sense) bugs in there.

That's not to deride Theo & crew's accomplishments - they've done amazing work, look at how few bugs are found in OpenSSH relative to how incredibly widespread it is - but it is practically impossible to write perfectly secure code that operates at anything like a reasonable speed for the x86.

Re:Well....

[Bonker]

Unfortuneately, the reason the information was leaked is because CERT charges people to get early access to security problems like this... So it could be *anyone* at any of the organizations that have legitimately (*cough*) gained access to this resource. Hell, it could be any one of those people's bored teenaged kid who snagged their dad's laptop when he brought it home for the weekend.

Sorry, but once you sell something there is no way to protect it as secret.

CERT has bought and paid for this. They've earned this security breach and every breach like this.

Re:Double-edged sword?

[Alex]

Finally, let's use a non-digital example. If (e.g.) Consumer Reports found a flaw in a popular child car seat that could cause severe injury to a child, which path would you prefer they take:

What usually happens in this scenario is that parents remove the childs seats in blind panic and as a result 10x more kids are killed by seatbelts and not being in carseats than would have been killed by the carseats.

Lucky we removed those car seats isn't it?

Alex