Criminal Intent

InfoSecSellout (who lives up to his name by posting Google Adwords on his blog while criticizing security consultants for being sellouts) posted a great story -- Conversations with a Blackhat. I'd like to highlight a few of his comments.

I recently had the opportunity to share some drinks and interesting conversation with a group of self confessed "bad guys"... These guys make a living in various ways but it seems that spamming, phishing, and carding are their main source of income and of course, once they are done with a zero day exploit they will go ahead and make a few dollars selling it to the highest bidder...

[T]hese guys, and most like them, are against Full Disclosure. Their reason for this is also very obvious, Full Disclosure takes away their opportunity to use exploits that they have been previously able to use...

[They said] "there should be laws to prevent people from releasing exploit code on the Internet." This is obviously a self serving statement as the people already breaking the current laws are not going to care about breaking some new ones and this would take care of their problem with Full Disclosure...

[They also said] "A law like this would take the information away from the actual smart people and leave the retards who feel that having alphabet soup behind their name gives them some sort of self and professional worth watching the vault."

All of this rings true to me, and I can't find a plausible way to argue against it. (It's similar to the argument over firearms in the US. If possessing guns is illegal, only criminals will have guns.) If possessing exploits is illegal, only criminals will have exploits. There will be no way to test if vendor patches work. There will be no way to test if new code possesses older vulnerabilities, or if "security products" (e.g., host IPS and/or AV) introduce previously patched vulnerabilities. There will be no way to understand how exploits work to detect and/or prevent them. Criminals would roam freely while the world sits dumb and blind. (We're not that far away from that situation now, but it would be worse in a world without free information on exploits.)

I always like reporting on real threats, because without these insights we're playing soccer-goal security.

For a timely example of the full disclosure debate, check out Chris Shiflett's publication of a vulnerability in Amazon.com's infrastructure. If you need to understand Cross Site Request Forgeries I recommend this post.

Comments

Anonymous said…
Hey! What is wrong with the google ads? I made an entire $.23 last month.
10:46 AM
Richard Bejtlich said…
Heh -- sellout!! :)
10:48 AM
Juan Miguel Paredes said…
Yeah, but making guns illegal to own make people feel better! Probably the same with the idea of outlawing exploit code. The only place I've ever seen anyone write about outlawing exploit code (or that they are already illegal) are in mac fanboy websites when they were decrying the mac wireless exploits. Seriously, is there ANYONE CREDIBLE calling for making full disclosure illegal?
12:43 PM
Richard Bejtlich said…
I expect some heat from Pete L at some point...
12:49 PM
Anonymous said…
Last time I checked, consultants weren't sellouts...just willing to take a risk that falls outside other people's comfort zone. However, don't fault folks for running AdSense on their site...gotta pay the bills somehow (although blogspot is free, others always aren't). At least AdSense is a legitimate service that doesn't throw popups and popunders. Besides, last time I checked, folks presenting and teaching at conferences wanted a return on time spent sharing their ideas as well :-).
10:09 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more