Issues: "Save a bug, safe a life?"
by Thejian - for Help Net Security

"And thereís the sign, Ridcully," said the Dean.
"You HAVE read it, I assume. You know? The sign which says

"Do not, under any circumstances, open this door"?"

"Of course Iíve read it," said Ridcully. "Why díyer think I want it opened?"
"ErÖ why?" said the Lecturer in Recent Runes.
"To see why they wanted it shut, of course."

Above exchange, from the novel "Hogfather" by Terry Pratchett, holds quite an accurate description of what hacking is, or at least of the ideal of what hacking should be. That is, to me personally, because one of the things coherent with the scene where this practice thrives is the many different clashing opinions and ideas. You may "smash the stack" for fun, for profit, or maybe just because youíre a vicious lilí bugger with too much time on his hands, but the ideal most people have concerning what a hacker is, is someone who opens stuff up to find out the why and the how.

The security scene consists of a lot of people with different ideas on how to act to follow and what to do to reach above ideal. An outsider would probably think of it as a whole lot of politics on what to say, what to do and how all this gets interpreted by others and he or she would probably be right. Amongst the topics (probably even The Number One Topic) fueling many a heated discussion is the one of "Full disclosure" versus "Security through obscurity". Basically, these are two philosophies regarding how to deal with product security problems. The "full disclosure" variety of these two, advocates the releasing of all available information on security problems to the public, as to promote full awareness about it and inform the users as to how to prevent this from affecting them and their systems. The main idea is that before this philosophy was introduced, information about security problems was only shared amongst a select group of people. When vendors were notified of problems in their products or services, they would either not act on it or quietly introduce a fix in later versions of the product. This resulted in quite an alarming number of security incidents which could have been prevented if people would only have known their system was vulnerable to a particular problem. The thing with hackers, you know, is that you often donít need to tell THEM, THEY can figure it out for themselves ("hackers" in its older and more respected form that is, nowadays a hacker is often portrayed as anything on two legs near something electric and with the ability to break it).

Full availability of this kind of information does have its dark side though. As will be always the case amongst us humans, when something can be abused chances are someone will, one way or the other. Unfortunately, detailed information on how to exploit these security problems eventually brought along others, who were also pretty pleased with the concept of "full disclosure" since it saved them the trouble of actually learning how things worked. "Plug-and-play"-like tools appeared in the scene, allowing for automated scanning of other peoplesí systems for these problems and exploiting them. Where in the past the number of incidents rose because of uninformedness, now a same kind of tendency could be detected because of people being informed who otherwise wouldnít have been. People opposed to the full disclosure philosophy often use this as an argument for "security through obscurity", a sort of "back in the old days everything was better" kind of approach, arguing "what they donít know they canít use to hurt you".


More than 900 embedded devices share hard-coded certs, SSH host keys

SEC Consult analyzed firmware images of more than 4000 embedded devices of over 70 vendors and found that, in some cases, there are nearly half a million devices on the web using the same certificate.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Nov 26th