[iwar] [fc:'White.Hat'.Hackers.Threaten.Information.Anarchy]

From: Fred Cohen (fc@all.net)
Date: 2001-11-06 19:51:21
Next message: Fred Cohen: "[iwar] [fc:Linux.breaks.100-Petabyte.ceiling]"
Previous message: Fred Cohen: "[iwar] [fc:Microsoft.settlement.hits.dead.end]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200111070351.fA73pLB07858@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Tue, 6 Nov 2001 19:51:21 -0800 (PST)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:'White.Hat'.Hackers.Threaten.Information.Anarchy]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

'White Hat' Hackers Threaten Information Anarchy 
By Brian McWilliams, Newsbytes, 11/6/2001
<a href="http://www.newsbytes.com/news/01/171900.html">http://www.newsbytes.com/news/01/171900.html>

Responding to an effort by Microsoft [NASDAQ:MSFT] to squelch the full
disclosure of software vulnerabilities, a group of "white hat" hackers
is putting out a call to other experts, asking them to deluge software
vendors with bug reports. 
"Let's flood the security department of every vendor with new issues.
Let's show the world what they would miss and what information could
just as easily have stayed in the underground," wrote a security
researcher who uses the nickname "HellNbak," in an announcement posted
to several security mailing lists last week. 
So far, only one prominent organization has signed on to the
"Information Anarchy 2K01" initiative - a group known as Nomad Mobile
Research Center, of whom HellNbak is a member. 
The call to arms comes as Microsoft convened its Trusted Computing
conference in Mountain View, Calif., today, and is expected Wednesday to
further its push for an industry consensus against disclosing details on
security vulnerabilities.

That effort to block security experts from publishing "exploits" was
formally launched last month with the publication of an essay by Scott
Culp, the head of Microsoft's security response center, entitled "It's
Time to End Information Anarchy." 
The company is expected to put forth a formal proposal this week in the
form of a request for comment with the Internet Engineering Task Force,
an industry standards-setting body. 
Sources said Microsoft also has recently been lobbying senior management
at major security consulting firms over the issue, and at least one
unspecified company has agreed to adopt Microsoft's vision of
"responsible" disclosure. 
"If companies don't start taking a more responsible approach, some of
the ramifications could be bad," including new laws criminalizing the
release of exploit code, said Chris Klaus, founder and chief technology
officer for Internet Security Systems. According to Klaus, ISS has long
considered the public release of "proof of concept" programs that
exploit software holes "the equivalent of giving burglar tools to
everyone." 
But if Microsoft succeeds in shutting off open discussions of security
vulnerabilities, the conversation will merely go underground to the
world of "thieves, spies, and never-do-wells," according to Richard
Forno, chief technology officer for Shadowlogic, a Virginia-based
security consulting firm. 
"HellNbak is correct. ... We need this public discourse, without which
the Internet community is placed in serious, uninformed,
corporate-controlled jeopardy," said Forno. 
Among those scheduled to present at the Microsoft conference is Chris
Wysopal, director of research and development for AtStake, a security
consulting firm that includes former members of L0pht, a group that in
the past has released several tools that exploit security weaknesses. 
Wysopal, who also uses the hacker nickname "Weld Pond," said he will
outline his views on the need for vulnerability reporting standards. 
At present, AtStake's disclosure policy specifies that the firm may
release full technical details, including "non-gratuitous" exploit code,
12 days after notifying a vendor of a security vulnerability, according
to a statement of the policy at the AtStake site. 
While HellNbak reported that he has seen considerable interest from
independent security consultants, the Information Anarchy proposal is
unlikely to have its intended effect, according to Elias Levy, chief
technology officer for SecurityFocus. 
"He is calling for people to release vulnerabilities, but he is also
calling for people to do so responsibly. So I fail to see how that is
any different than what we do today," said Levy. 
The Information Anarchy proposal is online here:
<a href="http://www.securityfocus.com/archive/82/224378">http://www.securityfocus.com/archive/82/224378>

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Universal Inkjet Refill Kit $29.95
Refill any ink cartridge for less!
Includes black and color ink.
http://us.click.yahoo.com/bAmslD/MkNDAA/ySSFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Linux.breaks.100-Petabyte.ceiling]"
Previous message: Fred Cohen: "[iwar] [fc:Microsoft.settlement.hits.dead.end]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:59 PST