Life, Code & Idiocy

That was a cool takeover job there – owning ImageShack, and earning yourself what has been regarded as one of the best advertising campaigns ever. Well done. Here’s my breakdown of your threat.

Anti-sec. We’re a movement dedicated to the eradication of full-disclosure. We wanted to give everyone an image of what we’re all about.

OK then, let’s hear it. For the record, I respect all opinions. I read your messag– errm, image in full the first time I saw it.

Full-disclosure is the disclosure of exploits publicly – anywhere. The security industry uses full-disclosure to profit and develop scare-tactics to convince people into buying their firewalls, anti-virus software, and auditing services.

In some cases, that can be completely true. Firewalls, anti-virus software, and auditing services can only do so much. For instance, a lot of exploits on web applications are based on different types of malformed HTTP requests. I’ve studied these a lot. That’s why I have automatic systems in projects like Enano to filter out common types of attacks. I completely acknowledge that it’s not perfect, and I wouldn’t be surprised if there’s a huge hole sitting under my nose. All I can do is design my project with security in mind and carefully consider security when I’m coding each component.

That said, I don’t consider “IE6 is outdated and insecure – you should upgrade!” to be a scare tactic. Maybe “Protect your web infrastructure with Acme, Inc. Heuristic HTTP Firewalls” could fall within that scope if it’s marketed as the only way to keep your website from getting hacked. But that’s advertising. I don’t necessarily agree with that kind of marketing either, but they are trying to sell their product. I share the view that ads like that market to idiots who think they can put a black box in between their router and web server and be unhackable, but I guess I’m just too white-hat to say that they deserve to be destroyed. I feel like I have the same discriminatory and sometimes hateful attitude towards n00bs sometimes, but that is not an excuse to do anything illegal.

Meanwhile, script kiddies copy and paste these exploits and compile them, ready to strike any and all vulnerable servers they can get a hold of. If whitehats were truly about security this stuff would not be published, not even exploits with silly edits to make them slightly unusable.

Script kiddies are a part of life. They’re also part of the security ecosystem, whether you like it or not. I hate them too. Fact is, there’s a concept called BORE – Break Once, Run Everywhere – that says that if one person publishes an exploit, it will propagate everywhere in time. I haven’t written any live exploits for this Enano security vulnerability whose patching was the reason for 1.0.6, but someone could easily look at the regular expression and figure out what was being filtered out and write an exploit. Boom, goes on milw0rm, exploit in the wild and I can’t do a damn thing about it. If there’s a hole, there will be an exploit somewhere. And open source software has no way to really avoid full disclosure because of version control and diffs.

If we didn’t have script kiddies, people would have no inclination to apply updates, and when someone did decide to pull off an elaborate hackfest, it would be mayhem. Instead, full disclosure means ImageShack contained your attack enough that they were able to restore everything from backups with no particularly heavy repercussions.

Full disclosure is inevitable. The whole reason full disclosure policies are put into place is because every vulnerability will get leaked at one point or another, so best to just publish it and get it over with, so that others can understand the vulnerability and avoid similar problems within their own code. Full disclosure is a driving force behind the growth of the security and software industry because people learning from each other is the most productive way for a group as a whole to become better. And because full disclosure is an inherent part of open source software as mentioned above, if you are against full disclosure, you are also against open source software. Open source software that you’re probably using to pull off your hackfest. I dare you to hack my blog with only closed source tools. In fact, I’ll make a bet. If you do that and e-mail me with a detailed explanation of how you did it, I’ll replace this blog with whatever non-pornographic “pwn3d” page you want.

As an added bonus, if publication wasn’t enough, these exploits are mirrored and distributed widely across the Internet with a nice little advertisement embedded in them for the crew or website which first exposed the vulnerability to the public.

It’s about money. While the world is difficult to change, and money will certainly continue to be a very important in the eyes of many, our battle is that of the removal of full-disclosure for the purpose of making it harder for the security industry to exploit its consequences.

What’s wrong with giving credit where credit is due? What’s the problem with a little self-promotion? What’s the problem with being competitive?

For what it’s worth, I don’t make a dime when someone visits my blog or any of my other sites. I pay $10 a year for the domain, and I host it all myself. But I’ll still credit myself if I ever post an exploit, because it helps me to build a reputation. I’m a kid that just graduated high school and am looking to make a name for myself in the security industry so that I can get a good job and make a living. How am I supposed to do that if I don’t get any credit for my work? It pays to put “Discovered X vulnerability in Acme, Inc. Foo Application (CVE-2009-1234)” on a résumé.

It is our goal that, through mayhem and the destruction of all exploitive and detrimental communities, companies, and individuals, full-disclosure will be abandoned and the security industry will be forced to reform.

How do we plan to achieve this? Through the full and unrelenting, unmerciful elimination of all supporters of full-disclosure and the security industry in its present form. If you own a security blog, an exploit publication website or you distribute any exploits… “you are a target and you will be rm’d. Only a matter of time.” This isn’t like before. This time everyone and everything is getting owned.

Signed: The Anti-sec Movement

Try me.

I just wrote my argument on why full disclosure is good for the industry. Counter it, and you’ll get your message pushed across further. Or, you can just hack my blog to death using your tools that were authored around the very principle you are rejecting, and I’ll just shell into my server and take down your “pwn3d” page and restore a backup, and you won’t get anywhere.

Bring it on, I dare you.