3 ms·

Represents most of what I hate about the 'security industrial complex'. Self serving and to that point at the bottom of the page is a link saying: 'With the di

by gist 7y ago

Represents most of what I hate about the 'security industrial complex'. Self serving and to that point at the bottom of the page is a link saying: 'With the discovery of the CDPwn vulnerabilities, organizations from every industry as well as governments are looking for a way to identify which of their devices are impacted by these vulnerabilities. Armis offers a CDPwn Risk Assessment to help organizations looking to understand their exposure.' Then - 'Request a CDPWN threat assessment'.

miah_ 7y ago
My thoughts as well. I'm interested in hearing about new novel security issues; I'm not interested in reading a advertisement. With widespread deployment of IP Phones and the like, I think this is a interesting find. But at the same time I wish I read about this on bugtraq.
- IAmEveryone 7y ago
  I guess for the benefit of having people work on such things you will occasionally have to suffer through the brutal injustice that is ... a single-line text ad at the end of an article?
- jlgaddis 7y ago
  They provided a very detailed, technical, 29 page PDF as well.
- drcross 7y ago
  Same. I'm a CCIE and after a five minute skim I can't tell if this is grandstanding or an actual threat. Best practice is to disable CDP on all eternal interfaces. This is a given.
  - Bluecobra 7y ago
    There's a funny name and a logo, so grandstanding.
falcor84 7y ago
I don't understand where you're coming from. Given that there isn't some global cybersecurity authority employing enough people to find all security vulnerabilities out there, security researchers need to have some way of earning money. This approach of openly working with the wider community and then providing paid professional services on top of it seems to me to pretty much be the nicest possible way of doing this. I'm confident that they could have earned a lot more by almost any other approach.
- gist 7y ago
  Finding security vulnerabilities is an industry that gains by the type of wide and open disclosure that is done. And revels and enjoys the process and profits from it. An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. How about if I say 'hey Paul Graham' (using him as an example) I will give you 90 day to remove your home address from public records and if you don't I will then publish that address in the open. Of course anyone can find the info just like I could (let's say). But my act of making the info more widely know would put Paul at greater risk than he'd be if I didn't do that. Now let's say I find a way to profit from that activity. Now multiply that.
  - falcor84 7y ago
    >An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. There are two ways I can read it, the first being almost a tautology (if no one pursues it, then it won't likely be found by accident), and the second (if white-hats don't pursue it, then it won't be found by black-hats either) sounds very unreasonable to me. The black market for zero-days is quite active, with prices for a single vulnerability in the millions [0,1]. So I'd appreciate if you can provide any citation that the "overwhelming majority" of security researchers are white hats. I'd find that to be as surprising as a statement that an overwhelming majority of people breaking into houses are locksmiths. [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...

by gist 7y ago

miah_ 7y ago

My thoughts as well. I'm interested in hearing about new novel security issues; I'm not interested in reading a advertisement. With widespread deployment of IP Phones and the like, I think this is a interesting find. But at the same time I wish I read about this on bugtraq.

IAmEveryone 7y ago
I guess for the benefit of having people work on such things you will occasionally have to suffer through the brutal injustice that is ... a single-line text ad at the end of an article?
jlgaddis 7y ago
They provided a very detailed, technical, 29 page PDF as well.
drcross 7y ago
Same. I'm a CCIE and after a five minute skim I can't tell if this is grandstanding or an actual threat. Best practice is to disable CDP on all eternal interfaces. This is a given.
- Bluecobra 7y ago
  There's a funny name and a logo, so grandstanding.

falcor84 7y ago

I don't understand where you're coming from. Given that there isn't some global cybersecurity authority employing enough people to find all security vulnerabilities out there, security researchers need to have some way of earning money. This approach of openly working with the wider community and then providing paid professional services on top of it seems to me to pretty much be the nicest possible way of doing this. I'm confident that they could have earned a lot more by almost any other approach.

gist 7y ago
Finding security vulnerabilities is an industry that gains by the type of wide and open disclosure that is done. And revels and enjoys the process and profits from it. An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. How about if I say 'hey Paul Graham' (using him as an example) I will give you 90 day to remove your home address from public records and if you don't I will then publish that address in the open. Of course anyone can find the info just like I could (let's say). But my act of making the info more widely know would put Paul at greater risk than he'd be if I didn't do that. Now let's say I find a way to profit from that activity. Now multiply that.
- falcor84 7y ago
  >An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. There are two ways I can read it, the first being almost a tautology (if no one pursues it, then it won't likely be found by accident), and the second (if white-hats don't pursue it, then it won't be found by black-hats either) sounds very unreasonable to me. The black market for zero-days is quite active, with prices for a single vulnerability in the millions [0,1]. So I'd appreciate if you can provide any citation that the "overwhelming majority" of security researchers are white hats. I'd find that to be as surprising as a statement that an overwhelming majority of people breaking into houses are locksmiths. [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...