4 ms·
Worked for a major medical device manufacturer in security for a few years. That was (and probably still is) their #1 threat model. Security Researchers at con
by mox1 6y ago
Worked for a major medical device manufacturer in security for a few years. That was (and probably still is) their #1 threat model.
Security Researchers at conferences moved the security needle far more than any other threat actor.
I wont opine on whether this is good or bad, just interesting to note that this is real.
The threat model is hard, because you have all this "meta" stuff. We also commonly ended up in "proving a negative" arguments with researches and regulators.
Researcher X says "I can do this, so giving this other set of circumstances I can probably do this".
We would say, "No, we looked into that, doesn't work that way."
Researcher X "Prove it".
We then enter a standstill where we try to figure out how we "prove" our product isn't vulnerable!?!?
It eventually felt like trying to prove bigfoot was or wasn't real.
- suifbwish 6y agoIt’s probably safe to say that some major hacks have been made possible by security researchers publishing POCs for vulnerabilities that will inevitably never be completely patched by everyone. It’s not like a POC is just a tool that’s being abused, it literally has only one purpose.
- enkid 6y agoBlaming the security researcher is a bad idea. Without the security researcher, the tool would still be created and used by somebody. The security researcher highlights the problem and makes people understand the danger in it. Without the POC, is it highly likely people who know nothing about cyber security just wouldn't care about the vulnerability.
- suifbwish 6y agoI’m not blaming them in a bad way. I’m just saying it’s not completely not their fault. Releasing vulnerabilities and POCs for major applications should be handled with utmost care and responsibility unless they don’t care about the consequences of their actions. There are tons of script kiddies using POCs out there who would never be smart enough to create them themselves. It helps abstract the actual hacker process down to just grabbing a git library and executing it on a victim.
- SahAssar 6y agoHow do you properly test that you mitigated a vulnerability if you don't have a POC? POC's are useful for other purposes than malicious attacks.