5 ms·
It’s probably safe to say that some major hacks have been made possible by security researchers publishing POCs for vulnerabilities that will inevitably never b
by suifbwish 6y ago
It’s probably safe to say that some major hacks have been made possible by security researchers publishing POCs for vulnerabilities that will inevitably never be completely patched by everyone. It’s not like a POC is just a tool that’s being abused, it literally has only one purpose.
- enkid 6y agoBlaming the security researcher is a bad idea. Without the security researcher, the tool would still be created and used by somebody. The security researcher highlights the problem and makes people understand the danger in it. Without the POC, is it highly likely people who know nothing about cyber security just wouldn't care about the vulnerability.
- suifbwish 6y agoI’m not blaming them in a bad way. I’m just saying it’s not completely not their fault. Releasing vulnerabilities and POCs for major applications should be handled with utmost care and responsibility unless they don’t care about the consequences of their actions. There are tons of script kiddies using POCs out there who would never be smart enough to create them themselves. It helps abstract the actual hacker process down to just grabbing a git library and executing it on a victim.
- SahAssar 6y agoHow do you properly test that you mitigated a vulnerability if you don't have a POC? POC's are useful for other purposes than malicious attacks.