4 ms·

There are literally companies you can hire that will go this far pentesting your company and the employees involved are not in on it. How else do you prove you

by lrvick 6y ago

There are literally companies you can hire that will go this far pentesting your company and the employees involved are not in on it. How else do you prove your process can stop real infiltrators by state actors?

bawolff 6y ago
So? The difference is consent (in your case of the owners of the company). There are many crimes in the world that are only crimes if you do it without consent. > How else do you prove your process can stop real infiltrators by state actors? One of the common security controls against infiltration by foreign nation states is espionage being a capital offense. Well obviously not appropriate, i think that its pretty obvious that these researchers would have not succeded if they faced the electric chair like a spy would. So i don't think the comparison is apt.
- lrvick 6y ago
  So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in an org of 100,000 is this still okay? It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window. Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals. Real world bad actors are backdooring these projects constantly. I specialize in this area of research. If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain. The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.
  - bawolff 6y ago
    > So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? You have to get consent from someone who has legal authority to give it to you. > If every white hat has to get permission from exponentially large dependency chains They don't. They just have to get permission from someone in authority. Different open source projects have different governance structures. Sometimes that is a single person. > The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate. If you are hacking someone elses system without their consent (not to mention for your own personal gain), you are a blackhat. By definition. Pretending to be a researcher doesn't change that.
avereveard 6y ago
> you can hire there lies the difference, duh.
- lrvick 6y ago
  And what about the hundreds of NPM dependencies in VS Code no one reviews? Or the the thousands of brew packages that are blindly merged unsigned by 800 people with access? Who pays to give a white hat as much freedom to find supply chain attack vectors here? Who gets consent from every random student whose code, if compromised, would compromise every major company? We have created a massive mess, and I don't know that we will be able to hire enough researchers to fix it. We are going to need unpaid volunteers, and a lot of them.
  - avereveard 6y ago
    holy moving the goalpost batman, slow down. > We are going to need unpaid volunteers, and a lot of them. that's absolutely orthogonal to the question at hand, it's not a matter of paid or unpaid, neither being volunteer or not: it's a matter of consent. if you don't sought consent beforehand either via a contract relationship or a sponsored bug hunt program or the likes, you're a racketeer, not a white hat, and you should (and will) be treated as such.

by lrvick 6y ago

bawolff 6y ago

So? The difference is consent (in your case of the owners of the company). There are many crimes in the world that are only crimes if you do it without consent. > How else do you prove your process can stop real infiltrators by state actors? One of the common security controls against infiltration by foreign nation states is espionage being a capital offense. Well obviously not appropriate, i think that its pretty obvious that these researchers would have not succeded if they faced the electric chair like a spy would. So i don't think the comparison is apt.

lrvick 6y ago
So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? If you have approval from one person in an org of 100,000 is this still okay? It has to be, because getting explicit consent from every person in the org at that size would be untenable, and make them artificially extra vigilant during a potential audit window. Well now scale this to open source. The typical web project has 2k+ random nodejs libs in their dependency tree. These are all separate orgs/individuals. Real world bad actors are backdooring these projects constantly. I specialize in this area of research. If every white hat has to get permission from exponentially large dependency chains, they will never even come close to being able to compete with black hats here finding the weak links of the chain. The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate.
- bawolff 6y ago
  > So if we get consent from a C-level at a company, we don't need consent from every other lower level person we trick? You have to get consent from someone who has legal authority to give it to you. > If every white hat has to get permission from exponentially large dependency chains They don't. They just have to get permission from someone in authority. Different open source projects have different governance structures. Sometimes that is a single person. > The blackhats set the rules of engagement, for better or worse. White hats should be free to go for it just like with any other vulnerability they evaluate. If you are hacking someone elses system without their consent (not to mention for your own personal gain), you are a blackhat. By definition. Pretending to be a researcher doesn't change that.

avereveard 6y ago

> you can hire there lies the difference, duh.

lrvick 6y ago
And what about the hundreds of NPM dependencies in VS Code no one reviews? Or the the thousands of brew packages that are blindly merged unsigned by 800 people with access? Who pays to give a white hat as much freedom to find supply chain attack vectors here? Who gets consent from every random student whose code, if compromised, would compromise every major company? We have created a massive mess, and I don't know that we will be able to hire enough researchers to fix it. We are going to need unpaid volunteers, and a lot of them.
- avereveard 6y ago
  holy moving the goalpost batman, slow down. > We are going to need unpaid volunteers, and a lot of them. that's absolutely orthogonal to the question at hand, it's not a matter of paid or unpaid, neither being volunteer or not: it's a matter of consent. if you don't sought consent beforehand either via a contract relationship or a sponsored bug hunt program or the likes, you're a racketeer, not a white hat, and you should (and will) be treated as such.