4 ms·
> At that point, the incentives strongly favor the attackers, who will work quickly to join the in-crowd and exploit the window of time where they know how to
by parennoob 13y ago
> At that point, the incentives strongly favor the attackers, who will work quickly to join the in-crowd and exploit the window of time where they know how to exploit the flaw, and site operators don't know enough about it to take it seriously.
Has this sort of behaviour been observed for other vulnerabilities in the wild that can be cited? I would think that the patch is small enough that a co-ordinated deployment to all the distros could have been managed so that they had packages ready before attackers could exploit the vulnerability. Not sure that the correct solution is to announce it with a corporate blog post and a vanity web site instead.
- frandroid 13y agoThere's another name for the phenomenon described by tptacek above: insider trading. Plenty of examples in the wild. The more insiders know what's happening before the markets do, the more likely someone will act on it, or sell the information.
- deleted 13y ago[deleted]
- rdl 13y agoSomeone still being on 0.9.8 and this not being vulnerable isn't too meaningful as an indicator. If they mysteriously went from 1.0.1f back to 0.9.8 without changing any other part of their configuration, that would be suspicious. The lulzy thing about this bug is that people who are still on 0.9.8 aren't doing the right thing; they just got lucky on this one bug.
- drewcrawford 13y ago> Has this sort of behaviour been observed for other vulnerabilities in the wild that can be cited? Yes. The mailing list that was used as recently as 2011 to coordinate exactly this kind of issue was backdoored. Further reading: http://www.openwall.com/lists/oss-security/2011/03/03/3 http://www.openwall.com/lists/oss-security/2011/03/03/3