4 ms·

This seems dodgy to me on a post of this nature: Does your web app need a security audit? YES. Get your security assessment here <-- links to presumed sales co

by gruseom 17y ago

This seems dodgy to me on a post of this nature: Does your web app need a security audit? YES. Get your security assessment here <-- links to presumed sales contact form Can someone who knows the industry comment on this practice? (tptacek?)

bittersweet 17y ago
In my opinion this is a bit like finding a exploit in a site and contacting the company and publishing it later. It certainly is more flashier then reading a .txt. He uses a sort of scare tactic to let people see how easy it is to get into some of the sites, it might work well. I bet Cloudkick has this as their top priority now. On the other hand, I don't know how many companies would want to hire him if he didn't take the time to contact Cloudkick.
- iuguy 17y ago
  I work in the industry and if what has happened is that the site requested a test from them and was happy for them to publish this then yes I guess it's appropriate, but I wouldn't really do it as it associates the firm with hacking live sites. To put it another way, to demonstrate the exploit you have to actually conduct the attack. To find the exploit you have to do a PoC. If this was done without explicit permission from the site owner it's legally shaky ground at best and certainly (at least as far as I'm concerned) unethical.
tsally 17y ago
I'm not employed in the industry, but unless they disclosed to vulnerability to the company before posting the video, it's definitely shady. I'm not so sure companies will respond well to researchers waving around exploits in public and then trying to sell an audit. Surprised and angry people aren't the best consumers.
tptacek 17y ago
I've never heard of Adam Baldwin, nGenuity's security person and presumably the impetus behind "evilpacket". He's ex-Symantec consulting; my cofounders cofounded @stake, which is now known as Symantec security consulting, and I don't believe it was ever their practice to make video demos of unpatched vulnerabilities. I don't know enough about what's going on here to comment further, but I can say that nGenuity is going to find it hard to keep working with major vendors if they're going to actively screw over other vendors. Maybe that's not what they're doing here though.

by gruseom 17y ago

bittersweet 17y ago

In my opinion this is a bit like finding a exploit in a site and contacting the company and publishing it later. It certainly is more flashier then reading a .txt. He uses a sort of scare tactic to let people see how easy it is to get into some of the sites, it might work well. I bet Cloudkick has this as their top priority now. On the other hand, I don't know how many companies would want to hire him if he didn't take the time to contact Cloudkick.

iuguy 17y ago
I work in the industry and if what has happened is that the site requested a test from them and was happy for them to publish this then yes I guess it's appropriate, but I wouldn't really do it as it associates the firm with hacking live sites. To put it another way, to demonstrate the exploit you have to actually conduct the attack. To find the exploit you have to do a PoC. If this was done without explicit permission from the site owner it's legally shaky ground at best and certainly (at least as far as I'm concerned) unethical.

tsally 17y ago

I'm not employed in the industry, but unless they disclosed to vulnerability to the company before posting the video, it's definitely shady. I'm not so sure companies will respond well to researchers waving around exploits in public and then trying to sell an audit. Surprised and angry people aren't the best consumers.

tptacek 17y ago

I've never heard of Adam Baldwin, nGenuity's security person and presumably the impetus behind "evilpacket". He's ex-Symantec consulting; my cofounders cofounded @stake, which is now known as Symantec security consulting, and I don't believe it was ever their practice to make video demos of unpatched vulnerabilities. I don't know enough about what's going on here to comment further, but I can say that nGenuity is going to find it hard to keep working with major vendors if they're going to actively screw over other vendors. Maybe that's not what they're doing here though.