LOGIN | REGISTER NOW | SUBSCRIBE
 

Outrunning the Bears


In-house hackers help Web sites stay steps ahead by finding vulnerabilities before they are exploited

By Jeff Feinman
Email    print   
July 1, 2007 —  (Page 1 of 3)
The term “hackers” does not merely represent the villains that break into Web sites to do malicious things and steal important information. There are the white knights of the hacker society as well, scanning Web sites and conducting penetration tests to find vulnerabilities. Ethical hacking has become a security tool, as organizations seek out their vulnerabilities before the wrong sets of eyes find them.

BUGS FOR SALE
A developer for the open source Metasploit project, a computer security project that provides help and tooling for penetration testing, said that hackers are starting to sell the vulnerabilities they find because bugs are getting harder to find. The developer, who asked to be referred to only as Pusscat, said sale prices depend on what the bug is.

Pusscat and other developers contribute exploit code to Metasploit on an ad hoc basis. Exploit code is code that takes advantage of a software vulnerability to subvert some security mechanism, most usually to execute arbitrary code on the system within the context of that process.

“There’s a lot of time and effort that goes into finding [vulnerabilities], and even more that goes into exploiting them,” Pusscat said. “It’s basically free work you’re giving the company if you disclose the bug. The ones that get disclosed are usually disclosed by people who think they have more going for them in name recognition than in selling the bug.”

Pusscat also said that hackers can achieve a great deal of fame and a stronger resume if they release vulnerabilities publicly.

Both Pusscat and Scott Laliberte, director of security assessments for Protiviti, a provider of audit and technology risk consulting services, said most hackers follow the unwritten rule of responsible disclosure, which calls for informing the company and giving them the information you have on the vulnerability, while the company in turn gives a timeline for fixing the patch.

Sometimes the researcher and the company can negotiate an acceptable time line, with the researcher vowing to keep it quiet until that date, and the company crediting the researcher for finding it, according to Pusscat.




Pages 1 2 3 


Share this link: http://sdt.bz/30856
 
Most Read Latest News Blog Resources
Taking enterprise architecture to the business side
Startup Corso is bringing out a cloud-based planning platform that ties into business plans
Top five apps to manage your workload
Web applications offer new ways to track your “to-do” lists
From the Editors: Node.js is unruly, but that’s where the fun is
The time to get involved with Node.js is now; Hadoop is about to break its own barriers
Zeichick’s Take: Looking for the best of the best of the best
It's time once again for readers to send in nominees for the SD Times 100
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
What Bears Repeating
Software development is hard. Software development can be made easier by disciplined team and managerial practices. The best programmers are Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
Agility, mom, and apple pie
If we're to evaluate the state-of-the-art in software development, we should start with the values espoused in the Agile Manifesto.
02/07/2012 11:57 AM EST

RIM woos developers with free tablet
How do you get more apps ported to the BlackBerry PlayBook? By giving every developer a free tablet, of course!
02/04/2012 01:57 PM EST

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

Bloomberg opens its API
Bloomberg's APIs could lead to a future standard for accessing market data.
02/01/2012 04:41 PM EST

 
Events calendar tab
Cloud Connect
2/13/2012 to 2/16/2012
Santa Clara
TechWeb

SPTechCon: The SharePoint Technology Conf.
2/26/2012 to 2/29/2012
San Francisco
BZ Media

RSA Conf.
2/27/2012 to 3/2/2012
San Francisco
RSA

IBM Pulse Conf.
3/4/2012 to 3/7/2012
Las Vegas
IBM Tivoli

Game Developer Conf.
3/5/2012 to 3/9/2012
San Francisco
TechWeb