Legal Battle Brewing Over Release of Telnet Exploit?
Network administrators have been scrambling to secure their servers since news of a vulnerability in the Telnet program -- used to remotely access servers -- first came to the public's attention last week when a group of network security enthusiasts called TESO Security posted advisories to several security mailing lists.
On Tuesday, the Computer Emergency Response Team (CERT) issued an advisory that servers running the Berkeley Software Design (BSD) operating system were vulnerable to the flaw. But less attention has been paid to a possible legal battle brewing behind the scenes between TESO and a prominent security mailing list owned by security firm SecurityFocus.com.
On Tuesday, the Computer Emergency Response Team (CERT) issued an advisory that servers running the Berkeley Software Design (BSD) operating system were vulnerable to the flaw. But less attention has been paid to a possible legal battle brewing behind the scenes between TESO and a prominent security mailing list owned by security firm SecurityFocus.com.
On Tuesday, a member of the Bugtraq mailing list, which boasts upwards of 50,000 subscribers, posted an exploit -- developed by TESO -- which takes advantage of the vulnerability, despite the fact that the exploit's header forbade distribution of the exploit, and gave mailing lists and Bugtraq in particular as examples.
"We did not give out the exploit to anyone and have not done so since it was written," said Sebastian, a member of TESO and the discoverer of the vulnerability. Sebastian chose to remain "pseudonymous."
"We were aware that if the exploit is publicly posted on Bugtraq or another public Web site it would mean great damage, so we put a warning message that legally forbids doing so in the top of the exploit source code, so that if it ever falls into the wrong hands at least there is some extra 'protection.'"
Sebastian said TESO is still considering whether to pursue legal action, but has not yet retained an attorney.
Bugtraq's point of view
The Bugtraq mailing list is administrated by Elias Levy, who is responsible for approving or disapproving all messages sent to the list.
"The approval of TESO's exploit was an error as we have stated on the list," Levy told InternetNews.com. "This does not appear to have been sufficient for TESO. We do have to wonder, how did their exploit end up being used by criminals to break into machines, and [we] find it ironic that while their exploit is being openly traded in the underground they did not wish to provide the public with access to the same so that at the very least they could examine it and use it to test their own systems."
Indeed, TESO's exploit has been in the wild for a while, and has been used by unskilled crackers (malicious hackers) dubbed 'script kiddies,' to deface a number of Web sites.
Sebastian told InternetNews.com that after discovering the flaw about one and a half months ago, TESO researched the exploit which was later stolen from its network.
Sebastian explained, "We do not know how this happened as of yet. Anyway, we were notified by an anonymous person that the exploit has been used to break into his server machine and the attacker left the exploit header (the copyright and one-line description) as a proof on his server.
"We instantly knew that this was no good news and would probably mean a lot of illegal activity using our exploit. So we decided to release an advisory to the public as soon as possible, although we have not yet researched all vulnerable platforms and have not compiled full details on the vulnerable systems."
Sebastian added, "The exploit has been stolen before, and was indeed 'traded' among relatively unskilled system crackers. We also have received mails of persons who apparently had the exploit before it was sent to Bugtraq. "Nevertheless, the distribution through Bugtraq added massively to the problem from our point of view."
While acknowledging that he had been in error in publishing the exploit, Levy said, "We do not encourage people that find vulnerabilities to release exploits, although we understand that some people may think it's necessary. We encourage people that wish to release some type of demonstration tool to create it in such a way that it only allows for the testing, not the exploitation, of the vulnerability. That being said, if there is an exploit in the wild we will publish it so as to allow the public to be aware of its existence, study it, and use it for their own testing."
