Security

Ask something
Discussion Locked

Do administrators really care?

0 helpful
24 replies

by robert

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

once a month I do a security audit on 100+ web
sites using only a standard web browser: Netscape
by name. The summary is on my site at
http://www.asrdesigns.ltd.uk/security.html

I have written to a number of the webmasters of
sites that I rate as 'severe vulnerability'
(about 14% of sites) offering a commercial
service at less than $300. Their attitude ranges
from accusing me of black mail to 'so what'. So
what if I can get to the home address and
telephone number of employees? So what if I can
access the client databases? So what if I can
get to user names and crack their passwords? And
as to black mail, $300 would not cover my phone
bill some months.

Perhaps WebMasters and Server Administrators arescared to accept specialist assistance as they
see it as weakness on their own part. In the
mean time the information that they are the
guardians of is open to less benevelant
observation than mine.

Regards, Robert.

24 replies

by robert

So how would you have written the topic so not as to be 'spam'? I feel as strongly about vulnerable web sites as you seem to about spam.

There is a young man in Wales facing a jail sentence and confiscation of his equipment for trying to force people to take notice of what he was saying. It appears people only took notice after he took money out of accounts. His action was undoubtedly the wrong thing to do.

The ISSUE of what was the content was not addressed by the reply. Is it that people here too only care about what they consider as spam rather than the issue of web server security?

by garetht

>The ISSUE of what was the content was not addressed by the reply.
The ISSUE of the content appeared to be: Here is my web address, here is the amazing things I can do, and let me tell you my cost. Twice. A mere $300.

Sure, I see no problem using a real life example, and it's rather handy that it's your line of business, but the exact details of your service appeared to be pushed rather hard.

The topic is interesting, but I don't see why you had to advertise your site & cost. Perhaps your intentions were strictly academic, and if so, I wholeheartedly apologise for the insinuation, but it strongly smelt of spam.

Re: "Do you even know what spam is? Really, do you?" Yes, yes I do.
Thanks for asking. And in such an antogonistic way, too.

On topic, obviously, I would expect all decent Sys admins to reply, "Yes, we take security very seriously" but it seems a week doesn't go by without a high profile 'info-leak.'

The people you contact may be understandably reticent to hand over their security issues to an unknown, preferring to handle everything in-house (or not handle it, as the case may be..)

Re: "Your attitude seems to be, "don't bother me with security when I'm busy."" Who exactly are you talking about? The belief that no Sys admins care about security is laughable. The belief that a few admins don't take security as seriously as they should is perhaps more believeable.

by ebob

Thanks for the offer of assistance, BUT "we" will be the judge of whether "our site" poses a "severe vulnerability" risk. We will use our standards and our tools.

Thank you very much.

by buffalodan

If you REALLY REALLY cared about web site and network vulnerabilities, perhaps you might better have expressed to the administrators what you found and how to close the holes, rather than tell them they've got problems and must hire you to fix them.

Take a lesson from Steve Gibson, (www.grc.com), He hates hackers so bad, he Gives away tutorials, and firwall software.
(Good stuff too!)

In America, after the civil war, The Southern States were a mess, many people came to the south to helprebuild, but many other's also came and took advantage of their weekness. These people were known as Carpetbaggers. here in America, there is an inherant level of distrust in one who would, without being asked for, point out my weeknesses, and solicit money from me to repair them.

The key here is that you are UNSOLICITED.

While your intentions might be honorable, the appearance is of one who would willingly take advantage of another's weekness.

by pallan

Really, do you? If you're seriously accusing this person of spamming, you clearly don't.

To address the original poster's question, *good* administrators care. They're the ones that have patched the holes, so you would almost never have cause to offer them your services. Unfortunately, good administrators are vastly outnumbered by clueless, cookie-cutter trained hacks.

by ebob

We have our own set of measurement tools, and are happy to rate our own site as to whether it suffers from 'severe vulnerability'. Thanks very much!

Which is what we invariably tell the spammers that send us these alarmist solicitations (that is,if we even bother to respond).

by mjervis

Is your sales aproach as harsh as your discussion? If so I can see how administrators would be pushed back. Your aproach to me would sound like black mail or extortion also if it is worded as your discussion is.

However aside from that your point is very valid. Why do I think your not getting the response you want? Many administrators work long hard hours putting together their sites with the skills they have. Yes of course some fall short of being secure. Be it maybe time constraints, budget, or skills. You may have the best thing on the market but if your trying to get people to listen to you like that you will not sell to much.

Administrators will listen. However I know many times sales people such as yourself call me when I am at the end of a project or busy with a piece of hardware that failed or anything along that line. I ask the sales person to call me back when I have time and thier answer is to keep pitching thier sale. They want to sell me thier product now because Ineed thier product. Well NO I DON'T. Not at that point. I need to focus on what I have in front of me then I can give time to that sales person after.

I am not accusing all sales people in this field of being like this, however the majority do fit into the above described category. And you know something? Since you didn't have the decency to allow me to get of the phone to work on my project and give you a call back later, I will not call you back.

If you haven't noticed thier is a big push for people in the IT field and some of us that are in this field have a lot of work on our shoulders. Work with your administrators more, if they ask you to call them back later do it. IT professionals do not sit at thier desks all day. Most are right out there doing the repairs and taking care of thier users. Respect thier time constraints and you may find the payback rewarding.

by pallan

Blackmail: If you don't give me $300, I'll trash your site.

Helpful warning: Your site has known security issues and is vulnerable to attack. For $300, I'll close the holes.

See the difference?

Your attitude seems to be, "don't bother mewith security when I'm busy." Security should always be your top priority, and you need to start listening when someone tells you you're not secure.

by robert

Perhaps because I am a developer and not a sales person, I came on too strong.

The holes I am finding are very easy to detect with a browser. I only started sampling because I had been on a training course and did not believe things could be as bad as the instructor suggested.

As a developer I have to document my code: its the bit that can be 'left-off', or I'll do it later. But if I do, I leave somebody else with a problem. I think that with security, it cannot be left-off or looked at later.

Please note that I have never telephoned any-one to sell this. I have only sent e-mails and always addressed these to the WebMaster where the site gives one to contact.

I disagree with illegal action to force the issue. I have not even been tempted to break something to make the point.

Regards, Robert.

by altserver

I think most admins do care, but many admins have two conditions that may contribute to irrational responses (to your solicitation): ego and stress. I think if I received your offer, along with the security analysis of my website, I'd be annoyed momentarily before realizing the importance of the information. There's no logical reason for it - it's just that:

1) I'm tired of unsolicited offers (Yes, I should be glad to have the information, if not the help.)
2) I don't like people probing for security holes unasked (Yes, I know it happens all the time whether I like it or not.)
3) I planned to do a security audit, but haven't had the time (Yes, I know that's what you're offering to help with.)
4) I'm embarrassed that I allowed the problem to exist (Yes, I know I'd be more embarrassed if we were actually hacked.)
5) It's hard enough to get managment to pay for new backup tapes before they start failing, much less hire a consultant (Yes, I should explain what it could cost if wedon't fix the problem.)

None of this is your fault, and I would reconsider, thank you for the information, and fix it myself; but other people can be more uptight, for their own reasons, and that's just the way people are. You need to either consider a new approach or ignore them and move on. IMHO complaining is unproductive and ridiculing them (even without disclosing who they are) on your website is unprofessional.

Good luck.

by robert

Thanks for your comments and suggestions. The quotes referred to have now been deleted.

Regards, Robert

by william shipway

My experience of admins is that most do care to some extent. The good ones are professional and care a lot - but as said before, they are usually the ones who have fixed the problems or found them and helped developers fix them.

I agree with altserver's reasons why an admin would not be happy about receiving your email. I would feel similar initially and in my case it would be due indirectly to the number of items on my to-do list that are considered by my management as higher priority than security. I guess I have some bargaining to do there! And I also receive way too much advertising email so have a poor view of unsolicited ad emails.

I'm a member of SAGE-AU and we have a system admin code of ethics. It relates a bit to this. Check it out at http://www.sage-au.org.au/resource/ethics.html

William

by pallan

We could argue all day about whether or not this thread was started as free advertising, but it would accomplish nothing. The original poster has, however, raised an important question worth discussing. It certainly isn't spam. Spam is unsolictedmass-advertising through private email. This is a message posted to a public forum.

As for my other comment, it wasn't even directed at you. The person I was replying to stated quite clearly that he was too busy to be bothered with this sort ofthing.

Stop, take a deep breath. Spend a little less time needlessly antagonising people, and maybe check your server patches while you're at it.

by epepke

You appear to be operating according to a model of humanity which, while heartwarmingly idealistic, is poorly predictive of the way people behave.

I suggest finding a copy of _Surely You're Joking, Mr. Feynman?_ and reading his accounts of his experience working on the Manhattan Project. You know, the atom bomb. He describes probing for security problems and receiving much the same reaction that you did.

Given that this was a top secret project, one might naively have thought that they would care about security. One would be wrong. Do you expect webmasters to be any better?

"Security" is primarily a social function, not a technical one. That which gives the Big Cheese a warm fuzzy feeling is "secure." That which makes him uncertain is not. The fact that this fuzzy-feeling-tropism actually makes systems *more* vulnerable to breaking is irrelevant.

Thus, the Germans in WWII weakened their Enigma encryption enough so that Alan Turing could break it. Thus, the U.S. issues useless background checks with one hand and openly promotes spies to positions of prominence with the other. Thus, rather than fix a few obvious boneheaded bugs, most people prefer to pant-hoot about Filipino teenagers who are, after all, comfortingly "other."

It's all monkey games.

by e-fellow

Would you break into persons homes and then send them a letter and say "HEY I WAS ABLE TO BREAK INTO YOUR HOME AND TAKE SOME STUFF, FOR SOME MONEY I WILL FIX IT WHERE OTHER PEOPLE CAN'T DO THAT. OH BUT YOU STILL CAN!!!! What a bunch of crap! You areobviously a very technically smart person, but your tact is lacking, you should be selling your skills, UP FRONT, not after the BREAK-IN. What happens after you get paid and another person breaks in, DO YOU GUARANTEE 100% SECURETY, HECK NO? OR CAN YOU? IF YOU CAN AND CAN BACK IT UP LET ME KNOW.

by pallan

The script kiddie who walks through the gaping hole in your security will be the ultimate judge of your work.

by dsr28

I think the problem is positioning. You are *attacking* the site and then telling the administrator that you can fix it for a fee. If the administrator chooses to believe your findings are legitimate, he probably will just roll over the logs and see what has happened, if he is not too proud of his administrative efforts to date. If he doesn't believe you are legit., his response should be very negative. Imagine returning to your car after a movie, and the door is unlocked - with a message "I found a way in your car - call me to ensure this doesn't happen again"

by robert

So I changed my approach: I now offer to check for free for four weeks. I offer a one off report for free. I still get no uptake.

Last week I found a SSL certificate. This week I got to read the configuration files and logs of a major bank, should I really do nothing more?

by shanghai sam

I find this discussion very interesting.It's a question I've asked myself many times. I've read the responses to your posting and could see how your approach might anger many administrators. It might be wise for you to try another approach to advertise your services. However, if I received such an email and there was proof that someone had actualy gotten into my system, I would take it very serious. Although I probably wouldn't call the person that sent me the email because of lack of trust. I would definetly find someone I could trust to look into what the email revealed. I agree that the administrators top priority should be to secure their site. No excuses, if the site contains buisness information or customer info. I also feel that although most administrators care, The ones I've worked with don't care enough. Primarly because of lack of knowledge or mixed priorities. The administrators I have worked with have alot of weight on there shoulder. Much of the weight is from the chip their carrying on it. Coming up through the ranks I remember how I was treated, especially when I was a new technician. I remember sending my administrator at the time many security updates / patch info, but none of it was acted on. I'm talking simplethings like browser security patches. I would even tell them that I would install them. Not once did that administrator act on the information. So I find myself asking many times the same question, Do they care? I guess the answer is as one replier said, "Good" administrators care.

by kima

Reality is that you can't tell somebody hey I got into your website, here are your vulnerabilities if you pay me I'll tell you how I did it.

Have a different approach, maybe sell your services in a different manner. As for administrators gettingthis type of e-mail, remember their job is in the line if SECURITY is not strong enough so most of them won't even aknowledge it, then again there are the ones that would carefully review what you said and might consider it.

Here is what you can do, design a website describing the type of job you can perform, post a description on sites that you know most IT people go to such as this one as well as newspapers and magazines on the net.

You know something like: experience INTERNET SECURITY TESTER with *years experience have the ability to check websites for vulnerabilities at a fair price. For references please feel free to contact the following companies... and so forth.

Maybe this works, give it a try and good luck

by robert

Thanks Karen,

I have written a web page that does much as you suggest. I would not use client names as references however. As the discussions here have shown, nobody likes having their nose rubbbed in their own dirt.

I have sent a press release to as many relevant magazines as I could find. I am paying for a half page advert for three months in 'e-web' magazine, but I think this is only distributed in the UK.

Thanks again for the encouragement.

Regards, Robert.

by generalist

Another approach is to provide 'free' advice to those people with vulnerabilities. A well worded letter mentioning that there are flaws and suggesting ways to correct at least one of them might work. If you're phrasing hints that there are other flaws out there, they might nibble.

Just be sure to include a link to your web site. And also try to keep the flaw list short and as generic as possible. You don't want your potential clients to share your solutions with each other.

by robert

I have sent a number of these by e-mail and snail mail. The only replies I have had want more for free, say its not important, they have no budget for this, tell me not to write again, thank me for my 'considered opinion' and so on. Hence my initial thought that people do not care. Curiously, nobody reading this thread has asked for a free report either.

Regards, Robert.

This discussion is closed to new replies.