Tag: OSVDB

  • We’re Doing the Unthinkable

    [This was originally published on the OSVDB blog.] Anyone who knows me in the context of vulnerability databases will find this post a tad shocking, even if they have endured my rants about it before. For the first time ever, I am making it policy that we will no longer put any priority on Vulnerability…

  • Errata or VDBs – My real hobby?

    Every month or three, I am reminded that people in the InfoSec industry don’t know me very well. They primarily know the Jericho that likes squirrels, runs attrition.org, and points out all the muck of the industry via the Errata project. To be sure, Errata is was a passion for a long time. The last…

  • howdoireportavuln.com – Good intentions, needs fix-ups though

    [This was originally published on the OSVDB blog.] Tonight, shortly before retiring from a long day of vulnerability import, I caught a tweet mentioning a web site about reporting vulnerabilities. Created on 15-aug-2013 per whois, the footer shows it was written by Fraser Scott, aka @zeroXten on Twitter. http://howdoireportavuln.com/ I love focused web sites that…

  • Buying Into the Bias: Why Vulnerability Statistics Suck [Abstract]

    [This was originally published on the OSVDB blog.] Last week, Steve Christey and I gave a presentation at Black Hat Briefings 2013 in Las Vegas about vulnerability statistics. We submitted a brief whitepaper on the topic, reproduced below, to accompany the slides that are now available. Buying Into the Bias: Why Vulnerability Statistics SuckBy Steve…

  • Seriously RIM? Call it the HackBerry from now on…

    [This was originally posted on the OSVDB blog.] Our sponsor Risk Based Security (RBS) posted an interesting blog this morning about Research In Motion (RIM), creator of the BlackBerry device. The behavior outlined in the blog, and from the original blog by Frank Rieger is shocking to say the least. In addition to the vulnerability…

  • Cybercrime Stats: From Bad to Bad

    [This was originally published on the OSVDB blog.] Since vulnerabilities are a cornerstone of computer crime, stats on it are of interest to us. Statistics on cybercrime have always been dodgy; more so than real-world crime statistics. When your car is broken into or stolen, you know it. More often than not, you will report…

  • Android versus iOS Security – Not Again…

    [This was originally published on the OSVDB blog.] About two weeks ago, another round of vulnerability stats got passed around. Like others before, it claims to use CVE to compare Apple iOS versus Android in an attempt to establish which is more secure based on “vulnerability counts”. The statistics put forth are basically meaningless, because…

  • The curiously creeping value of the iOS vulnerability…

    [This was originally published on the OSVDB blog.] The market for vulnerabilities has grown rapidly the last five years. While the market is certainly not new, going back well over ten years, more organizations are interested in acquiring 0-day / private vulnerabilities for a variety of needs. These vulnerabilities cover the gambit in applications and…

  • Local File Inclusion vs Arbitrary File Access

    [This was originally published on the OSVDB blog.] Notes for this blog have been lingering for over three years now. In the daily grind to aggregate vulnerabilities, the time to write about them gets put on the back burner frequently. Rest assured, this is not a new issue by any means. Back in the day,…

  • Mobile Devices and Exploit Vector Absurdity

    [This was originally published on the OSVDB blog.] The last few days has seen several vulnerabilities disclosed that include serious gaps in logic with regard to exploitation vectors. What is being called “remote” is not. What is being called “critical” is not. Here are a few examples to highlight the problem. We beg of you,…