What is meant by "releasing code tells the hackers what to attack"?

6

2

I came across this statement from a SolidCoin developer:

Can anyone explain this statement?

[06:48] gavinandresen: I came here to ask RealSolid to be responsible and report problems or vulnerabilities to the core bitcoin dev team before releasing code that fixes the exploit (because releasing code tells the hackers what to attack). RealSolid, I'll ask again: are you willing to do that?

The user "Gavin" asked RealSolid to first report vulnerabilities and only then fix them, because "releasing code tells the hackers what to attack". The conversation is archived in this chat transcript.

ripper234

Posted 2011-09-05T08:10:19.533

Reputation: 25 192

It might be best to quote from the original transcript to allow people behind firewalls who can't access the link, and link decay to be able to answer – Gary Rowe – 2011-09-05T08:21:40.957

@Gary - right you are. Done. – ripper234 – 2011-09-05T08:29:50.623

I reformatted the post to put the focus on the actual question rather than the chat transcript and the two participants. If I missed any of the salient points, feel free to edit them back in. – Robert Cartaino – 2011-09-07T16:41:47.367

2This is not a Bitcoin question (and hardly a question at all). It's about security in software development. Plus, I'm not sure discussing about how valid what somebody said is, is appropriate on a Q&A website. Such a discussion would be more appropriate on a forum. – David Ammouial – 2011-09-07T17:10:37.437

Answers

11

It would appear that Gavin is advising against providing zero-day attack vectors.

Essentially, if someone gives fairly precise instructions (e.g. a code sample) on how to exploit a vulnerability then anyone monitoring that discussion can exploit it. This is the zero-day exploit because no-one has had time to react, create an appropriate patch and disseminate it widely. Until the patch overtakes the exploit then the affected systems are vulnerable.

Consider the famous "Java Double of Death" (see http://www.exploringbinary.com/java-hangs-when-converting-2-2250738585072012e-308/ for details, Oracle fixed it here http://www.exploringbinary.com/fpupdater-fixes-the-java-2-2250738585072012e-308-bug/).

Imagine if a malicious coder decided to put that magic number into a request against your web API that and exploited the fact that you haven't patched your JVM? You'd be seeing an awful lot of unexplained JDK downtime and lost business.

There is a fair amount of discussion about this topic over on Security StackExchange which references this Wikipedia page about responsible disclosure.

Gary Rowe

Posted 2011-09-05T08:10:19.533

Reputation: 7 175

5What Gavin is asking for is a coordinated response to vulnerability discovery. Ideally, if someone discovered a vulnerability in the Bitcoin client software, they'd notify responsible parties for each crypto-currency. They'd all develop and test fixes, then the person discovering the flaw could announce it, and then every currency could release a fix simultaneously. Otherwise, it becomes a race to fix the bug before it's exploited as each crypto-currency happens to discover it, has developers who don't know about the problem, has to race to test a fix during an exploit event, and so on. – David Schwartz – 2011-09-05T18:39:54.353

3What David said. Creating a patch to fix a potential security exploit almost always gives attackers enough information about what the problem is to create an exploit. – gavinandresen – 2011-09-08T01:46:08.350

Asked: 2011-09-05T08:10:19.533

Viewed: 353 times

Active: 2011-09-07T16:34:51.523