Re:Remote Code Execution on a Facebook server
by pvg on Saturday August 25, 2018 @07:03AM
(#17840380)
So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.
It's pentesting not penthieving. That's like saying military training is useless because they don't actually kill people.
Re:Remote Code Execution on a Facebook server
by throwawaymath on Saturday August 25, 2018 @10:25AM
(#17840885)
> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.
He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it.
> It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.
I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.
>He back-pocketed credentials, didn't tell anyone he had them
It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.