Legal Battle Brewing Over Release of Telnet Exploit?

Network administrators have been scrambling to secure their servers since
news of a vulnerability in the Telnet program — used to remotely access
servers — first came to the public’s attention last week when a group of
network security enthusiasts called TESO Security posted advisories to
several security mailing lists.


On Tuesday, the Computer Emergency Response Team (CERT) issued an advisory that servers running the Berkeley Software Design (BSD)
operating system were vulnerable to the flaw. But less attention has been
paid to a possible legal battle brewing behind the scenes between TESO and a
prominent security mailing list owned by security firm SecurityFocus.com.

On Tuesday, a member of the Bugtraq mailing list, which boasts upwards of
50,000 subscribers, posted an exploit — developed by TESO — which takes
advantage of the vulnerability, despite the fact that the exploit’s header
forbade distribution of the exploit, and gave mailing lists and Bugtraq in
particular as examples.


“We did not give out the exploit to anyone and have not done so since it was
written,” said Sebastian, a member of TESO and the discoverer of the
vulnerability. Sebastian chose to remain “pseudonymous.”

“We were aware that if the exploit is publicly posted on Bugtraq or another
public Web site it would mean great damage, so we put a warning message that
legally forbids doing so in the top of the exploit source code, so that if
it ever falls into the wrong hands at least there is some extra
‘protection.'”

Sebastian said TESO is still considering whether to pursue legal action, but
has not yet retained an attorney.

Bugtraq’s point of view


The Bugtraq mailing list is administrated by Elias Levy, who is responsible
for approving or disapproving all messages sent to the list.

“The approval of TESO’s exploit was an error as we have stated on the list,”
Levy told InternetNews.com. “This does not appear to have been sufficient
for TESO. We do have to wonder, how did their exploit end up being used by
criminals to break into machines, and [we] find it ironic that while their
exploit is being openly traded in the underground they did not wish to
provide the public with access to the same so that at the very least they
could examine it and use it to test their own systems.”

Indeed, TESO’s exploit has been in the wild for a while, and has been used
by unskilled crackers (malicious hackers) dubbed ‘script kiddies,’ to deface
a number of Web sites.

Sebastian told InternetNews.com that after discovering the flaw about one
and a half months ago, TESO researched the exploit which was later stolen
from its network.

Sebastian explained, “We do not know how this happened as of yet. Anyway, we
were notified by an anonymous person that the exploit has been used to break
into his server machine and the attacker left the exploit header (the
copyright and one-line description) as a proof on his server.

“We instantly knew that this was no good news and would probably mean a lot
of illegal activity using our exploit. So we decided to release an advisory
to the public as soon as possible, although we have not yet researched all
vulnerable platforms and have not compiled full details on the vulnerable
systems.”

Sebastian added, “The exploit has been stolen before, and was indeed
‘traded’ among relatively unskilled system crackers. We also have received
mails of persons who apparently had the exploit before it was sent to
Bugtraq. “Nevertheless, the distribution through Bugtraq added massively to
the problem from our point of view.”


While acknowledging that he had been in error in publishing the exploit,
Levy said, “We do not encourage people that find vulnerabilities to release
exploits, although we understand that some people may think it’s necessary.
We encourage people that wish to release some type of demonstration tool to
create it in such a way that it only allows for the testing, not the
exploitation, of the vulnerability. That being said, if there is an exploit
in the wild we will publish it so as to allow the public to be aware of its
existence, study it, and use it for their own testing.”

Get the Free Newsletter!

Subscribe to our newsletter.

Subscribe to Daily Tech Insider for top news, trends & analysis

News Around the Web