281–290 of 425 posts
Earlier quoted context omitted.
> create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.
Hunting for bugs to report would be a valid, wouldn't it?
Earlier quoted context omitted.
Well, now the market is saying that such a tool should be open sourced and well, now it is.
I wouldn't say the market is doing that, government funded tool being released as FOSS is opposite to "the market".
I just don't understand the doubt and hate. It's perfectly reasonable to distrust the NSA in most cases, but look at the context - the NSA has a huge brain drain and PR problem. They desperately need qualified people to start trusting and applying to them again. Does anyone seriously think they would try to backdoor security researchers in such a stupidly obvious way? I was actually at the RSA talk where they release…
Earlier quoted context omitted.
Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?
Because they have access to the source code itself. No need to reverse engineer anything.
The concrete difference between the two is that vulnerability research is mostly focused on the technical security aspects. Eg. is there a buffer overflow here yes or no? From an efficiency perspective it makes no sense to hide the source code or even credentials from the pentesters performing this research.
An attack simulation is more holistic in nature, the question becomes "can your security team detect when we exploit this buffer overflow?". The blue team and the red team do not share details, and to give the blue team a proper exercise they are often not even informed. To do a proper red team exercise the scope must be very broad. Both technical controls as well as procedural operations are in scope. If you call application/network security research a red team exercise I think you're doing it wrong.
So a red team, in the sense of the word that I specified, does not have access source code, and most definitively sometimes needs to reverse engineer binaries.
Earlier quoted context omitted.
4. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.
Good point... "we need a site license. No, I can't tell you for how many employees, that's classified. No, I can't tell you who we are, that's classified. No, I can't tell you what we are working on, that's classified. Hello? Hello? Darn they hung up again..."