Hacker News Reader

Comment by x0x0 | Hacker News Reader

I think the fundamental misunderstanding is that once a patch is released, you've given hackers a roadmap to understanding the exploit. At this point, there are essentially professional dev teams waiting to build out exploits. From what I've read, lack of a full poc delays hackers by hours.

View on HN

While I certainly think it's true that the "real deal" would jump on any patches put out and reverse-engineer the exploit with relative ease, I expect the actual hack scene to have the same distribution of skill (if not more skewed) than the regular programming world. For every Carmack there are 10 me's, and for every professional exploit builder there is an army of script kidies. Look at how widespread Shellshock and Heartbleed exploits became after their disclosure, I don't think there are that many attackers capable of making such an attack themselves without a PoC.

True -- but skilled engineers aren't necessary. The exploit builders sell their wares. I read recently -- unfortunately I don't have the link handy -- that these exploit toolkits rent out for eg $5k/mo.

No PoC was released with the Heartbleed disclosure, but many were published within hours by others (including myself). And this was a good thing, without them admins would be unable to verify that their servers were patched successfully.

At a company where I worked previously one team only noticed one of their systems hadn't been correctly patched against Heartbleed because there was an exploit available that they could use to test.

Who knows what would have happened days/weeks/months later if that hadn't been the case.

Hours can be really useful, especially if they can be scheduled in advance.

Reply on news.ycombinator.com