9 ms·

And now the bad guys know there is a very serious vulnerability, somewhere.

pavel_lishin 13y ago
They'd know it was there as soon as a patch was released, anyway.
dan_manges 13y ago
Knowing that there is a vulnerability might motivate them to look for it, but given the size of the software, I doubt they'll be able to find it without knowing more.
- jfim 13y ago
  You'd be surprised; on Windows, at least, there are people who reverse engineer the security patches from Microsoft in order to determine the initial vulnerability[1]. [1] http://www.phreedom.org/presentations/reverse-engineering-and-security/reverse-engineering-and-security.pdf http://www.phreedom.org/presentations/reverse-engineering-an... Edit: Misinterpreted your post. You're right, it's unlikely that they'll guess where it is until a patch comes out.
  - rosser 13y ago
    Because there are enough people running Windows who haven't applied the patch that figuring out how to exploit it is a worthwhile undertaking. Then again, IME of many years as a PostgreSQL DBA, the vast, overwhelming majority of postgres shops aren't running anywhere near the latest release, so depending on how far back this vulnerability goes, there could be a very large number of exploitable targets...
- mixedbit 13y ago
  The knowledge may also motivate them to prepare for attacks to be executed once the vulnerability is public but most instances do not have it patched. Scan the Internet for PG backed applications, identify high profile ones, prepare automatic scripts, etc.
  - zalew 13y ago
    > Scan the Internet for PG backed applications, identify high profile ones, prepare automatic scripts, etc. it rather works like: - take exploit - spread it over the whole internet and calls home where it sticks
sophacles 13y ago
The bad guys already assumed that. Seriously - the entire premise of IT security (no matter the color of your hat) is the assumption that there is no such thing as a secure computer.

They'd know it was there as soon as a patch was released, anyway.

Knowing that there is a vulnerability might motivate them to look for it, but given the size of the software, I doubt they'll be able to find it without knowing more.

jfim 13y ago
You'd be surprised; on Windows, at least, there are people who reverse engineer the security patches from Microsoft in order to determine the initial vulnerability[1]. [1] http://www.phreedom.org/presentations/reverse-engineering-and-security/reverse-engineering-and-security.pdf http://www.phreedom.org/presentations/reverse-engineering-an... Edit: Misinterpreted your post. You're right, it's unlikely that they'll guess where it is until a patch comes out.
- rosser 13y ago
  Because there are enough people running Windows who haven't applied the patch that figuring out how to exploit it is a worthwhile undertaking. Then again, IME of many years as a PostgreSQL DBA, the vast, overwhelming majority of postgres shops aren't running anywhere near the latest release, so depending on how far back this vulnerability goes, there could be a very large number of exploitable targets...
mixedbit 13y ago
The knowledge may also motivate them to prepare for attacks to be executed once the vulnerability is public but most instances do not have it patched. Scan the Internet for PG backed applications, identify high profile ones, prepare automatic scripts, etc.
- zalew 13y ago
  > Scan the Internet for PG backed applications, identify high profile ones, prepare automatic scripts, etc. it rather works like: - take exploit - spread it over the whole internet and calls home where it sticks

sophacles 13y ago

The bad guys already assumed that. Seriously - the entire premise of IT security (no matter the color of your hat) is the assumption that there is no such thing as a secure computer.