This movement has a goal to take down every public forum, group, or website that helps in promoting exploits and tools or have show-off sections.
Movement Philosophy :
The purpose of this movement is to encourage a new policy of anti-disclosure
among the computer and network security communities. The goal is not to
ultimately discourage the publication of all security-related news and
developments, but rather, to stop the disclosure of all unknown or
non-public exploits and vulnerabilities. In essence, this would put a stop
to the publication of all private materials that could allow script kiddies
from compromising systems via unknown methods.
The open-source movement has been an invaluable tool in the computer world,
and we are all indebted to it. Open-source is a wonderful concept which
should and will exist forever, as educational, scientific, and end-user
software should be free and available to everybody.
Exploits, on the other hand, do not fall into this broad category. Just like
munitions, which span from cryptographic algorithms to hand guns to
missiles, and may not be spread without the control of export restrictions,
exploits should not be released to a mass public of millions of Internet
users. A digital holocaust occurs each time an exploit appears on Bugtraq,
and kids across the world download it and target unprepared system
administrators. Quite frankly, the integrity of systems world wide will be
ensured to a much greater extent when exploits are kept private, and not
published.
A common misconception is that if groups or individuals keep exploits and
security secrets to themselves, they will become the dominators of the
"illegal scene", as countless insecure systems will be solely at their
mercy. This is far from the truth. Forums for information trade, such as
Bugtraq, Packetstorm, www.hack.co.za, and vuln-dev have done much more to
harm the underground and net than they have done to help them.
What casual browsers of these sites and mailing lists fail to realize is
that some of the more prominent groups do not publish their findings
immediately, but only as a last resort in the case that their code is leaked
or has become obsolete. This is why production dates in header files often
precede release dates by a matter of months or even years.
Another false conclusion by the same manner is that if these groups haven't
released anything in a matter of months, it must be because they haven't
found anything new. The regular reader must be made aware of these things.
We are not trying to discourage exploit development or source auditing. We
are merely trying to stop the results of these efforts from seeing the
light. Please join us if you would like to see a stop to the
commercialization, media, and general abuse of infosec.
Thank you.
What do you think ?
