Thread by @HackingDave

I wanted to clarify some complex topics regarding the Exchange / ProxyLogon discussions that happened since the dust has settled.

1. I'm concerned generally about the negativity against security researchers releasing code as I view this as taking steps back not forward.

1/10

2. I think researchers should be mindful of when a PoC drops. In the ProxyLogon event, I was against dropping early to give companies time to patch. In stating that, there should be no hindrance as to when a researcher publishes code, especially after a patch is released.

2/10

3. My biggest fear is we are moving back to where red is secretive in TTPs which does not help the industry progress forward. This occurred several years ago in this industry, and there were several years of organizations not understanding how to defend themselves.

3/10

4. We've made a lot of strides, both due to blue and red working together collaboratively. To me, this is likely the only path to continued success and always having the betterment of organizations and security in mind first.

4/10

5. I think everyone has their own perspectives/views on this, and it's a very complex topic. Do you release a PoC after a patch has been released knowing that there are organizations that may never patch or are extremely slow.

5/10

6. The PoC which was first released was intentionally broken and required a significant understanding in order to make it work. This allowed researchers all around the world and defenders to piece together the entire attack chain and help better serve organizations impacted. 6/10

7. I saw this first hand at #TrustedSec where the red team and IR teams worked as one unit as information wasn't readily available out there since it was so new. That collaboration is key during situations like this.

7/10

There's a balance between responsibly releasing PoCs, OSTs, and others that we should always be mindful of.

As offensive testers, trying to simulate threat models of real-world adversaries, it's paramount that we model the same types of attacks in order to best defend.

8/10

As defenders, we need to understand real-world attacks against our organization or have prior breach data.

As offense, we need to have the tooling and capabilities to simulate/emulate. We can still do that responsibly and wait a bit, giving time for orgs to address.

9/10

My parting thoughts here is that we shouldn't be negatively going after researchers for their work and effort. It's needed, and it's something that will continue to make us better as an industry. Like other roles, we all make up an ecosystem built on making things better.

10/10