Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1105699" data-attributes="member: 114717">If a person (or AI) can write code, and that code bypasses protections, then it is a valid test of both the code and the protection failure. It is what we call a &quot;Proof of Failure (POF).&quot; We never use the words &quot;Proof of Concept (POC)&quot; to describe such tests.If a white or grey hat coder can write code that bypasses a security solution, then so can the mad black hatter.The point is this: there is no such thing as &quot;real world.&quot; If it can be done in a test, then it can be done in the &quot;real world.&quot;Why do bug and vuln bounty programs pay so much money for &quot;Proof of Concepts (POCs)&quot;? Because the common sense, obvious fact is that if it can be done in the &quot;lab&quot; or at a BlackHat pwn event, then it can be done by threat actors.It is dangerous territory to say &quot;This will never happen in the real world.&quot; Because it just ain&#039;t true. It might have a very low probability of happening, but making decisions based upon low probabilities is a risk decision. Not everything can be protected. Not every security solution can protect everything. At some point the consumer - if they have the capacity - has to decide &quot;I am going to worry about this.&quot; or &quot;I am not going to worry about this.&quot;That is why there are places such as MalwareTips and people like you. To educate those who pay a high &quot;Ignorance Tax.&quot;Nobody ever says that &quot;This test and video are valid only for the specific sample(s) used, for these specific versions of these security software. Do not read into what is demonstrated. Do not generalize the results.People with a high &quot;Ignorance Tax&quot; are the reason that social media has been a raging success. They make cybersecurity news click-bait a very profitable online endeavor.</blockquote>

[QUOTE="bazang, post: 1105699, member: 114717"] If a person (or AI) can write code, and that code bypasses protections, then it is a valid test of both the code and the protection failure. It is what we call a "Proof of Failure (POF)." We never use the words "Proof of Concept (POC)" to describe such tests. If a white or grey hat coder can write code that bypasses a security solution, then so can the mad black hatter. The point is this: there is no such thing as "real world." If it can be done in a test, then it can be done in the "real world." Why do bug and vuln bounty programs pay so much money for "Proof of Concepts (POCs)"? Because the common sense, obvious fact is that if it can be done in the "lab" or at a BlackHat pwn event, then it can be done by threat actors. It is dangerous territory to say "This will never happen in the real world." Because it just ain't true. It might have a very low probability of happening, but making decisions based upon low probabilities is a risk decision. Not everything can be protected. Not every security solution can protect everything. At some point the consumer - if they have the capacity - has to decide "I am going to worry about this." or "I am not going to worry about this." That is why there are places such as MalwareTips and people like you. To educate those who pay a high "Ignorance Tax." Nobody ever says that "This test and video are valid only for the specific sample(s) used, for these specific versions of these security software. Do not read into what is demonstrated. Do not generalize the results. People with a high "Ignorance Tax" are the reason that social media has been a raging success. They make cybersecurity news click-bait a very profitable online endeavor. [/QUOTE]

Verification