oCERT – Responsing to Flaws in Open Source Software


So a new initiative – the Open Source Computer Emergency Response Team known as oCERT has been set up one of the main sponsors being Google (read more here – Contributing to Open Source Software Security).

The oCERT project is a public effort providing security handling support to Open Source projects affected by security incidents or vulnerabilities, just like national CERTs offer services for their respective countries.

The service aims to help both large infrastructures, like major distributions, and smaller projects that can’t afford a full-blown security team and/or security resources. This means aiding coordination between distributions and small project contacts. The goal is to reduce the impact of compromises on small projects with little or no infrastructure security, avoiding the ripple effect of badly communicated or handled compromises, which can currently result in distributions shipping code which has been tampered with.

It’s a pretty interesting project and I hope it takes off – it will be a good place to gather information for small and large open source projects alike and make things more secure for everyone involved.

Check it out here:

http://ocert.org/

Posted in: Exploits/Vulnerabilities, Hacking News

, , , ,


Latest Posts:


SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.


4 Responses to oCERT – Responsing to Flaws in Open Source Software

  1. matt May 13, 2008 at 4:51 pm #

    I am still not getting the full idea of this project. Will the teams at oCERT.org be responsible for patching and deploying fixes for security holes, or are they just a contact for the Open Source projects? It seems as though for the bigger projects, oCERT will just pass information about reports and vulnerabilities, but for the little guys, they will help with the fixing. Am I getting this right?

  2. Jinesh May 14, 2008 at 7:07 am #

    Wow, that a gr8 news for small open source projects. Actually it is a 1 more step taken by google to trouble micro$oft.

  3. Rob Holland May 16, 2008 at 7:49 am #

    Matt, yes, we’ll help those who need it develop fixes or improve their infrastructure security.

  4. Bogwitch May 19, 2008 at 12:08 pm #

    @Rob Holland,

    I assume you are associated in some way with oCERT. A great idea and I hope it gathers some momentum. I am interested as to how you are intending to get vulnerabilities reported to you.
    Are you only interested in 0-day?
    Is it worth listing this as a sourceforge project?

    There is more and more open source product out there so I expect that your site will expand very rapidly. It is a shame that you only have (at the time of writing) four reports in the past two months.

    Good luck to you!