full-disclosure - JAP back doored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: fw at deneb.enyo.de (Florian Weimer)
Subject: JAP back doored

"Drew Copley" <dcopley@...e.com> writes:

>> Why is the U.S. government interfering with the publication 
>> of security advisories if the corresponding software is being 
>> run throughout the world?
>
> I haven't had any problem issuing security advisories. What is this in
> reference to?

The Windows kernel bug that was exploitable through WebDAV.

> Pointing the finger elsewhere does not excuse the fact that the German
> State has trojanized a popular application which was open to the world
> to download. And, indeed, the world did download.

If they just downloaded the software, nothing changed for them.

>  - I do not even care if they hack into criminals systems in other
> countries if they have some jurisdiction in this and are working with
> other authorities.

Why are you so sure that this isn't a multinational investigation?

> A German cop has no jurisdiction over me. He has no jurisdiction over
> anyone outside of Germany.

But if you access server in Germany, your use of this service is
subject to German law.  Like it or not, it's the way things are on the
Internet.