full-disclosure - Undisclosed breach at major US facility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Jul  4 15:17:48 2006
From: eaton.lists at gmail.com (Brian Eaton)
Subject: Undisclosed breach at major US facility

On 7/3/06, r r <anothersecurityquestion@...il.com> wrote:
> Any useable thoughts?

If you disclose this to anyone, don't expect to remain anonymous for
very long.  This hypothetical server probably has hypothetical logs
with your hypothetical IP address.  Your hypothetical ISP will almost
certainly be willing to help the authorities get in contact with you.

Even if you don't disclose this, you still might get contacted once
the owners of the server clue in to the problem.

I suspect contacting the affected hospitals might be a good start
towards getting this taken care of.  The hospitals have more clout
with the software vendor than you do.  If you're scared of going to
the hospital administrators, then the media might be a good option.

I hope you don't end up in court.

Regards,
Brian