full-disclosure - Re: SMS Banking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Feb 2010 14:41:03 +1100
From: "Craig S. Wright" <craig.wright@...ormation-Defense.com>
To: <Valdis.Kletnieks@...edu>,
	"'Thor \(Hammer of God\)'" <Thor@...merofgod.com>
Cc: 'full-disclosure' <full-disclosure@...ts.grok.org.uk>,
	pen-test@...urityfocus.com, security-basics@...urityfocus.com
Subject: Re: SMS Banking

I have a simple answer to this. Forget the debate, rhetoric is not a
scientific method of determining truth.

"Thor" wants a challenge, let's have one - a real one and not one based on
verbalisations, abuse and unfounded assertions.

I suggest two components;
1	A selection of software products are tested using both processes,
that is I use a model for the risk of these products, and "Thor" can make up
whatever guesses he wishes. We model (or "Thor" guesses, pulls from a
hat...) the vulnerabilities over a time period. The number of bugs in
software as well as the risk are to be presented as a monthly estimate. 

2	We model a few systems (say 50). We can use Honeypots (real systems
set to log all activity without interference) run by an independent party to
each of us. I use probabilistic models to calculate the risk. "Thor" does
whatever he wants.

Each of the predictions is published by all parties. The one who is most
accurate wins. Fairly simple?

I will even give a handicap to "Thor", I will offer to predict within a 95%
confidence interval and that for me to win, at least 90 of the 100 software
products and 45 of the 50 systems have to lie within my predicted range that
I calculate and release. "Thor" has to simply guess better than I do no
matter how far out he is.

I will put up $10,000 Au for my side. Let's see if "Thor" has something real
to offer.

Regards,
...
Dr. Craig S Wright <http://gse-compliance.blogspot.com/>  GSE-Malware,
GSE-Compliance, LLM, & ...
Information Defense <http://www.information-defense.com/>  Pty Ltd

_____________________________________________
From: Valdis.Kletnieks@...edu [mailto:Valdis.Kletnieks@...edu] 
Sent: Wednesday, 10 February 2010 7:03 AM
To: Thor (Hammer of God)
Cc: pen-test@...urityfocus.com; full-disclosure;
craig.wright@...ormation-Defense.com
Subject: Re: [Full-disclosure] SMS Banking

* PGP Signed by an unknown key

On Tue, 09 Feb 2010 17:39:39 GMT, "Thor (Hammer of God)" said:
> how about accepting a challenge to an open debate on the subject at
Defcon?

"Alright folks just make yourself at home, Have a snow cone and enjoy the
show"
				-- Webb Wilder

* Unknown Key
* 0xB4D3D7B0

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/