bugtraq - RE: Re[2]: Solaris telnet vulnberability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <096A04F511B7FD4995AE55F13824B8332125FB@banneretcs1.local.banneretcs.com>
Date: Wed, 14 Feb 2007 16:28:29 -0500
From: "Roger A. Grimes" <roger@...neretcs.com>
To: <bugtraq@...urityfocus.com>
Subject: RE: Re[2]: Solaris telnet vulnberability - how many on your network?

Spectulation over whether Microsoft, Sun, or any other vendor
intentionally put in backdoors just makes our industry seem
unprofessional. The likelihood that either vendor did is near zero.
Could be, but most likely not. Unless you find a hard coded password,
code comments indicating a built-in backdoor, or an insider speaking
out, you'll never prove it. It's much more likely just a human mistakes.
And contrary to what was said below, by someone I respect, code audits
and reviews are not even close to near perfect. If they were, Microsoft,
Mozilla, and all the other open source projects would never have another
buffer overflow.

Security people running around maliciously spectulating on vendor
motives, when there are absolute no facts known either way, is
unprofessional. Our profession has enough black eyes without this type
of wasteful dialog.  Get back watching your Anna Nicole news updates.

Roger A. Grimes

-----Original Message-----
From: Thierry Zoller [mailto:Thierry@...ler.lu] 
Sent: Tuesday, February 13, 2007 7:32 PM
To: bugtraq@...urityfocus.com
Subject: Re[2]: Solaris telnet vulnberability - how many on your
network?

Dear Casper Dik,

I wasn't crying wolf about a Backdoor, heck I am not Steve Gibson. I was
asking whether somebody will investigate why this hasn't been caught by
audits or simply Q&A ?

CDSC> And one which was too easy to discover;
You said it, it's "easy to discover", so who has discovered it? Sun ?
Considering it's that easy to catch, why hasn't SUN ? Maybe you can give
us a heads up on that ?

CDSC>  real back doors are better
I like that tautologie, "real backdoors", what makes a backdoor more
real than another one ? Is it the coolness, the stealth ? Or is it
simply the fact that it gives back door access ?

CDSC> masquared as buffer overflows you might not chance upon.
Nobody doesn't that anymore, everybody does code audits now and catches
bufferoverflows, right? I think other overflows are more interesting to
hide access.

--
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7