lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20070216032335.16638.qmail@securityfocus.com>
Date: 16 Feb 2007 03:23:35 -0000
From: thefinn12345@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: Re: Solaris telnet vulnberability - how many on your network?

I believe in the early 90's there was a serious problem discovered in intel chips that allowed certain standard code to be run to overflow programs arbitrarily and gain access to operating systems in an administrative capacity.

Also I remember the redhat (back in the day) repository being hacked and backdoored versions of programs being put into it. I believe this also happened to an early version of debian or fedora at some point also.

But I think you miss the point.

When they aren't preparing for security problems, the job of most security professionals is to observe and react to these kinds of security problems.

The observer will exploit anything you are lax on. Discarding a security concern because it doesn't seem important or of value to you is kinda stupid, you should probably go find some other kind of work. Everything is important, everything should be examined when and if possible. Thus the thread certainly has merit.

It really makes me giddy when I see posts by trolls saying that security through obscurity isn't really important, or that examining a possible act of malice WITHIN one of the companies that is giving you software is not really an important factor.

Even if it isn't an act of malice BY THEM, perhaps they have been hacked at the very top levels of their software storage or their source code itself. Perhaps something has gone wrong (what? no, couldn't be?).

Dismissing it is as stupid as dismissing the possibility that running some unnamed, unknown executable on your windows box isn't a problem.

Scarey stuff. The job is to be paranoid. Not to be dismissive of those who ARE.

TheFinn.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ