bugtraq - the heart of the problem [was: RE: mac trojan in-the-wild]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.62.0711012123450.1164@linuxbox.org>
Date: Thu, 1 Nov 2007 21:35:59 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: "Roger A. Grimes" <roger@...neretcs.com>,
	bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	Alex Eckelberry <AlexE@...belt-software.com>,
	botnets@...testar.linuxbox.org, funsec@...uxbox.org
Subject: the heart of the problem [was: RE: mac trojan in-the-wild]

On Thu, 1 Nov 2007, Thor (Hammer of God) wrote:
> But more importantly, let's look at things from the other side.  Let's
> say I'm wrong, and that Gadi is right on target with his "hit hard"

I'd say we are both right.
You look at it from a security researcher stand-point. There is nothing 
interesting about user-interaction, and it is even kind of lame.

>From a reasonable perspective, we refuse to believe people will act so .. 
silly.

> prediction and that we should be very concerned with this.  Given the

Not predicting, assessing.

Criminal elements have a very clear cost/benefit calculation. For example, 
they won't release a 0day such as WMF or ANI as long as their revenue 
goals are met with published ones. They collect statistics on OS, browser, 
language, which exploit got how many, etc.

They have thousands on thousands of sites infecting users who surf (some 
of them ad-based on real sites, or defaced sites such as forums that 
remain with the same content only now infect people). Then there is also 
spam directing people to these sites.

Now, a criminal gang (could be the mob could be one guy) targets the mac. 
So much so that they serve different malware by OS-type.

As a security researcher looking at code, bits and bytes, you are simply 
not usually following what's going on in operational security where things 
are bleak.

>From an operational security standpoint, this equates to what happened in 
the world of the Internet back when Windows 98 was around. Not what 
security features it had.

> requirements here, that again being flagrant ignorance where all the
> above steps are executed (including the explicit admin part)-- what
> exactly are we supposed to do?  If people are willing and able to go
> through the motions above what can we as security people do to prevent
> it?  Far too many people in this industry are far too quick to point out
> how desperate the situation is at all turns, but I don't see many people
> offering real solutions.  But you know, I have to say...  If we are

Things are in fact FUBAR. We need new ideas and new solutions as honestly, 
although we want to feel we make a difference by taking care of this or 
that malware or this and that C&C we are powerless and have not made a 
real difference in the past 6 years while things got worse.

We need new solutions and new ideas, and would be more than happy to have 
new people exploring operational security.

The current state of Internet security is you get slapped -- BAM! -- and 
you write an analysis about it. (when speaking at ISOI I actually slapped 
myself -- HARD -- when I said it on stage, not a good idea for future 
reference).

> really going to consider this "serious," and we are really going to
> define part of our jobs as being responsible for stopping people who
> have absolutely no concerns for what they do and are willing to enter
> their admin credentials into any box that asks for it, then I'd say that
> there is a *serious* misunderstanding about what security is, and what
> can be done about it-- either that, or I'm just in the wrong business.
>
> t

Well, we can't choose the risks. They choose us. Sometimes they are cool, 
sometimes they're not.

I often start emails by saying "first off, this is not the end of the 
world, the Sun will rise tomorrow and the Internet won't die today". I 
tire of it. Of course the Internet won't die today, but it is Mac season.

Apple is very much correct by not investing in security first until now -- 
from a BUSINESS standpoint, however much we as security people in our 
niche can't get behind it. Things are different now and unfortunately they 
have a backlog to deal with.

 	Gadi.