full-disclosure - David Litchfield talks about the SQL Worm in the Washington Post

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: rms at computerbytesman.com (Richard M. Smith)
Subject: David Litchfield talks about the SQL Worm in the Washington Post

>From today's AP story:

FBI Skeptical on Internet Attack Source 
http://story.news.yahoo.com/news?tmpl=story&ncid=528&e=3&cid=528&u=/ap/2
0030129/ap_on_hi_te/internet_attack

Litchfield, who works for NGS Software Inc., said Wednesday that he now
appreciates the dangers in publicly disclosing such computer code. He
said he originally published those blueprints for computer
administrators to understand how hackers might use the program to attack
their systems. 

"One has to question whether the benefits are outweighed by the
disadvantages," Litchfield said in a telephone interview from his home
in London. "I'm certainly going to be more careful about the way in
which anything is disclosed." 

Richard

-----Original Message-----
From: Georgi Guninski [mailto:guninski@...inski.com] 
Sent: Wednesday, January 29, 2003 12:18 PM
To: Richard M. Smith; full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] David Litchfield talks about the SQL Worm
in the Washington Post

So what?
This sql hype highly resembles the code red stuff. Then people accused
eeye for 
releasing the bug, though they didn't provide exploit code. IIRC
Litchfield also 
didn't provide exploit code. Should advisories be "There is a bug. Go
patch. End."?

Is there any real evidence that releasing PoC helps high scale incidents
like 
this one? - Don't think so.

Sure writing worms and virii is bad, but this sql worm has a positive
side 
effect imho.
The real damage done was very limitied (high traffic in m$ network
according to 
the reg, some atms stopped working for strange reason, korean spammers
off the 
net) compared to the potential long lasting damage from stealing info
from these 
DBs.
There wasn't such fuzz about the apache worm, though imho apache has
much more 
market share than m$ sql.

Georgi Guninski
http://www.guninski.com

Richard M. Smith wrote:
> Hi,
> 
> The following quote from David Litchfield appeared in a front-page
> article in today's Washington Post:
> 
>    http://www.washingtonpost.com/wp-dyn/articles/A57550-2003Jan28.html
> 
>    "You have this ideal vision of doing something 
>    for the greater good," said David Litchfield, 
>    managing director of Next Generation Security 
>    Software Ltd. of London, who acknowledged that 
>    a small bit of his code might have been used in 
>    the attack. "I will probably no longer publish such code." 
> 
> Perhaps David can put together a longer message for Bugtraq and
> Full-Disclosure on his changing views of publishing proof-of-concept
> code for security vulnerabilities.
> 
> Richard M. Smith
> http://www.ComputerBytesMan.com
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
>