full-disclosure - CounterAttack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: CounterAttack

> -----Original Message-----
> From: Jeff Bankston [mailto:suse@...l.bciassociates.com] 
> Sent: Friday, August 01, 2003 8:04 AM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] CounterAttack
> 
> Phil, I have to echo the other comments, because sometimes 
> your return fire invites an escalation before you know all of 
> the facts. We spend alot of time in the forensics of an 
> attack to understand if first it is _us_ letting the 
> vunerability in where we coulde have simply made our systems, 
> firewalls, and perimeter routers more secure in the first place.
> 
There's another aspect as well.  Often if you attack a computer that's
attacking you, you will be attacking an innocent victim that has been
hacked themselves.  (And no, I don't want to get in to the argument of
whether or not they're really innocent, they should have patched, yada,
yada, yada).  In that case, your response accomplishes nothing
meaningful.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/