full-disclosure - Is Marty Lying?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <09FE1353-ED15-11D7-97E8-0003938BF2E4@sourcefire.com>
From: roesch at sourcefire.com (Martin Roesch)
Subject: Is Marty Lying?

I'm not going to engage in tit-for-tat on this stuff, so let me get 
right to it.

> stupid to think independantly to arrive to a conclusion to what most
> likely did happen with the Snort.org compromise.

Snort.org wasn't compromised, a shell server was.

> Some good questions are:
> 1) If the intrusion were limited to a single "shellbox" then why did 
> they
> need to audit the code in CVS to see if it was backdoored?

The audits were performed after the rpc buffer overflow in Snort this 
past spring, no audit was performed as a result of the compromise 
because it didn't effect anything.  I don't see why this is a tough 
problem for you, grep the code for whatever you're interested in or 
something, it's open source.  In fact, I invite everyone to go through 
the code and check it themselves, it's all up there on snort.org all 
the way back to the initial release back in 1998.

     -Marty

-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Snort-based Enterprise Intrusion Detection Infrastructure
roesch@...rcefire.com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org