full-disclosure - OT: An odd question that has arrisen within my household

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B2204C8E-FD6D-11D7-8CC6-000A95864792@joshie.com>
From: jlevitsk at joshie.com (Joshua Levitsky)
Subject: OT: An odd question that has arrisen within my household

I would add a tier before Tier I that would be hackers that do not 
believe in full disclosure, do not share exploits outside their close 
knit circle of friends, do not support "the man". A lot of these guys 
are better than "The best of the best", but nobody knows because they 
don't make themselves public. Maybe you could call it "T13r Z3r0" :) 
Seriously... there are people out there that have tons of free time to 
learn, and possibly monitor lists like this, and laugh at the silly 
people that disclose vulnerabilities and share information. They aren't 
necessarily out doing damage. They just don't play with strangers 
because they choose not to. Some of these people are damn cool. Some 
are just anti-social, but that really isn't the norm so far as I can 
tell. Of the people I've ever met they seem to have personalities, and 
usually have more going on than I do socially. If you met them you 
wouldn't think "hacker" or even know they are in to computers.

I dunno... just my observations here in New York City. Perhaps it's 
different elsewhere.

-Josh

On Oct 13, 2003, at 1:02 AM, Joel R. Helgeson wrote:

> Tier I
> - The best of the best
> - Ability to find new vulnerabilities
> - Ability to write exploit code and tools
>
> Tier II
> - IT savvy
> - Ability to program or script
> - Understand wht the vulnerability is and how it works
> - Intelligent enough to use the exploit code and tools with precision
>
> Tier III
> - "Script Kiddies"
> - Inexpert
> - Ability to download exploit code and tools
> - Very little understanding of the actual vulnerability (launching 
> Linux
> attacks against MS boxes)
> - Randomly fire off scripts until something works

--
Joshua Levitsky, CISSP, MCSE
System Engineer
AOL Time Warner
[5957 F27C 9C71 E9A7 274A  0447 C9B9 75A4 9B41 D4D1]