full-disclosure - Hacker suspect says his PC was hijacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: dufresne at winternet.com (Ron DuFresne)
Subject: Hacker suspect says his PC was hijacked

	[SNIP]

> Well... Tell me where honeypotting goes if that happens?
>
>

	[SNIP]

> >
> > Will "Knowingly allowing a computer under your control
> > to remain in an exploitable state" become a crime?
> > (if it isn't already...)
> >
> > I am in two minds on whether it should or should not
> > :(
> >
> >

	[SNIP]

> > >
> > > http://www.cnn.com/2003/TECH/internet/10/10/hijacked.hacker.re
> > > ut/index.html
> > >
> > > "Caffrey is accused of triggering the paralyzing data blast
> > > on a vital
> > > computer server used to coordinate ship movements in the
> > > Houston port --
> > > the sixth biggest shipping port in the world"
> > >
> > > Ok, so somebody explain to me why in the world this "vital computer
> > > server" is on a public network?
> > >
> > > "He said his machine may have been taken over by another
> > > individual or
> > > group who then set the digital onslaught in motion. 'My computer was
> > > completely and utterly vulnerable to many exploits'"
> > >
> > > If anybody needed more ammo to convince people that patching is
> > > important this might be a good one to add to the stack, whether he is
> > > lying or not I sure wouldn't want to try and defend that position...
> >

Hoenypots are a differnet matter then a system attached to the internet
and the admin *knowingly* leaving it exposed and vulnerable for others to
abuse.  Hopefully the honeytoys admin knows how to keep that system under
control.  Course, such toys as well as IDS systems are best left to the
hands/work of  experienced persons.

The question is though, how does one prove that another *intentionally*
left a system on the  network in an abusable state?

A side question, and think carefully, should ISP's be demanding their
clients have specifics in place prior to connecting them up to the
internet, those minimals being:  anti-viri and perhaps personal networking
filters, and/or up-to-date- patches.  The real problem hee entails that
the ISP then has to audit clients to make sure they remain in compliance.

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.