full-disclosure - Name One Web Site Compromised by Download.Ject?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9D25EC9CEF02EE449A4D64BFFA413AC8015BD8E0@iu-mssg-mbx05.exchange.iu.edu>
From: edge at indiana.edu (Edge, Ronald D)
Subject: Name One Web Site Compromised by Download.Ject?

>From the latest issue of:
************************************************************************
*
SANS NewsBites                June 30, 2004               Vol. 6, Num.
26
************************************************************************
*
Legal liability question:  Has anyone contacted an attorney yet about
damage done by either of these two possibly negligent actions: (1) the
Wittie worm when the security software vendor may have allowed many
customers to have their systems disabled because selected users may not
have gotten the patch for weeks after it was ready, or (2) Download.Ject
damage done to consumers - through loss of identity data and banking
passwords -- by infected web sites that apparently did not tell their
clients that the site was infected?  If you have gotten legal advice
about these, please let us know by emailing info@...s.org with subject
"legal liability."
================================

So here was my email to SANS:

What I want to know is where the heck are the publicized identies of the
supposedly many major web sites that were infecting their
customers/visitors??

I have rarely seen such an obvious massive hush job and coverup. I have
searched the news articles on Download.Ject and to date I have not found
a SINGLE EXPOSED IDENTITY of a web site.

I have pointed this out to a well known IT journalist I correspond with
by email regularly, and he replied that he thinks it is definitely a
story worth pursuing. 

I frankly am appalled that not a single site has been named, at least
not to my knowlege, and I have TRIED to find one named in the news
online.

Ron.

Ronald D. Edge
Director of Information Systems
Indiana University Intercollegiate Athletics
edge@...iana.edu  (812)855-9010
http://iuhoosiers.com

Corporate IT's reaction to spyware has been surprising: it's been
largely swept under the rug. The problem is that you can't hide an
elephant by sweeping it under the rug. It leaves quite a bulge.