full-disclosure - Name One Web Site Compromised by Download.Ject?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: se_cur_ity at hotmail.com (Morning Wood)
Subject: Name One Web Site Compromised by Download.Ject?

> Legal liability question:  Has anyone contacted an attorney yet about
> damage done by either of these two possibly negligent actions

are you serious? this "hunt" is laughable. Why is this any different than 
anything else?
This is not the first time sites have been hacked to include exploits on the 
mainpage that
leveraged Internet Explorer atacks. ( hint: persistant XSS ).
The problem is UNPATCHED BROWSERS period.
They could have just as well compromised HP 4550 printers and embeded a 
malicious
 script that contained the same IE bug.
 ( see 
http://www.securityfocus.com/archive/1/330310/2003-07-18/2003-07-24/0 )

The THOUSANDS of defacements that occur everyday could also do the same..
 ( see http://zone-h.org/en/defacements ) .

IIS servers just happened to be the target of choice.
It could have been phpNuke portals, Apachee etc.
The media its trying to make this into some sofisticated criminal attack, 
which it isnt.
HYPE HYPE HYPE

This is pure bullsh*t...  hunt / seek / litigate / sue / processecute.
FACT: It is the websites fault they got hacked via UNPATCHED SERVERS,
 and the end users that have UNPATCHED BROWSERS.
Why is everone wanting to pass the buck and not take responsibility for 
maintaining current
patch levels? The USA is so f*cking co-dependant and blaming ( look at any 
daytime talk show )
this has gotten INSANE.

Be responsible for your own actions.
If you go into the water... you should know how to swim.
If you go into the net... you should know how to patch

As a side note, I would like to know if using a exploit on a non passworded 
site ( access restriction )
to obtain / change data is in fact illegal ( in the USA ) , as I recall it 
is a violation to bypass
an ACCESS CONTROL DEVCE. If no access control is present is there a 
violation of a law?

my 2bits

m.wood