full-disclosure - Security breach database

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200412171628.iBHGSU3R018966@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Security breach database 

On Tue, 14 Dec 2004 15:44:41 PST, n30 said:
> Guys,
> 
> Looking for few interesting security breach stories...
> 
> Any database / sites that capture these??

Well, there's a problem - where do you get the stories?

The black hats probably won't be sharing their version of the stories
(at least until the statute of limitations expires ;).

The white hats may be unable to share their version - or at least not
in a worldwide public forum.  As a result, they become things that get
told over a pitcher of Guinness and a "You never heard this from me"
disclaimer.  A story that was interesting when I heard it in "When I was
doing a pen test for <named the guilty large finacial institution>, we found
a <description of totally stupid self-inflicted vulnerability>" becomes a lot
less interesting when I tell it as "Somebody I know was doing a pen test and..."

And since people are going to ask :)  The guy was doing a pen test for one of
the larger banks in NYC, and right at the start he was being watched by the
VP-level guy who had hired him.  So my friend is doing commentary as he's
trying stuff, for the VP's benefit, and the *very first* thing comes out as
"Well, we like to check this one first because it was popular years and years
ago, but it *never* works anymore.  It's a good test of the logging and alert
system though, because somebody should notice that it got tried and.. umm..
HOLY <BLEEP> IT WORKED"...

See? Somehow it loses something that way.. ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041217/8632e98a/attachment.bin