full-disclosure - KSpynix ::: the Unix version of KSpyware? (Proof Of Concept)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42826D39.1020102@sdf.lonestar.org>
Date: Wed May 11 21:38:32 2005
From: bkfsec at sdf.lonestar.org (bkfsec)
Subject: KSpynix ::: the Unix version of KSpyware? (Proof
	Of Concept)

khaalel wrote:

>Hi,
>
>before sending me such emails, read Kspynix before: Firefox is not
>attacked by the POC,
>and such malware already exists for Unix systems although their code
>are not public... that's why I code this "small" malwares (if they can
>be called malware...)
>  
>
I'm quite well aware that such malware exists on Unix/Linux systems.  
Nor was I saying that firefox was attacked by your spyware.

But then, that's even less of a reason to publish it, seeing as there 
really is nothing new here.

>About the ethic, it's your problem if you think it's not ethical to
>publish such code, Besides don't be afraid Unix systems are always
>secure.
>  
>
Sure...  whatever you say...

No fear here, buddy.  But, seeing as this is an open list, I'm free to 
question the ethical nature of your release.  I think that if you'll 
take the time to look through the archive, you'll see that I'm a staunch 
advocate of full disclosure, but if there's no real gain from publishing 
code that can assist in harming others, chances are pretty damn good 
that it's unethical to publish that code.

>And i "waste" my time with what I want !!!
>  
>
No argument there.

>What's an ethical act for you? I wanted to publish a (snip malware type)
>this week, is it ethical?
>
>
>  
>
That depends.  What's the purpose of publishing the code?  Is there any 
new or interesting technique used that hasn't been charted before?  If 
so, then I'd say it might be ethical. 

If it's just "because you could"... then I'd say that it would most 
likely be unethical to publish that code.  Not to mention illegal in 
certain countries (I'm not advocating that it should be illegal, it just 
could be considered illegal..)

             -Barry