full-disclosure - Re: pnp worm unknown variant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050817181040.GA10101@foofus.net>
Date: Wed Aug 17 19:10:24 2005
From: foofus at foofus.net (foofus@...fus.net)
Subject: Re: pnp worm unknown variant - post
	infectionactions

On Wed, Aug 17, 2005 at 08:16:04AM -0500, Madison, Marc wrote:
> Now,  I agree that computer forensic work is currently unregulated and
> misrepresented, but according to Mr. Christy, in the near future U.S.
> Federal courts will not accept forensic work unless it was done in a
> federally certified lab.  

Certainly dc3.gov may harbor hopes along these lines (it would, for 
example, be a nice thing for DCITP, presumably), but this seems like
an overstatement, to me.  It could be taken to mean, for example, that
sysadmins could no longer testify about their own log files or IDS
traces.  Plus, it's not clear what "federally certified" means, at this 
point.

I can't imagine that federal courts would actually refuse to consider 
evidence unless it was discovered by federally authorized evidence-
finders.

> I see this as a move in the right direction
> for the forensics industry, though I'm many so called experts will not.

If a non-certified person presents a reasonable conclusion about a 
matter of computer forensics, what sense would it make to reject it
out of hand?

--Foofus.