full-disclosure - Responsibility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <739e7bb20605211652v581907a6h6d3c70c9da08c3b0@mail.gmail.com>
Date: Mon May 22 01:01:11 2006
From: 300baud at gmail.com (Line Noise)
Subject: Responsibility

On 5/21/06, Greg <full-disclosure3@...andyman.com.au> wrote:
> Large motel/hotel chain I recently acquired wants to sue previous company
> who did their I.T. work for them as a customer's wifi connected machine
> infected their network and caused loss of booking data thus money.

Good thing I see you are in Australia, or I'd have believed you to be
yet another wannabe. That said... How on earth did someone screw up so
badly as to not be separating the hotel network and data from anything
a guest could connect to? I can't believe someone designed such a
thing, and I really can't believe that customers could connect to a
network that is used for the hotel business.

> My question then is - if you have done the utmost to lock down your customer
> but someone connects an infected machine and somehow it gets in, is the
> customer right in suing you? Eg, like a car mechanic, you do the best but

Which customer are you talking here? If I, as a hotel guest, got
infected on the hotel network, I'd be pretty mad, and there might be a
lawsuit. If I, as a hotel owner, got infected due to the incompetence
and poor design of whoever set up the network in the first place,
there would be (at least) a civil suit, not to mention a serious
finger shaking.

> you cannot be 100% sure that something else that was never a problem will
> now cause a problem (such as a new exploit in our case that wasn't known
> generally until 24 hours ago). Should you be sued at that point?

What's a new exploit got to do with this? Why do I feel you are
leaving out details? Should *who* be sued; when you say "you" do you
mean yourself, or the IT person?

> Wondering whether to dump the guy at this point.

What guy?

-- 

NO CARRIER