full-disclosure - Re: Apparently eEye's blog got p0wnd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B784FE5FA30AAB4C8A09D803AA8185530180A86F@mse11be1.mse11.exchange.ms>
Date: Mon, 23 Apr 2007 14:08:09 -0400
From: "David Maynor" <dave@...atasec.com>
To: "Paul Schmehl" <pauls@...allas.edu>,
	"full-disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Apparently eEye's blog got p0wnd

You guys know Ross left eEye weeks ago...
http://blogs.zdnet.com/security/?p=148

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Paul
Schmehl
Sent: Monday, April 23, 2007 12:23 PM
To: full-disclosure
Subject: Re: [Full-disclosure] Apparently eEye's blog got p0wnd

--On Monday, April 23, 2007 05:00:49 -0400 Valdis.Kletnieks@...edu
wrote:

> On Sun, 22 Apr 2007 11:46:41 CDT, Paul Schmehl said:
>
>> --On April 22, 2007 10:45:17 AM +0200 poo <skodliv@...il.com> wrote:
>> > or maybe ross retard got his login info owned
>
>> Why take the whole site down then?  All you'd have to do is disable
his
>> account.
>
> Umm? Maybe for some real *basic* security reason?  For instance, doing
> forensics or making *sure* that Ross was the only pwnage, and that it
> wasn't anything more serious?
>
> So tell me Paul - if *your* password got pwned, would you take the
machine
> down, or not? :)

If *mine* got pwned, I'd take the machine down, but if an unprivileged
user 
got pwned, I'd simply have them change their password, *unless* there
was 
evidence of problems on that host.  Just because someone's account got 
hijacked doesn't mean that further damage necessarily happened.  Lots of

people have no access to anything except their own stuff.

Paul Schmehl (pauls@...allas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/