Date: Mon, 21 Jan 2008 11:29:13 -0600
From: "Nate McFeters" <nate.mcfeters@...il.com>
To: "Jerry dePriest" <jerryde@...net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [Professional IT Security Providers -Exposed]
	PlanNetGroup ( F )

Was that aimed at me or secreview?  I do NOT have MLK off, which is a
travesty in and of itself, but I also feel it is important to challenge
secreview on this matter.

On 1/21/08, Jerry dePriest <jerryde@...net> wrote:
>
> nice to see some have mlk off and nothing better to do
> ----- Original Message -----
> From: "SecReview" <secreview@...hmail.com>
> To: <nate.mcfeters@...il.com>
> Cc: <full-disclosure@...ts.grok.org.uk>
> Sent: Monday, January 21, 2008 10:40 AM
> Subject: Re: [Full-disclosure] [Professional IT Security Providers
> -Exposed]
> PlanNetGroup ( F )
>
>
> > Nate,
> >    Your email was constructive and much appreciated. We'll go over
> > the review a second time and incorporate some of your suggestions.
> > Thank you for taking the time to provide so much good feedback.
> >
> >
> >
> > On Mon, 21 Jan 2008 02:07:50 -0500 Nate McFeters
> > <nate.mcfeters@...il.com> wrote:
> >>SecReview,
> >>My 2 cents on your review, although I will try to be nicer then
> >>you were to
> >>the reviewee.  I'm completely skipping your section where you
> >>talked to the
> >>non-technical person, that's not even fair... sorta like reviewing
> >>a
> >>consulting group based on their website alone... oh shit, I forgot
> >>you guys
> >>do that too.
> >>
> >>Your comments on Question 1:
> >>
> >>We're not impressed with Michael's answer. First off we have no
> >>idea what
> >>the hell this means: "Depending on time and availability, we will
> >>work on
> >>finding any new vulnerability if we generate an anomaly of
> >>interest." And we
> >>totally disagree with "Currently, the focus is primarily on
> >>discovering new
> >>Oracle vulnerabilities - as MS SQL 2K5 is more difficult to beat
> >>on,
> >>compared to Oracle." In fact, whatever is being described above
> >>doesn't
> >>sound anything like a vulnerability assessment, we're not sure
> >>what kind of
> >>service it is.
> >>
> >>The first portion "Depending on time and availability..." I don't
> >>understand
> >>what your confusion is.  Basically the responder is saying that
> >>he's willing
> >>to do what the client will pay him for.  Consulting is not a
> >>cookie-cutter
> >>gig, so sometimes clients want you to spend 5 minutes running
> >>scans, some
> >>want you to fuzz a proprietary protocol for as long as it takes.
> >>I
> >>personally don't think either end of the extreme is of value to
> >>the client,
> >>but you can hardly fault the respondent for delivering what the
> >>client asks
> >>for.
> >>
> >>The second, I don't agree the overall focus is on Oracle, but if
> >>you read
> >>the new (ZDnet, eWeek), or if you follow the conferences (HITB
> >>Malaysia 2007
> >>great Oracle presnetation), then you will know that Oracle is
> >>catching a bit
> >>of the limelight.  Besides that, I don't think you are qualified
> >>to say what
> >>exactly a vulnerability assessment is... if the client is paying
> >>you to
> >>assess their database servers, then that is a vulnerability
> >>assessment of
> >>their database servers and that is what the work is.  Different
> >>clients have
> >>different needs, and their are different specialty consulting
> >>groups to help
> >>meet those... can hardly fault him if his specialty is databases.
> >>
> >>Your Comments on Question 2:
> >>
> >>>>trying to be cute with your "Again, carefully!" bullshit?
> >>
> >>Come on guys... imagine you get called by a group of people asking
> >>to assess
> >>your company and you don't know who they are, wouldn't you try to
> >>befriend
> >>them if possible?  A little professionalism would go a long way to
> >>improving
> >>your reviews.
> >>
> >>>>A penetration test is not "Anything Goes!"
> >>
> >>Umm... sorry guys, there is plenty of cause for performing a
> >>Denial of
> >>Service test.  Keep in mind that availability is a large portion
> >>of what
> >>security is about.  I don't think he's talking about using a bot
> >>net to try
> >>to take them down.
> >>
> >>>>it doesn't sound like Michael knows how to perform IDS evasion
> >>testing.
> >>Using a proxy is >>not going to help anyone evade detection, it
> >>will just
> >>help them to hide their IP address.
> >>
> >>Hmm... well, you're partially right.  I suppose that if he had
> >>enough proxy
> >>servers and kept his scans very focused, he "might" be able to get
> >>around an
> >>IDS.  In any case, not all clients want IDS evasion performed...
> >>for
> >>instance, they may want to test their incident response, or, they
> >>may allow
> >>the consulting group through the IPS/IDS in an effort to save on
> >>time and
> >>costs.
> >>
> >>Your response to question 3:
> >>
> >>>>From the answer above, it looks like they like the same tools as
> >>most
> >>people. That said, >>we've seen no proof of talent from anyone at
> >>PlanNetGroup yet. So we're near certain that >>their deliverables
> >>ARE the
> >>product of automation.
> >>
> >>If they are the same tools that everyone use, how can you knock
> >>them for
> >>that?  It seems to me that a group starts with a score of 0 in
> >>your book,
> >>and then if they impress you they get points.  If you don't ask
> >>the right
> >>questions, I don't see how they could impress you.  I concede, it
> >>is
> >>certainly possible that they have no skills, and that they use
> >>automation,
> >>but I don't think it is fair to say that at this point of the
> >>review.
> >>
> >>Your response to question 4:
> >>
> >>>>Woha, it takes too much time to create a fake deliverable? Well
> >>that's one
> >>way to get out >>of it, but we don't buy it. Either way, at this
> >>point we
> >>don't feel that a sample report would >>help this review, we've
> >>seen nothing
> >>impressive yet.
> >>
> >>Ever tried to do so?  It does take awhile, and it is risky.  If
> >>you miss
> >>sanitization and release results of one of your clients you could
> >>get sued.
> >> Perhaps given the context of the investigation he didn't want to
> >>give you
> >>an old report and it would take to long and too much of his
> >>billable time to
> >>actually get this to you.  That's not unreasonable.  You aren't
> >>paying him.
> >> Again with the comments of nothing impressive yet.  You are
> >>asking generic
> >>questions, how could anything be impressive?  It's a phone call or
> >>email and
> >>you are asking questions that almost all consulting groups should
> >>have
> >>relatively the same answers to... I see nothing impressive in that
> >>at all.
> >>
> >>Your response to question 5:
> >>
> >>>>It sounds like Michael has a difficult time sticking to the
> >>scope of work.
> >>Any time anyone >>performs Distributed Metastasis it should be
> >>built into a
> >>scope of work first. If it is not, >>then do not perform the
> >>testing because
> >>it is invasive and will get you into trouble. This is >>a big
> >>negative point
> >>in our eyes as its critical that providers are able to adhere to
> >>the scope
> >>>>of work for each specific engagement.
> >>
> >>I actually agree with most of this, but then again, as long as he
> >>doesn't go
> >>over the clients budgetary and time constraints and is providing
> >>the
> >>customer with value, I have no problem with going outside of scope
> >>as long
> >>as the client does not.  Also, I don't know that it is a big
> >>negative as you
> >>say.
> >>
> >>Your response to question 6:
> >>
> >>>>It sounds like Michael is a corporate security guy and has no
> >>experience
> >>as a hacker.
> >>Bit of a blanket statement I'd say, but OK, let's assume you are
> >>correct
> >>>>Certifications hold little to no water when it comes to real IT
> >>security.
> >>Agreed, but you are totally putting words into his mouth.  He
> >>basically says
> >>the same thing by calling the CISSP a definition test.  Why do
> >>that?  Most
> >>people in security have the certs... most realize they are worth
> >>nothing and
> >>don't really test tech knowledge, but instead test business
> >>knowledge.
> >>>>What does hold water is experience and from what we can tell,
> >>Michael has
> >>no real hacker >>experience.
> >>Please define "no real hacker experience".  If you mean he isn't
> >>31337 like
> >>you guys, then OK.  BTW, most clients aren't just paying for "real
> >>hacker
> >>experience" they're also paying for the business side, i.e. what
> >>is my risk,
> >>how can I mitigate, etc.  A good team has both people.
> >>
> >>On your response to question 7:
> >>
> >>Do you resell third party technologies?
> >>
> >>>>We don't think that it is a good idea that Professional IT
> >>Security
> >>Providers sell third party >>technologies. Specifically because
> >>they become
> >>biased towards a specific technology and >>push that technology as
> >>a method
> >>of remediation when better methods might already exist.
> >>Agreed.  But that said, what if your third-party tech. has nothing
> >>to do
> >>with the main thrust of your consulting work?  The question is
> >>pretty vague.
> >>
> >>On your response to question 8 and 9:
> >>
> >>Ok, I'll buy that you have cookie cutter definitions from google
> >>of those
> >>flaws and that his definitions don't fit.  I'll even buy that you
> >>make a
> >>good point when you say EIP overwrite is not the only method of
> >>exploitation
> >>(especially these days), but I'm wondering what you expected.
> >>Should he
> >>have rattled on and on about how to exploit b0f in an XP SP 2
> >>environment?
> >> Talk to you at length about DEP?  Bit ridiculous expectations.
> >>Hell, while
> >>your at it, why didn't you ask him about integer overflows?  Off-
> >>by
> >>one/few/many exploits?  Heap overflows?  Why not have him recite
> >>the Heap
> >>Fung Sheui method to you?  What about double free flaws, dangling
> >>pointers,
> >>etc. etc. etc.  Let's be serious here, unless you are contracted
> >>by
> >>Microsoft or another major software vendor, you probably don't pay
> >>the bills
> >>by doing your own research, so... does this really matter?  Sure,
> >>it's
> >>great... I'd like to know that consultants I was paying top dollar
> >>to knew
> >>about this, but if he comes on site and spends 3 weeks trying to
> >>find an
> >>integer overflow, I'm going to be pissed.
> >>
> >>Disclaimer:
> >>I'm not a client of PlanNetGroup.  Also, I don't think what you
> >>are trying
> >>to do is a terrible thing, there's lots of snake oil being sold in
> >>the
> >>commoditized security market out there, but I disapprove of your
> >>professionalism and your methods.  Also, I believe the list is
> >>still waiting
> >>for you to credentialize yourself/yourselves.  That still hasn't
> >>seem to be
> >>grasped here.  Look, if you're someone people respect, then maybe
> >>people
> >>will buy your reviews, but somehow I doubt that is the case.  I'm
> >>basing
> >>that view off of the content of your website and the fact that you
> >>still
> >>have not credentialized yourself as the list called for so long
> >>ago.  Do
> >>that, and I will re-review my review of your reviews.
> >>
> >>Nate
> >>
> >>On Jan 20, 2008 7:17 PM, secreview <secreview@...hmail.com> wrote:
> >>
> >>> The PlanNetGroup is a Professional IT Security Services Provider
> >>located
> >>> at http://www.plannetgroup.com. <http://www.plannetgroup.com/>
> >>One of our
> >>> readers requested that we perform a review of the PlanNetGroup,
> >>so here it
> >>> is. It is important to state that there isn't all that much
> >>information
> >>> available on the web about the PlanNetGroup, so this review is
> >>based mostly
> >>> on the interviews that we performed.
> >>>
> >>> The PlanNetGroup was founded by Jim Mazotas of Ohio USA
> >>according to this Affirmative
> >>> Action Verification Form<http://odnapps01.odn.state.oh.us/das-
> >>eod/EODBMSDev.nsf/d881c0c739c3c9b985257344004f1929/c3e323de1df5162b
> >>8525735d00607a6d?OpenDocument>.
> >>> We called Mr. Succotash and spoke with him for about an hour
> >>about his
> >>> company, here's what he had to say.
> >>>
> >>> When we spoke with Jim Mazotas we asked him how he defined a
> >>Penetration
> >>> Test. His answer wasn't really an answer at all but rather was a
> >>bunch of
> >>> technical words strung into sentences that made no sense. Here
> >>is what he
> >>> said for the most part. We can't give you an exact quote because
> >>he
> >>> requested that some of the information related to clients, etc
> >>be kept
> >>> confidential.
> >>>
> >>> "We get to target object, where we go with that is based upon
> >>the client's
> >>> comfort level. We grab banner information, backend support
> >>information, and
> >>> other kinds of information. During a penetration test we most
> >>will not
> >>> penetrate. Most mid level companies will not want penetration."
> >>– Sanitized
> >>> Quote from Jim
> >>>
> >>> Not only do we not understand what Jim said, but he'd be better
> >>off saying
> >>> "I don't know" next time instead of looking like an idiot and
> >>making up an
> >>> answer. This goes for all of you people that get asked technical
> >>questions.
> >>> If you say "I don't know" at least you won't look like a fool.
> >>Anyway.
> >>>
> >>> When we asked Jim to define a Vulnerability Assessment, we
> >>became even
> >>> more flustered. Again his answer was like a politician trying to
> >>evade a
> >>> question with a bunch of nonsensical noise. Again, we've
> >>sanitized this at
> >>> Jim's request.
> >>>
> >>> " A Vulnerability Assessment is more a lab based environment
> >>type test.
> >>> Analyze servers and all nodes that are a true vital asset to the
> >>company and
> >>> assess the vulnerability In a very planned out manner. This is
> >>done in a lab
> >>> based environment." – Sanitized Quote from Jim
> >>>
> >>> Again, next time say "I don't know" because now you look like an
> >>idiot.
> >>> Nobody expects you to know everything, but when you make shit up
> >>and try to
> >>> fool people, its insulting. To be fair to Jim, he did say that
> >>he was not
> >>> technical, but we didn't get technical here. As the founder of
> >>the business
> >>> he should at least know what his different service boundaries
> >>are and how
> >>> his services are defined.
> >>>
> >>> When we asked Jim if his team performed Vulnerability Research
> >>and
> >>> Development, he said that they did not have the time because
> >>they were
> >>> "fully booked". His primary customer base includes state
> >>government and a
> >>> few private sector businesses. Unfortunately, we can't disclose
> >>who his
> >>> exact customers are. He did say that he provides Network
> >>Management Services
> >>> and Wireless Management services for many of his clients. Sounds
> >>more IT
> >>> related than Professional Security related.
> >>>
> >>> When we finished with our call to Jim we asked him if he'd be
> >>kind enough
> >>> to give us contact information for someone more technical in his
> >>company. He
> >>> told us that he'd be happy to arrange a call with someone. At
> >>the end, we
> >>> didn't end up calling anyone but instead shot a few emails back
> >>and fourth.
> >>> The rest of this review is based on those emails.
> >>>
> >>> We decided to ask the same questions to Jim's technical expert.
> >>We know
> >>> who his expert is, but we assume that he wants to stay anonymous
> >>because he
> >>> signed his email with "Jason Bourne". So for the sake of this
> >>interview
> >>> we'll call him Michael. Here's the email from Michael:
> >>>
> >>> -) How do you perform your vulnerability assessments?
> >>>
> >>> "* Carefully! :) Typically, we will work with the customer to
> >>define the
> >>> scope of the assessment; limitations to OS, Network Equipment,
> >>Web
> >>> Server, etc. This could be a combination of components
> >>(depending on
> >>> scope), the real goal ultimately with this is to assess the
> >>patching
> >>> effort of a customer. Depending on time and availability, we
> >>will work
> >>> on finding any new vulnerability if we generate an anomaly of
> >>interest.
> >>> Currently, the focus is primarily on discovering new Oracle
> >>> vulnerabilities - as MS SQL 2K5 is more difficult to beat on,
> >>compared
> >>> to Oracle. Within vulnerability assessments, we disregard any
> >>attempts
> >>> to evade IDS, IPS, etc."
> >>>
> >>> We're not impressed with Michael's answer. First off we have no
> >>idea what
> >>> the hell this means: "Depending on time and availability, we
> >>will work on
> >>> finding any new vulnerability if we generate an anomaly of
> >>interest." And we
> >>> totally disagree with "Currently, the focus is primarily on
> >>discovering new
> >>> Oracle vulnerabilities - as MS SQL 2K5 is more difficult to beat
> >>on,
> >>> compared to Oracle." In fact, whatever is being described above
> >>doesn't
> >>> sound anything like a vulnerability assessment, we're not sure
> >>what kind of
> >>> service it is.
> >>>
> >>> -) How do you perform your penetration testing?
> >>>
> >>> * Again, carefully! The definition that I use with customers is -
> >>
> >>> Anything Goes! In addition to attempting to locate missing
> >>patches,
> >>> vulnerable IOS's, applications, etc - we will perform an
> >>assortment of
> >>> timed attacks, attempt to spoof trusted connections, or even
> >>perform
> >>> social engineering - like dropping a few pre-trojan'd usb data
> >>sticks
> >>> outside of a customer service area, a data center, etc. The only
> >>thing
> >>> that we do not perform, typically, is denial of service style or
> >>type of
> >>> attacks. We have had only one customer that we felt was in the
> >>position
> >>> to handle such a test and it was performed against their
> >>disaster
> >>> recovery infrastructure, not production."
> >>>
> >>> Michael, why are you trying to be cute with your "Again,
> >>carefully!"
> >>> bullshit? A penetration test is not "Anything Goes!", if that's
> >>how you
> >>> define it then I don't want you anywhere near any of my
> >>networks. And why
> >>> the hell would you perform a Denial of Service attack against
> >>anyone?
> >>> Everybody can be knocked off line if you fill up their pipe. You
> >>scare us
> >>> man!
> >>>
> >>>
> >>> -) How do you perform evasive IDS testing?
> >>>
> >>> "* We use a series of proxy servers to attempt to perform basic
> >>hacking
> >>> techniques; port scans, blatant attacks, etc. We are typically
> >>going to
> >>> look for TCP resets as a means to evaluate if IDS is present and
> >>> possibly to find if IDS performs blocking activity. Often times,
> >>if a
> >>> system in a trusted DMZ can be compromised and used as a proxy
> >>> (exploiting a relationship or rule within a firewall) or an SSH,
> >>SSL,
> >>> encrypted tunnel can be established to a server behind the IDS
> >>sensor
> >>> than we can successfully pull off an attack without the
> >>customers
> >>> security staff even knowing."
> >>>
> >>> It doesn't sound like Michael knows how to perform IDS evasion
> >>testing.
> >>> Using a proxy is not going to help anyone evade detection, it
> >>will just help
> >>> them to hide their IP address. If the target network or
> >>application is being
> >>> protected by an IPS device, then the IP that they are attacking
> >>from will be
> >>> shunned just the same. So, we understand that the PlanNetGroup's
> >>expert
> >>> hasn't a clue as to how to evade IDS. (Michael, did you get your
> >>answer from
> >>> Google?)
> >>>
> >>> -) What tools do you favor?
> >>>
> >>> "* We really do not favor any tools. The focus of our effort
> >>(Assuming we
> >>> are performing a pen-test or assessment) is to analyze a
> >>situation and
> >>> choose the best tool for the end result or compromise. I will
> >>use commercial
> >>> applications, such as AppScan, WebInspect, even ISS. There are
> >>however
> >>> plenty of freeware, low-cost tools that we use; nmap, nessus,
> >>metasploit -
> >>> ultimately, I find that an internet browser and a telnet prompt
> >>will suffice
> >>> for much of the testing. It ultimately gets back to interpreting
> >>the results
> >>> and adjusting the testing accordingly. We make it a point to try
> >>out new
> >>> freeware tools on every assignment. The more tools that we know
> >>of and can
> >>> test with opens our options if in the future a situation best
> >>suited for a
> >>> tool presents itself."
> >>>
> >>> Every business that delivers security services has a set of
> >>tools that
> >>> they use. These tools change from business to business, but
> >>common ones are
> >>> nessus, webinspect, CANVAS, Core Impact, Metaspoloit, etc. From
> >>the answer
> >>> above, it looks like they like the same tools as most people.
> >>That said,
> >>> we've seen no proof of talent from anyone at PlanNetGroup yet.
> >>So we're near
> >>> certain that their deliverables ARE the product of automation.
> >>>
> >>> -) Can you provide us with sample deliverables? (sanitized)
> >>>
> >>> "* No, too much time. Even to sanitize creates an opportunity
> >>for a
> >>> liability in the event that a customer name is exposed ...
> >>accidents do
> >>> happen! I will say that we do not take dumps from applications
> >>and
> >>> regurgitations the information on paper. We limit our executive
> >>summary to 6
> >>> pages at most and attempt to keep the entire report limited to
> >>25 pages in
> >>> total. Our goal with a deliverable is to get the precise
> >>information to the
> >>> key stake holders so that they can make a decision."
> >>>
> >>> Woha, it takes too much time to create a fake deliverable? Well
> >>that's one
> >>> way to get out of it, but we don't buy it. Either way, at this
> >>point we
> >>> don't feel that a sample report would help this review, we've
> >>seen nothing
> >>> impressive yet.
> >>>
> >>> -) Do you offer the option of performing Distributed Metastasis?
> >>>
> >>> "* No, not really. This is my decision as in a previous life I
> >>got walked
> >>> out of Bell Atlantic Mobile (Verizon Wireless) using this
> >>technique when I
> >>> compromised their Unix infrastructure by compromising the rlogin
> >>function
> >>> (on all Unix servers, across all data centers). There is no
> >>substitute for
> >>> experience, especially bad ones!"
> >>>
> >>> It sounds like Michael has a difficult time sticking to the
> >>scope of work.
> >>> Any time anyone performs Distributed Metastasis it should be
> >>built into a
> >>> scope of work first. If it is not, then do not perform the
> >>testing because
> >>> it is invasive and will get you into trouble. This is a big
> >>negative point
> >>> in our eyes as its critical that providers are able to adhere to
> >>the scope
> >>> of work for each specific engagement.
> >>>
> >>> -) What is your background with relation to information
> >>security?
> >>>
> >>> "* Too long, too boring. Yeah got the CISSP (nice vocabulary
> >>test), but
> >>> had to as I worked for DOD. Got a number of Certifications (I
> >>have a stack
> >>> almost an inch thick and only get into them about once a year to
> >>throw
> >>> another couple on top of the previous ones - too much alphabet
> >>soup for me,
> >>> but bosses and customers like it. Spoke at a number of
> >>> European conferences, but found too many people did not
> >>understand a word
> >>> I was talking about, so I got tired of that and quit that scene.
> >>My outlook
> >>> on security has changed, to the point that I will advise
> >>customers of their
> >>> risk, attempt to make it practical - but if they make a
> >>conscious choice not
> >>> to listen - I do not fret over it.?"
> >>>
> >>> It sounds like Michael is a corporate security guy and has no
> >>experience
> >>> as a hacker. Certifications hold little to no water when it
> >>comes to real IT
> >>> security. What does hold water is experience and from what we
> >>can tell,
> >>> Michael has no real hacker experience.
> >>>
> >>> -) Do you resell third party technologies?
> >>>
> >>> "* No, but kind of wished that we would. I think that it would
> >>help with
> >>> sales."
> >>>
> >>> We don't think that it is a good idea that Professional IT
> >>Security
> >>> Providers sell third party technologies. Specifically because
> >>they become
> >>> biased towards a specific technology and push that technology as
> >>a method of
> >>> remediation when better methods might already exist.
> >>>
> >>> -) Can you tell me why the EIP is important?
> >>>
> >>> "* The EIP controls an applications execution. If an attacker
> >>can modify
> >>> the EIP while it is being pushed on the stack then the attacker
> >>*could*
> >>> execute their own code and create a thread (aka. a buffer
> >>overflow condition
> >>> exists). I had a good refresher this past year at Blackhat with
> >>a course run
> >>> by Saumil Shah - he had an interesting buffer overflow
> >>> for the Linked-In client."
> >>>
> >>> The EIP is the Instruction Pointer for the x86 architecture. The
> >>purpose
> >>> of the EIP is to point to the next instruction in a particular
> >>code segment.
> >>> If the EIP can be overwritten then the flow of control of an
> >>application can
> >>> be changed. In most cases this can lead to the execution of
> >>arbitrary code
> >>> on the targeted system. Hackers use this to penetrate vulnerable
> >>systems.
> >>>
> >>> -) Can you define a format string exploit?
> >>>
> >>> "* A format string exploit leverages what is considered a
> >>programming
> >>> bug. If input is not sanitized, an attacker can perform calls to
> >>the
> >>> stack; read, write, etc without knowing details about the EIP."
> >>>
> >>> Unfortunately this answer isn't accurate or detailed enough as
> >>almost all
> >>> software vulnerabilities are the result of user input that is
> >>not properly
> >>> sanitized or validated. A format string condition occurs when a
> >>user inserts
> >>> a format token into a C based application and that input is not
> >>properly
> >>> sanitized. Hence why it is called a format string vulnerability.
> >>When that
> >>> input hits a function that performs formatting, such as printf()
> >>the input
> >>> is interpreted in accordance with the format tokens. Sometimes
> >>this can be
> >>> used to write arbitrary data to arbitrary memory locations. The
> >>EIP isn't
> >>> the only valuable memory location.
> >>>
> >>>
> >>>
> >>>
> >>> If you've managed to get this far, then you've survived reading
> >>Michael's
> >>> answers to our questions. We're not going to spend much more
> >>time writing
> >>> this review because by now we've formed our opinion. We did take
> >>a quick
> >>> look at the PlanNetGroup's website and as with their people, we
> >>were not the
> >>> least bit impressed.
> >>>
> >>> Our opinion of the PlanNetGroup is that they'd have a hard time
> >>hacking
> >>> their way out of a wet paper bag. Their security expert is not
> >>an expert by
> >>> our standards, as he did not properly answer any of our
> >>questions or help to
> >>> define any of their services. We're pretty sure that the
> >>PlanNetGroup could
> >>> run nessus and offer basic vulnerability assessment services.
> >>We're also
> >>> pretty sure that they could offer IT services at some level. But
> >>we'd hardly
> >>> call them subject matter experts and wouldn't recommend their
> >>services to
> >>> anyone.
> >>>
> >>> If you are using the PlanNetGroup services and feel that we have
> >>not given
> >>> them a fair review then please comment on this post. We will
> >>consider your
> >>> comments. We have to say that Jim and Michael were both very
> >>polite,
> >>> friendly, and respectful, but we can't let their kind nature
> >>impact our
> >>> opinion of their service delivery capabilities. We think that
> >>they should
> >>> sit down and try to define their services properly. We also
> >>think that they
> >>> should hire an ethical hacker with real world experience if they
> >>intend to
> >>> protect anyone.
> >>>
> >>> Score Card (Click to Enlarge)
> >>>
> >>>
> >>>
> >><http://bp2.blogger.com/_VcwqM25xL9M/R5PxN8GqVTI/AAAAAAAAACU/D7T4RS
> >>QlSXs/s1600-h/96YV5X.jpeg>
> >>>
> >>> --
> >>> Posted By secreview to Professional IT Security Providers -
> >>Exposed<http://secreview.blogspot.com/2008/01/plannetgroup-
> >>f.html>at 1/20/2008 04:21:00 PM
> >>> _______________________________________________
> >>> Full-Disclosure - We believe in it.
> >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >>> Hosted and sponsored by Secunia - http://secunia.com/
> >>>
> > Regards,
> >      The Secreview Team
> >      http://secreview.blogspot.com
> >
> > --
> > Love Graphic Design? Find a school near you. Click Now.
> >
> http://tagline.hushmail.com/fc/Ioyw6h4fQlBYaiWpFnhi7pQK25eSsGhZHGXMnUnkrTsYbFDu13WWSE/
> >      Professional IT Security Service Providers - Exposed
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists