full-disclosure - Re: Supporters urge halt to, hacker's, extradition to US

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 29 Sep 2008 16:00:38 +0100
From: Kyrian <kyrian@....org>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Supporters urge halt to, hacker's,
	extradition to US

Folks,

Thanks to "Exibar" for the (likely) clarification. No issue in converting
from metric, incidentally ;-)

I will check out the links you provided this evening and make up my own mind.

As stated, I did go to the thing, but wasn't shouting at chanting, because I
felt something was certainly amiss in this, the extradition agreement between
the UK and the US (which I also have yet to check out in detail) seems iffy
enough.

As someone has already stated, running an exploit to gain access in itself can
cause damage, without necessarily being known to do so by the 'attacker', but
it is equally possible that for example sh**ty PHP code can crash out a web
server by going too recursive and stack smashing (see various preg_* issues)
without any ill intent by the person viewing the page, merely code behaving
unexpectedly.

I am sure we all know many examples of how things can go awry without
malicious intent, or go awry because some company forget to pay their sysadmin,
and as a result he takes his eye off the ball, and something goes wrong
while he has a lingering login he forgot to terminate, eg. running in a
"screen" session in the background.

I'm not the best at computer forensics in the world, but I'm pretty sure
a sysadmin in that position would get the finger pointed at him, at least
for a while. Maybe long enough to be extradited, no?

That is perhaps my primary worry here. I am not yet certain.

However I was quite sure that what was amiss was not necessarily in the way
it was being expressed by those concerned.

Perhaps I was looking in the wrong place, perhaps not. I'll find out more
this evening, but for now there is work to be done.

K.

-- 
Kev Green, aka Kyrian. E: kyrian&#64;ore.org WWW: http://kyrian.ore.org/
Linux/Security Contractor/LAMP Coder/ISP, via http://www.orenet.co.uk/
                 DJ via http://www.hellnoise.co.uk/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/