full-disclosure - Re: Fwd: Rate Stratfor's Incident Response

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15334.1326138895@turing-police.cc.vt.edu>
Date: Mon, 09 Jan 2012 14:54:55 -0500
From: Valdis.Kletnieks@...edu
To: "J. von Balzac" <jhm.balzac@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Fwd: Rate Stratfor's Incident Response

On Mon, 09 Jan 2012 20:00:11 +0100, "J. von Balzac" said:

> Valdis you make me curious - how do you know that most are kids, and
> script kiddies?

Note that it wasn't me who suggested hiring script kiddies to do pen tests. I
was pointing out why it wouldn't work.

> Isn't it more likely that the people who massively pwned Stratfor are
> indeed mature and serious?

If they're mature, serious, and pwning machines like that, they're heavy duty
black hats (pretty much by definition).  What are the chances they'll want to
take a consulting gig doing a pen test (which would require they come out of
hiding?)

Yes, there's a few people working both sides of the fence. *VERY* few, and
certainly not enough to make it feasible in general to hire one to do your
pentests.  And again, there's that whole "Do you really want to hire a known
black hat" issue to work around.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/