[Message Precedent sur la mailing
][Message Suivant sur la mailing
][Precedent dans le fil
][Prochain dans le fil
][Index par Date
][Index par fil
Re: [Full-disclosure] What the f*** is going on?
On Tue, Feb 22, 2011 at 1:13 PM, jf <jf@xxxxxxxxx> wrote:
> In ~2005, I was a defense contractor watching NIDS when they came looking for someone who could reverse; I knew enough assembly to write up shellcode, but this was my intro to windows reversing and therein lay your first bad omen as to their actual ability. Over the course of a weekend we got the algorithm out, wrote up a program to read the pcap's and got to work on analysis. Come Monday, we dropped bombs and from the fires emerged a request for our report/tools from another agency and I got to redact my first report, and then another and another. Everyone had this problem, and had it for *years* with little to no discernable progress. They hadn't even identified how $they were getting in, like what bug. So we identified that too, and wrote up a binary patch for it (that went 100% unused except on my machine), et cetera. And then that long string of office 0-days in 2006 started, and eventually I ended up with the private SSL keys for a few absurdly large american companie
s (ended up on a machine of ours), and then the documents started cleaning themselves and this happened multiple times a week for the ~2 years with countless 80-100 hour weeks and all of you telling me my life was a myth/lie/CIA fabrication/et cetera.
hey, ZDI started that year. this when you funnel pcap 0day to ZDI payday... ;)
> These three aspects make it really potent, and my concerns relate to how such lines of thought will develop as they mature as they all circumvent fairly fundamental aspects our fairy tale.
> Anyone from the AV industry got a big set and want to step up and talk about your aurora attacks?
make the operating environment hostile and resilient to attackers. no
AV product can do that from within the system that must be resilient
(not to say AV is worthless, but more akin to crowd based negative
reputation assignment of known malicious payloads rather than any
protection against same...)
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
|Mini-Tagwall des articles publiés sur SecuObs : || |
| || |
| | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre
|Mini-Tagwall de l'annuaire video : || |
| || |
| | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio
|Mini-Tagwall des articles de la revue de presse : || |
| || |
| |security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité
|Mini-Tagwall des Tweets de la revue Twitter : || |
| || |