Re: Civil Disobedience

["Jordan" <jordanf () home com>]

Seeing as it seems to be "Rehash old arguments without contributing anything
new"-week, here's my contribution.

This raises another fun issue. Is the person who helped the cracker who
cracked you also responsible for the cracking that ensued. Would it be
better if we stopped discussing vulnerabilities publicly, and only gave the
bare minimum, (ie. there's a new vuln in IIS, download the patch). Major
players in the security industry seem to think this is better...what's your
take on the matter...Scott Culp is advocating this, read his take on this at
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/columns/s
ecurity/noarch.asp. Apparently we're all information anarchists....well
don't we feel sheepish...

My opinion is this:
If that guy hadn't been helped on this wonderful list, then you may not have
been cracked by him, but if your box was vulnerable then it would only have
been a matter of time...at least with the public discussion of the
vulnerability, you can't say you weren't warned...I see no problem with
educating people. As long as it's not too specific (Q: Hey vuln-dev, I have
a question, how can I break into www.ebay.com. A: Well, just type...). I
think that forbidden knowledge is much more dangerous than public knowledge.

jordan


----- Original Message -----
From: "j03" <j03 () hotmail com>
To: "Joe Shaw" <jshaw () insync net>; "Hire, Ejay" <Ejay.Hire () Broadslate net>
Cc: "'br0ken halo'" <x_burning () hotmail com>; <vuln-dev () securityfocus com>
Sent: Tuesday, October 16, 2001 12:08 AM
Subject: Re: Civil Disobedience


> I was crackd by someone who posted a question on here.  Its amazing to
watch
> how they ask for help on things, receive the help, then apply it to your
> box.
> ----- Original Message -----
> From: Joe Shaw <jshaw () insync net>
> To: Hire, Ejay <Ejay.Hire () Broadslate net>
> Cc: 'br0ken halo' <x_burning () hotmail com>; <vuln-dev () securityfocus com>
> Sent: Monday, October 15, 2001 8:31 PM
> Subject: RE: Civil Disobedience
>
>
> > On Mon, 15 Oct 2001, Hire, Ejay wrote:
> >
> > > Don't you think "hacking is a victimless crime" is a bit soft?  I
> > > agree it doesn't merit life inprisonment, but it still has an impact
> > > on its' victims.
> >
> > Crackin is never a victimless crime.  Someone owns the compromised
> > systems.  I've personally spent more time restoring/securing systems
after
> > a compromise because people didn't implement adequate security measures
> > than I'd ever want to.
> >
> > Yours in freedom and liberty,
> > --
> > Joseph W. Shaw II
> > Network Security Specialist/CCNA
> > Unemployed.  Will hack for food.  God Bless.
> > Apparently I'm overqualified but undereducated to be employed.