Re: DCOM RPC exploit (dcom.c)

[Len Rose <len () netsys com>]

Disclaimer: I'm not supposed to have an opinion about anything
other than how the list functions but I'm weak and unable to
resist this one.

Hi Chris,

I don't feel that your position is valid. Once the vulnerability was
announced then it was inevitable. I'm surprised that you feel that
security by obscurity is a valid stance. Even those who have released
"harmless" scanners have in fact aided those who would be writing such
malware anyway since all they have to do is sniff the wire if they're
searching for correct methodology. 


Chris Paget wrote:

> <sarcasm>
> I'd just like to thank FlashSky, Benjurry, and H D Moore for releasing this
> code.  Really guys, sterling job.  Now the skript kiddies and VXers have got
> virtually no work to do in order to write a worm that exploits this.
> </sarcasm>

Only those who mistakenly believe that hiding information from the masses
will stop those who have the knowledge and intent to cause harm could feel
this way.

> Personally, I'm tempted to set up my firewall to NAT incoming requests on port
> 135 to either www.metasploit.com or www.xfocus.org.  I know this is the
> full-disclosure list, but working exploit code for an issue this huge is taking
> it a bit far, especially less than 2 weeks after the advisory comes out.

It wouldn't matter if it were 2 months.

> Cheers, fellas.  When the worm comes out, I'll be thinking of you.

Think of the joke sold to millions of people masquerading as an operating system 
coded by unemployed vms programmers, and visual basic "experts" instead.

Len

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html