Full Disclosure mailing list archives
Re: An open question for Snort and Project Honeynet
From: "Matsu Kandagawa" <matsu () mailvault com>
Date: Fri, 26 Sep 2003 22:09:59 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE-----
Who is making a "non-detectability" claim, and in what context? I
have
no reason to claim that no one has, I just haven't seen it. BB
Fair enough, but I sure haven't seen anyone doing much to point out their limitations and cataloging their points of failure. Not to metion taking a full inventory of every respect in which your systems respond differently from real ones. Maybe I just haven't been talking to the right people or listening carefully enough, anybody up for a white paper to fill everyone in? If your sponsors haven't asked for a third-party audit of your tools and deployed systems from an attacker's perspective, they ought to. Really give it both barrels and see what you're left with. If the answer is "but we have!" then in my opinion you really ought to start looking around for that third party. Tear it down, build it up--what else are you getting paid for. Frankly, I'd like nothing better than to discuss more of what I had in mind, but unfortunately my ass is so 0wned by [this space intentionally left blank] that it seems I can't even take a shit without signing a release form. M. -----BEGIN PGP SIGNATURE----- Version: MailVault 2.2 from Laissez Faire City http://www.mailvault.com iQA/AwUAP3Tw7GM5xTGTuR0REQIyBACeJELn8egcz+mjNNK4q6dvnzDsXd8AoNvE jviCR2DWn+n4/O6nU3ForiU2 =w8pq -----END PGP SIGNATURE-----
Current thread:
- Re: An open question for Snort and Project Honeynet, (continued)
- Re: An open question for Snort and Project Honeynet Blue Boar (Sep 23)
- Re: An open question for Snort and Project Honeynet northern snowfall (Sep 23)
- RE: An open question for Snort and Project Honeynet Zach Forsyth (Sep 23)
- Re: An open question for Snort and Project Honeynet Matsu Kandagawa (Sep 24)
- RE: An open question for Snort and Project Honeynet Schmehl, Paul L (Sep 25)
- Re: An open question for Snort and Project Honeynet Matsu Kandagawa (Sep 25)
- Re: An open question for Snort and Project Honeynet madsaxon (Sep 25)
- RE: An open question for Snort and Project Honeynet Ma tsu Kan daga waga (Sep 25)
- RE: An open question for Snort and Project Honeynet Matsu Kandagawa (Sep 26)
- Re: An open question for Snort and Project Honeynet Blue Boar (Sep 26)
- Re: An open question for Snort and Project Honeynet Matsu Kandagawa (Sep 27)