Re: what is this?

[Valdis.Kletnieks () vt edu]

On Wed, 16 Jan 2008 20:41:21 CST, reepex said:

> woah paul are you talking about stuff you do not know about again? [1] You
> like to butt in on conversations. and how do you that this virus has been
> put in virustotal, maybe it is new? Most people with decent RE skill (
> unlike you and gadi ),

It might come as quite the shock to you in your sheltered corner of the
security community, but many of us have jobs and roles in the community that
don't directly involve either creating exploits or doing RE.  For instance,
I will cheerfully admit that I suck at writing exploits, and I'm not the
world expert on RE.  On the other hand, that's OK, because that's not my
job.  My job is to answer questions like "What is our exposure if somebody
has an exploit for bug #19345" and "What can we do to minimize the damage if
somebody in the VP's office gets hit with the FooBar trojan?" and other
similar "How do we keep our 30,000 users out of trouble?" questions.
And to answer those sorts of questions doesn't take a lot of writing/RE
knowledge, but it *does* require understanding things like "escalating
privilege" (if attacker has X, can they get to Y?), auditing (how do we
know if an attacker did or didn't get Y), deployment issues (how
do you get 30,000 users to patch against something, when you don't have
administrative control over their boxes), and social engineering (what you
resort to when you can't find other ways to get the users to patch :) 
and social engineering.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/