Re: [NSE script] SSH weak hostkey

[Arturo 'Buanzo' Busleiman <buanzo () buanzo com ar>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Brandon Enright wrote:
> It also makes is possible to compare competitors.  Suppose 30% of the
> keys a Bank of America scanner checks are weak but Citi Bank scanner
> only has 1%.  Maybe Citibank isn't such a great place to do business.
> The fact that this data *might* be recorded by some third party makes
> companies really nervous.

<joke>But isn't being able to make big companies nervous a Good Thing (tm)?</joke> :P

> Nevermind that *you* aren't going to use the data (or probably even
> record it).  I think that enough paranoid people will freak out about
> this sort of service that we need to tread very lightly in this area.

That's why a "use my local /etc/ssh/blacklist.* files" should be the primary source for this
information from an NSE script perspective. IF, and only IF an individual decides and enables an
external query by hand, then, and only then should my/whoever's lookup tool be used.

> I guess that was more than my fair share of $.02 .  Please don't take
> the above as a personal attack but I think it is something worth
> considering.

Yes, don't worry. I don't get it as a personal attack. And I'm grateful you spared the time to write
your insight.

<irony>I'm SURE Google was contacted when the papers on Google Hacking appeared :)</irony>

I mentioned this idea to Fyodor a couple days ago before even writing it, anyway. Forgot to mention
that (not that it changes things, anyway). I agree with you, but I also consider the amount of
people that will find it useful. I'm a balanced paranoid :P

- --
Arturo "Buanzo" Busleiman
Independent Linux and Security Consultant - SANS - OISSG - OWASP
http://www.buanzo.com.ar/pro/eng.html
Mailing List Archives at http://archiver.mailfighter.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIxa96AlpOsGhXcE0RCmZJAJ9Z18RrG/37PmQrJYxI8BiRKsaO4ACdGUBh
dGHpy4OsJpW8Imm6AFkvnW4=
=6QBl
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org