Full Disclosure mailing list archives
RE: David Litchfield talks about the SQL Worm in the Washington Post
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Wed, 29 Jan 2003 12:17:19 -0500
From today's AP story:
FBI Skeptical on Internet Attack Source http://story.news.yahoo.com/news?tmpl=story&ncid=528&e=3&cid=528&u=/ap/2 0030129/ap_on_hi_te/internet_attack Litchfield, who works for NGS Software Inc., said Wednesday that he now appreciates the dangers in publicly disclosing such computer code. He said he originally published those blueprints for computer administrators to understand how hackers might use the program to attack their systems. "One has to question whether the benefits are outweighed by the disadvantages," Litchfield said in a telephone interview from his home in London. "I'm certainly going to be more careful about the way in which anything is disclosed." Richard -----Original Message----- From: Georgi Guninski [mailto:guninski () guninski com] Sent: Wednesday, January 29, 2003 12:18 PM To: Richard M. Smith; full-disclosure () lists netsys com Subject: Re: [Full-disclosure] David Litchfield talks about the SQL Worm in the Washington Post So what? This sql hype highly resembles the code red stuff. Then people accused eeye for releasing the bug, though they didn't provide exploit code. IIRC Litchfield also didn't provide exploit code. Should advisories be "There is a bug. Go patch. End."? Is there any real evidence that releasing PoC helps high scale incidents like this one? - Don't think so. Sure writing worms and virii is bad, but this sql worm has a positive side effect imho. The real damage done was very limitied (high traffic in m$ network according to the reg, some atms stopped working for strange reason, korean spammers off the net) compared to the potential long lasting damage from stealing info from these DBs. There wasn't such fuzz about the apache worm, though imho apache has much more market share than m$ sql. Georgi Guninski http://www.guninski.com Richard M. Smith wrote:
Hi, The following quote from David Litchfield appeared in a front-page article in today's Washington Post: http://www.washingtonpost.com/wp-dyn/articles/A57550-2003Jan28.html "You have this ideal vision of doing something for the greater good," said David Litchfield, managing director of Next Generation Security Software Ltd. of London, who acknowledged that a small bit of his code might have been used in the attack. "I will probably no longer publish such code." Perhaps David can put together a longer message for Bugtraq and Full-Disclosure on his changing views of publishing proof-of-concept code for security vulnerabilities. Richard M. Smith http://www.ComputerBytesMan.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- David Litchfield talks about the SQL Worm in the Washington Post Richard M. Smith (Jan 29)
- Re: David Litchfield talks about the SQL Worm in the Washington Post Georgi Guninski (Jan 29)
- RE: David Litchfield talks about the SQL Worm in the Washington Post Richard M. Smith (Jan 29)
- RE: David Litchfield talks about the SQL Worm in the Washington Post Geo (Jan 29)
- <Possible follow-ups>
- Re: David Litchfield talks about the SQL Worm in the Washington Post Steven M. Christey (Jan 29)
- Re: David Litchfield talks about the SQL Worm in the Washington Post auto68182 (Jan 30)
- Re: David Litchfield talks about the SQL Worm in the Washington Post Georgi Guninski (Jan 29)