Re: Is Marty Lying?

[Martin Roesch <roesch () sourcefire com>]

I'm not going to engage in tit-for-tat on this stuff, so let me get 
right to it.

> stupid to think independantly to arrive to a conclusion to what most
> likely did happen with the Snort.org compromise.

Snort.org wasn't compromised, a shell server was.

> Some good questions are:
> 1) If the intrusion were limited to a single "shellbox" then why did 
> they
> need to audit the code in CVS to see if it was backdoored?

The audits were performed after the rpc buffer overflow in Snort this 
past spring, no audit was performed as a result of the compromise 
because it didn't effect anything.  I don't see why this is a tough 
problem for you, grep the code for whatever you're interested in or 
something, it's open source.  In fact, I invite everyone to go through 
the code and check it themselves, it's all up there on snort.org all 
the way back to the initial release back in 1998.

    -Marty

--
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Snort-based Enterprise Intrusion Detection Infrastructure
roesch () sourcefire com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html