Full Disclosure mailing list archives
Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows
From: n3td3v <xploitable () gmail com>
Date: Fri, 25 Jul 2008 21:38:08 +0100
On Fri, Jul 25, 2008 at 7:37 PM, Fredrick Diggle <fdiggle () gmail com> wrote:
8. PROFIT!!!!
The security conference (Black hat) will make the most money, out of ticket sales. On the matter of the blog entry leak, I always thought that was a pretend accidental leak and not a real accidental leak. I mean we're not talking about newbies here, these guys are highly intelligent folks focused on information security issues, not the type of folks who genuinely press send on a blog entry by mistake and not know that the blog data gets cached around the internet within seconds of the post going live. We shouldn't get into the conspiracy bullshit because it distracts us from more important stuff, but I was always under the assumption, that the information leak was done on purpose, and made to look like an accidental leak. My focus is away from bashing Dan Kaminsky now about the over hype, and now focused on HD Moore and his partner I)ruid and the legality of their exploit code disclosure and their gloating that is now happening as we speak. Attacks are starting to be reported on unpatched DNS via Nanog mailing list and SANS internet storm center blog, and im not completely convinced that HD Moore and I)ruid should be walking away from this and not being criticized. Infact, im calling for big names in the industry to criticize HD Moore on the mailing lists, and /or in the media. What I have noticed in is no big names have come out in support of what HD Moore has done, so thats a good thing. I praise Cnet News's Robert Vamosi for not writing a single mention of HD Moore or Metasploit in his recent blog write up of the exploit code in the wild coverage http://news.cnet.com/8301-1009_3-9998406-83.html, because to me the whole thing feels criminal, even though it might not be, there is still a sense of criminality and wrongness in what HD Moore has done. Perhaps Nate McFeters can start following Robert Vamosi's lead in not mentioning HD Moore, I)ruid and the Metasploit frame work. Its too late though because Nate McFeters has been promoting HD Moore and I)ruid's name and the Metasploit frame work all week, so perhaps the ZDnet Zero-Day blog is a lost cause already of unrepairable damage of promoting the name of the bad guys who released the exploit code to the wild in the first place, of which im told by Valdis Kletnieks isn't a criminal offense, but in the eyes of n3td3v and the rest of the industry bloody well is the wrong precedence to set in info sec in promoting responsible disclosure or any kind of ethical standard. Hell people like HD Moore are supposed to be role models for a lot of people, scratch that, HD Moore is no role model for anything anymore. :( What have you become HD Moore and who is it you're trying to impress? Not anyone important, maybe a lot of cyber criminal circles, but certainly not the people you should be keeping on side on the mailing list scene or the wider security community and industry. You're not a hax0r anymore who can just do what he wants and f*** around releasing exploit code anymore, you're looked up to by a lot of the young generation HDM, so think about that the next time you go freestyle on going behind the industry's back to bring yourself five minutes of fame, we all know you can program... you don't need to keep proving yourself with these ridiculous irresponsible exploit code disclosures anymore. I have one question to ask you HD Moore, What the hell are you playing at??? All the best, n3td3v _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows Fredrick Diggle (Jul 25)
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows coderman (Jul 25)
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows Fredrick Diggle (Jul 25)
- Message not available
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows Fredrick Diggle (Jul 25)
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows coderman (Jul 25)
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows n3td3v (Jul 25)
- Re: Dan Kaminsky Disclosure Methodology + Super Critical vulnerability disclosure in Windows eugaaa () gmail com (Jul 25)