full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] All China, All The Tim

Re: [Full-disclosure] All China, All The Time

From: Benji <me_at_nospam>
Date: Fri Jan 15 2010 - 18:42:47 GMT
To: Christian Sciberras <uuf6429@gmail.com>


Actually you were boasting, it was irrelevant to have what you have as a security precausion. Infact, one could argue that you were making your setup insecure by telling people how you're secured from the get go.

On Fri, Jan 15, 2010 at 6:38 PM, Christian Sciberras <uuf6429@gmail.com>wrote:

> My question was mostly rhetoric, I tried to imply the point on why
> computers with sensitive information were;
> 1. not fully up to date (=>from the top of my had, the exploit had
> several issues in non-standard browser versions?)
> 2. running internet explorer (=>more known as a target, nothing against
> MSIE)
> 3. used to surf the web (=>why else would you be using IE [rhetoric])
> 4. not monitored correctly (=>our most sensitive information is stored
> in a server locked up 5 times, the only way to get in is either
> getting all the keys or through a remote exploit*)
>
> I think the above points violate a couple of rules in security auditing.
>
> * I'm not boasting about our configuration; this is very easy to
> achieve in a company of 5 and one server rack.
>
>
> On Fri, Jan 15, 2010 at 7:08 PM, Peter Besenbruch <prb@lava.net> wrote:
> > On Thursday 14 January 2010 21:49:05 Christian Sciberras wrote:
> >> "They used an IE exploit to get in."
> >> The people at *Google* use *IE*?!! Besides, how does an exploit in IE
> >> affect the server?
> >
> > It would affect a person with login rights to a server.
> >
> > This wasn't just an attack on Google, btw, it was an attack on 32
> different
> > companies.
> > --
> > Hawaiian Astronomical Society: http://www.hawastsoc.org
> > HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/