- Legacy - lists.gtalug.org

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 09:59:43 -0500 (EST) Robert Brockway <robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org> wrote: > Well, there's my position. I won't be replying to this thread again > unless interesting new material is added. I find all too often that > people will follow up, just repeating (or slightly varying from) what has > already been said and the arguments go round and round. As far as I'm > concerned Joe and I have differing opinions and have both expressed them > now. I won't waste time following up if I'm only going to be repeating > what I've already said. Like to have the last word, eh? People like car ananlogies, so here goes: A certain brand of tire, it is discovered, has a propensity for explosive tread separation at highway speeds. Do we keep this info private, until the vendor can supply a patch? No. We immediately inform the public that there is a risk, so that they can take steps to reduce that risk, such as using another brand of tire or modifying their driving habits, or, if so inclined, staying off the road altogether until the vendor can supply a tire which does not go "boom". I have found/seen no empirical evidence to suggest that crackers (you are correct, I think in that distinction) benefit from disclosure, but I have read many accounts of public disclosure of security risks leading to timely and effective mitigation, such as the examples I have already posted. If someone could point me to a source which contradicts this evidence, I would gladly eat my words, otherwise, the idea that these script kiddies benefit *substantially* from public disclosure of vulnerabilities remains, in my mind, merely a theory. The fact that it is proposed primarily by proprietary software vendors also makes me suspicious. To wit: http://www.wild.lib.fl.us/bib/disclosure-by-date.html You will notice that proprietary vendors are by far the most vocal about keeping a lid on newly discovered exploits, whereas the actual security professionals see more good than harm in publicly disclosing them. My favourite quote, from: http://www.computerworld.dk/usarticles.asp?Mode=1&USArticleID=2682 ""On analysis of the code of the Slammer worm it is apparent that my code was used as its template," Litchfield wrote. Many parts of the worm's code were identical to the published proof of concept code, but the worm was not simply a copy of the published example, Litchfield said. "It (is) apparent that whoever authored the worm knew how to write buffer overflow exploits and would have been capable of doing this without using my shellcode as a template," Litchfield wrote. The code taken from Litchfield's published exploit saved the worm's real writer "about 20 or so minutes," Litchfield wrote." -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "Where the state begins, individual liberty ceases, and vice versa." -- Bakunin -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

MisterHouse / x10 /home automation
by tlug-KfBRzk3UKwol8X4E99VVQg＠public.gmane.org 03 Dec '03

03 Dec '03

Has anyone used x10 or home automation in their house? Where is a good place to shop for x10 stuff? Any recommendations? Robert -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003, JoeHill wrote: > Again, facts and reality fly in the face of this argument. Hackers are > usually, if not always, aware of these vulnerabilities before the > security "establishment", and certainly before software designers can > come up with a Years in the security arena make me disagree with this statement. Most "Hackers" (I prefer the term Crackers but there you go) are script-kiddies. The number of Black Hats (people who are actually serious crackers in their own right) is, and has always been, very small. Far smaller than the security establishment. Most exploits discovered these days are found by those who launch a concerted effort to detect them. By sheer number and amount of effort most of the people who discover exploits are in the security establishment and are not Black Hats. I, along with most security professionals, maintain that the vendors/developers are better off receiving some amount of warning before the exploit goes public. This period can be quite short: 2-4 weeks is fine. Lists like Bugtraq now have specified grace periods that a vendor should have to fix a problem. If they haven't patched after this period, then it is time enough to release the exploit to the world. The problem with this is approach is that while it definately speeds up lazy vendors it creates a race condition: Will the bad guys get to a working exploit before the good guys get a fix out. The reality is the idea of providing vendors a grace period before releasing info on a vulnerability/exploit has been working well for many years and we have all benefitted from it. Most exploits fixed in this way don't get the media attention of ones released on an unsuspecting world so the hard work of many security professionals goes unacknowledged (how typical :) > patch. Full public disclosure is one way to give the vast majority of users a Not true. The vast majority of users can't fix the problem for themselves. They are reliant on a vendor (using the term generically here to include OSS development teams) and the public disclosure has just put the vendor at odds with Black Hats who now know about the exploit. Immediate public disclosure just creates a situation where bad buys & good guys are working on the exploit at the same time, instead of providing the vendor with a head start to getting a fix. > head start, before a patch can even be issued, so that they can at least be > aware of the risk. In fact, following this logic, it could be proposed that Most exploits have few or no ways of mitigating risk without taking down services/servers so knowledge of the risk without viable means to protect against it is only of limited use (trust me I've been there :) It does keep you up at night watching firewall and IDS logs though. > disclosure be even *more* widespread, as soon and as widely as possible. > Security issues are not solved by a patch, they are mitigated by awareness. Software vulnerabilities are normally fixed by patches but I'll agree that security overall is more a function of awareness. I think this sentence mixes up too different concepts (specific security issues vs security procedures and knowledge). > Finally, there is no way to develop an enforceable "policy" in this Do you follow Bugtraq? The policy of advising a vendor first is not formally enforceable but it works anyway. Peer pressure can be a positive force in some instances. Well, there's my position. I won't be replying to this thread again unless interesting new material is added. I find all too often that people will follow up, just repeating (or slightly varying from) what has already been said and the arguments go round and round. As far as I'm concerned Joe and I have differing opinions and have both expressed them now. I won't waste time following up if I'm only going to be repeating what I've already said. Rob -- Robert Brockway B.Sc. email: robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org, zzbrock at uqconnect.net Linux counter project ID #16440 (http://counter.li.org) "The earth is but one country and mankind its citizens" -Baha'u'llah -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, Dec 03, 2003 at 07:46:08AM -0500, JoeHill wrote: > On Wed, 3 Dec 2003 08:24:38 -0500 > John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > > > > > Ask yourself: if this were a certain proprietary company, would this > > > > news leak out so quickly, and would said organization publish a detailed > > > > post-mortem as soon as one is available? > > > > > > There's no "if". Microsoft actually got seriously pissed recently when news > > > of *seven* new vulnerabilities, two of them critical, was released to the > > > general public rather than being privately and secretly notified > > > themselves. > > > > That's a different matter and worthy of everyone being > > pissed. Anyone finding a new vulnerability should > > notify the owner of the code and give them some time > > to find a cure before making a public announcement. > > For an open source project, the original notification > > will be partially public, but you still should not > > try to make the news widely public until there has > > been adequate time to find a fix and distribute it. > > (Proprietary source products often require a longer > > period of time for that process to be carried out.) > > After the period of time is up, then announcing > > the vulnerability is fine (and if the code owner > > has wasted the time and not arranged a fix to be > > distributed widely enough, it rightly looks bad > > on them). > > I think considering MS's past behaviour in this respect (ie. taking *months* to > issue fixes that do not even work), the discoverers of the vulnerabilities did > the right thing. Leaving that aside, MS has no right to expect "courtesy" from > the security community, taking into account it has acted with aggressive > intolerance at any and all criticism of it's security track record, witness the > recent case of the CCIA report and the subsequent firing of it's principle > author from an MS-connected company, @Stake. MS has a poor track record for sure, but your example was not a case of MS acting poorly - they weren't given a chance. Now you're saying they don't deserve a chance, but that is irrelevant to your original point that this example proved that open source does a better job. The open source community can't fix problem before they know of them either. > The argument that public disclosure of security flaws encourages hackers is very > weak, and reeks of justification, in comparison to the logically sound idea that > more public scrutiny means more pressure, and more resources, brought to bear to > fix said bugs. Hence Eric S. Raymond's "many eyes make all bugs shallow." Immediate public disclosure does not provide more eyes for a bug in MS code, just more eyes in the cracker community. Telling MS of a bug, and then telling the world later of the bug (and that MS was told a month earlier so that people can judge whether their response was adequate) provide more than ample pressure, and may reduce the number of exploits carried out against victims who have never had any warning or chance to apply a fix because there wasn't one. If MS responds prompty (which they are doing better at these days - they've learned that they have to), then when the public announcement goes out any attacks prompted by the announcement can only be applied against people who have not yet applied the fix. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 09:16:11 -0500 John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > Immediate public disclosure does not provide more eyes > for a bug in MS code, just more eyes in the cracker > community. That is a myth, propagated by MS and other proprietary vendors, to avoid embarassment and having to do actual work to improve security. Witness the recent case of Diebold and their voting machines. If it were not for the work of students and activists at Swarthmore College, no one would ever have known of the security flaws. Diebold certainly showed no interest in fixing the problem, even though internal memos showed they were aware of those flaws. It was only after said students published the internal memos online that enough pressure is being brought to bear on Diebold to fix the vulnerabilities. Now what software were those machines running agian...? Oh, that's right, MS. > Telling MS of a bug, and then telling the world later > of the bug (and that MS was told a month earlier > so that people can judge whether their response was > adequate) provide more than ample pressure, and may > reduce the number of exploits carried out against > victims who have never had any warning or chance to > apply a fix because there wasn't one. If MS responds > prompty (which they are doing better at these days - > they've learned that they have to), then when the > public announcement goes out any attacks prompted by > the announcement can only be applied against people > who have not yet applied the fix. Again, facts and reality fly in the face of this argument. Hackers are usually, if not always, aware of these vulnerabilities before the security "establishment", and certainly before software designers can come up with a patch. Full public disclosure is one way to give the vast majority of users a head start, before a patch can even be issued, so that they can at least be aware of the risk. In fact, following this logic, it could be proposed that disclosure be even *more* widespread, as soon and as widely as possible. Security issues are not solved by a patch, they are mitigated by awareness. Finally, there is no way to develop an enforceable "policy" in this regard, so it is not realistic to expect that, even if you assume this "myth" is true, people will not go on publicly releasing info on exploits. It's more realistic to find a way to deal with the *expectation* that the exploits are already widely known, and to work from there. If you read the full account of the Debian incident, you will see that that is exactly what happened, and exactly the attitude that was taken. Nothing radical here! In fact, if you do a quick google on this topic, you will find that nothing I'm saying is particularly original, this is the opinion of much bigger fish than you or I. -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "The modern conservative is engaged in one of man's oldest exercises in moral philosophy; that is, the search for a superior moral justification for selfishness."-- John Kenneth Galbraith -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Sendmail for smtp routing..
by fraser-Txk5XLRqZ6CsTnJN9+BGXg＠public.gmane.org 03 Dec '03

03 Dec '03

On December 3, 2003 12:25 am, JM wrote: > would it be possible to route all mails to a different mail server whos > recipient belongs to mydomain.com only.. Yes but why don't you just set the MX record correctly in DNS? With a correct MX record it will automatically go to the mail server of your choice. -- Fraser Campbell <fraser-Txk5XLRqZ6CsTnJN9+BGXg at public.gmane.org> http://www.wehave.net/ Georgetown, Ontario, Canada Debian GNU/Linux -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, Dec 03, 2003 at 05:22:56AM -0500, JoeHill wrote: > On Wed, 3 Dec 2003 00:22:29 -0500 > Chris Keelan <rufmetal-MwcKTmeKVNQ at public.gmane.org> wrote: > > > Ask yourself: if this were a certain proprietary company, would this > > news leak out so quickly, and would said organization publish a detailed > > post-mortem as soon as one is available? > > There's no "if". Microsoft actually got seriously pissed recently when news of > *seven* new vulnerabilities, two of them critical, was released to the general > public rather than being privately and secretly notified themselves. That's a different matter and worthy of everyone being pissed. Anyone finding a new vulnerability should notify the owner of the code and give them some time to find a cure before making a public announcement. For an open source project, the original notification will be partially public, but you still should not try to make the news widely public until there has been adequate time to find a fix and distribute it. (Proprietary source products often require a longer period of time for that process to be carried out.) After the period of time is up, then announcing the vulnerability is fine (and if the code owner has wasted the time and not arranged a fix to be distributed widely enough, it rightly looks bad on them). -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

SOT: shitfs in spam trends and topics
by matt-s/rLXaiAEBtBDgjK7y7TUQ＠public.gmane.org 03 Dec '03

03 Dec '03

Byron Sonne <blsonne-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> writes: > SOT = Somewhat Off Topic, though if there is a another acronym in more common > usage let me know... Yeah, there is. It's 'OT'. > me. "Satisfy your woman, you pin-dick" was the most harsh, and perhaps > relatedly, the funniest one as well. If aggressive derision toward a > potential customer helps make you money then I should have been rich long > ago! The most hilarious spam that I ever got had the subject line 'Get exposed on the internet'. I think that they were offering to register me with various search engines. -- matthew rice <matt-s/rLXaiAEBtBDgjK7y7TUQ at public.gmane.org> starnix inc. phone: 905-771-0017 x242 thornhill, ontario, canada http://www.starnix.com professional linux services & products -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

2 1

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 08:24:38 -0500 John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > > > Ask yourself: if this were a certain proprietary company, would this > > > news leak out so quickly, and would said organization publish a detailed > > > post-mortem as soon as one is available? > > > > There's no "if". Microsoft actually got seriously pissed recently when news > > of *seven* new vulnerabilities, two of them critical, was released to the > > general public rather than being privately and secretly notified > > themselves. > > That's a different matter and worthy of everyone being > pissed. Anyone finding a new vulnerability should > notify the owner of the code and give them some time > to find a cure before making a public announcement. > For an open source project, the original notification > will be partially public, but you still should not > try to make the news widely public until there has > been adequate time to find a fix and distribute it. > (Proprietary source products often require a longer > period of time for that process to be carried out.) > After the period of time is up, then announcing > the vulnerability is fine (and if the code owner > has wasted the time and not arranged a fix to be > distributed widely enough, it rightly looks bad > on them). I think considering MS's past behaviour in this respect (ie. taking *months* to issue fixes that do not even work), the discoverers of the vulnerabilities did the right thing. Leaving that aside, MS has no right to expect "courtesy" from the security community, taking into account it has acted with aggressive intolerance at any and all criticism of it's security track record, witness the recent case of the CCIA report and the subsequent firing of it's principle author from an MS-connected company, @Stake. The argument that public disclosure of security flaws encourages hackers is very weak, and reeks of justification, in comparison to the logically sound idea that more public scrutiny means more pressure, and more resources, brought to bear to fix said bugs. Hence Eric S. Raymond's "many eyes make all bugs shallow." -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "I have the South in front of me and the bankers behind me -- and for my country, I fear the bankers most."-- Abraham Lincoln -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 00:22:29 -0500 Chris Keelan <rufmetal-MwcKTmeKVNQ at public.gmane.org> wrote: > Ask yourself: if this were a certain proprietary company, would this > news leak out so quickly, and would said organization publish a detailed > post-mortem as soon as one is available? There's no "if". Microsoft actually got seriously pissed recently when news of *seven* new vulnerabilities, two of them critical, was released to the general public rather than being privately and secretly notified themselves. -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "The US is our trading partner, our neighbour, our ally and our friend... and sometimes we'd like to give them such a smack!"-- Rick Mercer -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0