Re: Debian Server Compromise -- A Fire Drill ??

2003-12-09 Thread Burkhard Woelfel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tuesday 09 December 2003 01:55, Joyce, Matthew wrote: -Original Message- From: ScruLoose [mailto:[EMAIL PROTECTED] Sent: Friday, 5 December 2003 8:58 AM To: [EMAIL PROTECTED] Subject: Re: Debian Server Compromise -- A Fire Drill

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-09 Thread David Palmer.
AM To: [EMAIL PROTECTED] Subject: Re: Debian Server Compromise -- A Fire Drill ?? It's cracker. Not hacker. http://web.bilkent.edu.tr/Online/Jargon30/JARGON_C/CRACKER.HTM It's both according to OED. [snip] There are numerous definitions for the word hacker

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-09 Thread Tom
On Mon, Dec 08, 2003 at 06:55:32PM -0800, Paul Johnson wrote: On Mon, Dec 08, 2003 at 05:07:20AM -0800, Tom wrote: I could pay $35 to 1-800-US-SEARCH and really fuck up your day! IANAL, but watch it. You're crossing into threats and harassment territory with that one. No, agressive-type

Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Karsten M. Self
on Sun, Dec 07, 2003 at 06:29:30PM -0800, Tom Ballard, former Microsoft employee, ([EMAIL PROTECTED]) wrote: On Sun, Dec 07, 2003 at 06:19:45PM -0800, Tom Ballard, former Microsoft employee, wrote: On Sun, Dec 07, 2003 at 05:31:12PM -0800, Karsten M. Self wrote: IIRC, it was a prior

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Tom
On Sun, Dec 07, 2003 at 11:25:33PM -0800, Karsten M. Self wrote: Peace. What the fuck are you ranting about? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Tom
On Sun, Dec 07, 2003 at 11:25:33PM -0800, Karsten M. Self wrote: [MSFT Shill] That's not what I'm trying to accomplish. I was trying to point out that you had to invalidate everybody's password last week. I was trying to point out that (gasp) a philosophy which accuses half the world of being

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Tom
Please don't use my real name: I've told you why I don't want it used. Would you prefer I used a handle ? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Karsten M. Self
on Mon, Dec 08, 2003 at 03:48:19AM -0800, Tom Ballard ([EMAIL PROTECTED]) wrote: Please don't use my real name: I've told you why I don't want it used. Would you prefer I used a handle ? Interesting what truths people are uncomfortable with. Peace. -- Karsten M. Self [EMAIL PROTECTED]

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Tom
On Mon, Dec 08, 2003 at 04:54:26AM -0800, Karsten M. Self wrote: on Mon, Dec 08, 2003 at 03:48:19AM -0800, Tom Ballard ([EMAIL PROTECTED]) wrote: Please don't use my real name: I've told you why I don't want it used. Would you prefer I used a handle ? Interesting what truths people are

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Karsten M. Self
on Mon, Dec 08, 2003 at 05:07:20AM -0800, Tom ([EMAIL PROTECTED]) wrote: On Mon, Dec 08, 2003 at 04:54:26AM -0800, Karsten M. Self wrote: on Mon, Dec 08, 2003 at 03:48:19AM -0800, Tom Ballard ([EMAIL PROTECTED]) wrote: Please don't use my real name: I've told you why I don't want it used.

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Greg Folkert
On Mon, 2003-12-08 at 02:25, Karsten M. Self wrote: Mr. Ballard: No, it's not that I'm uncomfortable over the fact, yes, fact, that free software in general, or the Linux kernel in particular, have both bugs and security vulnerabilities. It's your grossly ignorant, yet simultaneously

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Paul Morgan
On Sun, 07 Dec 2003 23:25:33 -0800, Karsten M. Self wrote: There are bugs in the kernel code. Estimates of such bug counts can be made. And again I pointed out several texts, most from the bibliography of _Code Complete_, which point out the statistical basis on which an

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread ScruLoose
On Mon, Dec 08, 2003 at 03:35:40AM -0800, Tom wrote: On Sun, Dec 07, 2003 at 11:25:33PM -0800, Karsten M. Self wrote: Peace. What the fuck are you ranting about? tone=dripping with sarcasm Ah, there's a surefire way to bolster your credibility. Clearly the mark of a mature mind: As soon

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-08 Thread Johannes Zarl
IIRC, it was a prior nonproductive thread with Tom which pointed out seeding and metrics as a way of estimating such bug counts. Well, at this point I should admit that I tend to ignore threads as they grow longer than one screen, break up more than once, or begin to get sub-threads...

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Tom
On Mon, Dec 08, 2003 at 02:18:55PM -0500, ScruLoose wrote: What the fuck are you ranting about? grin I'm not taking the bait anymore. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread ScruLoose
On Mon, Dec 08, 2003 at 12:37:04PM -0800, Tom wrote: On Mon, Dec 08, 2003 at 02:18:55PM -0500, ScruLoose wrote: What the fuck are you ranting about? Um, no. I did not write this. LEARN. TO. QUOTE. Are you making a deliberate attempt to mis-attribute your inane blather to me, or are you

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-08 Thread Colin Watson
On Thu, Dec 04, 2003 at 11:17:32AM -0700, Dave wrote: That is my assumption. The only thing that would give me confidence that there are no holes would be a common process for connecting raw input to privileged routines -- a process which is so simple that everyone can see it is robust. Such

RE: Debian Server Compromise -- A Fire Drill ??

2003-12-08 Thread Joyce, Matthew
-Original Message- From: ScruLoose [mailto:[EMAIL PROTECTED] Sent: Friday, 5 December 2003 8:58 AM To: [EMAIL PROTECTED] Subject: Re: Debian Server Compromise -- A Fire Drill ?? It's cracker. Not hacker. http://web.bilkent.edu.tr/Online/Jargon30/JARGON_C/CRACKER.HTM It's

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Dec 08, 2003 at 03:35:40AM -0800, Tom wrote: On Sun, Dec 07, 2003 at 11:25:33PM -0800, Karsten M. Self wrote: Peace. What the fuck are you ranting about? Why not search the archives and find out? - -- .''`. Paul Johnson [EMAIL

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Dec 08, 2003 at 05:07:20AM -0800, Tom wrote: I could pay $35 to 1-800-US-SEARCH and really fuck up your day! IANAL, but watch it. You're crossing into threats and harassment territory with that one. - -- .''`. Paul Johnson [EMAIL

Re: Tom Ballard, MSFT shill (was Re: Debian Server Compromise -- A Fire Drill ??)

2003-12-08 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Dec 08, 2003 at 12:37:04PM -0800, Tom wrote: On Mon, Dec 08, 2003 at 02:18:55PM -0500, ScruLoose wrote: What the fuck are you ranting about? grin I'm not taking the bait anymore. But you still missed his point about quoting

Re: apple - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Kevin Mark
On Sat, Dec 06, 2003 at 05:10:36PM -0800, Alvin Oga wrote: On Sun, 7 Dec 2003, csj wrote: Well, we used to own an Apple II that was made in Taiwan and didn't have the Apple logo. Does that qualify as open enough? If it weren't for the Apple II clones eating into Apple's bottomline,

Re: segmented mem - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Paul Morgan
On Sat, 06 Dec 2003 16:54:39 -0800, Alvin Oga wrote: On Sat, 6 Dec 2003, Paul Morgan wrote: IBM did popularize the term PC, but they sure as heck didn't invent the personal computer. And, because they'd bought the rights to the Intel 8086, and because of the sheer economic power and

Re: segmented mem - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread John Hasler
Paul Morgan writes: ...but there was no hardware memory management as you suggest until the 80386. The 80286 had memory management. -- John Hasler [EMAIL PROTECTED] (John Hasler) Dancing Horse Hill Elmwood, WI -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe.

Re: segmented mem - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Paul Morgan
On Sun, 07 Dec 2003 08:15:33 -0600, John Hasler wrote: Paul Morgan writes: ...but there was no hardware memory management as you suggest until the 80386. The 80286 had memory management. Thanks, John, I wasn't sure, I personally skipped the 80286 :) -- paul Don't be

Re: segmented mem - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Alvin Oga
hi ya john/paul On Sun, 7 Dec 2003, Paul Morgan wrote: On Sun, 07 Dec 2003 08:15:33 -0600, John Hasler wrote: Paul Morgan writes: ...but there was no hardware memory management as you suggest until the 80386. The 80286 had memory management. Thanks, John, I wasn't sure, I

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Karsten M. Self
on Thu, Dec 04, 2003 at 06:21:33PM +0100, Johannes Zarl ([EMAIL PROTECTED]) wrote: Content-Description: signed data On Thursday 04 December 2003 17:43, Tom wrote: On Thu, Dec 04, 2003 at 10:15:12AM -0600, John Hasler wrote: ... That's why the kernel developers thought it was just an

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Tom
On Sun, Dec 07, 2003 at 05:31:12PM -0800, Karsten M. Self wrote: IIRC, it was a prior nonproductive thread with Tom which pointed out seeding and metrics as a way of estimating such bug counts. So how many are there? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-07 Thread Tom
On Sun, Dec 07, 2003 at 06:19:45PM -0800, Tom wrote: On Sun, Dec 07, 2003 at 05:31:12PM -0800, Karsten M. Self wrote: IIRC, it was a prior nonproductive thread with Tom which pointed out seeding and metrics as a way of estimating such bug counts. So how many are there? One thing I've

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Dave
On Sat, 06 Dec 2003 03:20:14 +0100, Paul Johnson [EMAIL PROTECTED] wrote: On Thu, Dec 04, 2003 at 04:57:55PM -0500, ScruLoose wrote: It's cracker. Not hacker. http://web.bilkent.edu.tr/Online/Jargon30/JARGON_C/CRACKER.HTML This is a *very* outdated mirror of The Jargon File, please kick the

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Richard Kimber
On Fri, 05 Dec 2003 17:52:21 -0500 Paul Morgan [EMAIL PROTECTED] wrote: On Fri, 05 Dec 2003 16:26:07 -0600, John Hasler wrote: I wrote: And then there is morality. I know you won't believe this, but almost all corporate executives consider themselves moral law-abiding citizens.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread bob parker
On Sat, 6 Dec 2003 09:12, Tom wrote: On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does not mean they are immoral. Microsoft played the exact same role in its origins v. IBM as Linux is

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Tom
On Sun, Dec 07, 2003 at 03:49:12AM +1100, bob parker wrote: On Sat, 6 Dec 2003 09:12, Tom wrote: Microsoft played the exact same role in its origins v. IBM as Linux is now playing to Microsoft; the upstart, force for freedom. The PC was a freedom revolution against the glass house.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Paul Morgan
On Sun, 07 Dec 2003 03:49:12 +1100, bob parker wrote: On Sat, 6 Dec 2003 09:12, Tom wrote: On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does not mean they are immoral. Microsoft played

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread John Hasler
Paul Morgan writes: And, because they'd bought the rights to the Intel 8086... Where did you dredge that non-fact up from? -- John Hasler [EMAIL PROTECTED] Dancing Horse Hill Elmwood, Wisconsin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread bob parker
On Sun, 7 Dec 2003 05:17, Paul Morgan wrote: On Sun, 07 Dec 2003 03:49:12 +1100, bob parker wrote: On Sat, 6 Dec 2003 09:12, Tom wrote: On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread csj
On 7. December 2003 at 6:31AM +1100, bob parker [EMAIL PROTECTED] wrote: On Sun, 7 Dec 2003 05:17, Paul Morgan wrote: [...] Ever heard of the Altair? Or the Apple I and II, the TRS-80 or Commodore Pet? Sure but they are not PCs and as brilliant as they were in their day, they were

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Paul Morgan
On Sun, 07 Dec 2003 06:31:42 +1100, bob parker wrote: On Sun, 7 Dec 2003 05:17, Paul Morgan wrote: On Sun, 07 Dec 2003 03:49:12 +1100, bob parker wrote: On Sat, 6 Dec 2003 09:12, Tom wrote: On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill

PC - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Alvin Oga
On Sun, 7 Dec 2003, bob parker wrote: On Sat, 6 Dec 2003 09:12, Tom wrote: On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does not mean they are immoral. Microsoft played the exact

segmented mem - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Alvin Oga
On Sat, 6 Dec 2003, Paul Morgan wrote: IBM did popularize the term PC, but they sure as heck didn't invent the personal computer. And, because they'd bought the rights to the Intel 8086, and because of the sheer economic power and brand recognition of IBM, we all got stuck with the

Re: PC - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread John Hasler
Alvin writes: IBM made is official that its okay to use in an office environment to replace the selectric typewriter Nope. That was Wang et al. with their word processors. -- John Hasler [EMAIL PROTECTED] Dancing Horse Hill Elmwood, Wisconsin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED]

apple - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Alvin Oga
On Sun, 7 Dec 2003, csj wrote: Well, we used to own an Apple II that was made in Taiwan and didn't have the Apple logo. Does that qualify as open enough? If it weren't for the Apple II clones eating into Apple's bottomline, Steve Jobs wouldn't have bothered inventing the Mac. apple doesnt

Re: PC - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-06 Thread Alvin Oga
On Sat, 6 Dec 2003, John Hasler wrote: Alvin writes: IBM made is official that its okay to use in an office environment to replace the selectric typewriter Nope. That was Wang et al. with their word processors. yes.. wang was out there too, along with olivetti and few other typewriter

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Alvin Oga
On Thu, 4 Dec 2003, Dave wrote: On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock [EMAIL PROTECTED] wrote: [...] There is also the point that *somebody* found this bug. Just not the folks we were hoping would. ;-) Letting real crackers hammer your system is another way to find bugs,

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread John Hasler
Dave writes: He or she had intimate knowledge of the various Debian servers. I see no evidence that the cracker had anything other than public information. And no damage was done. You don't consider the downtime and wasted labor damage? Do you think he could have had the same impact by

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Benedict Verheyen
John Hasler wrote: Do you think he could have had the same impact by merely announcing that he *could* break into a system if he wanted? Privately delivering the exploit to the appropriate people would have gotten the bug fixed at least as quickly. Are there people out there that really do

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread John Hasler
I wrote: Privately delivering the exploit to the appropriate people would have gotten the bug fixed at least as quickly. Benedict writes: Are there people out there that really do this? I mean, try to break in and post this to the people that can fix it? Who said anything about trying to

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Dave
On Fri, 05 Dec 2003 15:50:13 +0100, John Hasler [EMAIL PROTECTED] wrote: Dave writes: He or she had intimate knowledge of the various Debian servers. I see no evidence that the cracker had anything other than public information. I'm guessing, based on the timeline ( hours, not days ) and other

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread John Hasler
Dave writes: I'm guessing, based on the timeline ( hours, not days ) and other info in the report. Seems like an outsider, having only a password, would have to spend an awful lot of time poking around to find the right machines and directories. Most of that information is publically

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Benedict Verheyen
- Original Message - From: John Hasler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, December 05, 2003 5:33 PM Subject: Re: Debian Server Compromise -- A Fire Drill ?? I wrote: Privately delivering the exploit to the appropriate people would have gotten the bug fixed

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Paul Morgan
On Thu, 04 Dec 2003 20:13:20 -0600, John Hasler wrote: And then there is morality. I know you won't believe this, but almost all corporate executives consider themselves moral law-abiding citizens. Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Tom
On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does not mean they are immoral. Microsoft played the exact same role in its origins v. IBM as Linux is now playing to Microsoft; the upstart,

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread John Hasler
I wrote: And then there is morality. I know you won't believe this, but almost all corporate executives consider themselves moral law-abiding citizens. Paul Morgan writes: Good point. And just because Bill Gates et. al have become hard-nosed businessmen, it does not mean they are immoral.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Paul Morgan
On Fri, 05 Dec 2003 16:26:07 -0600, John Hasler wrote: I wrote: And then there is morality. I know you won't believe this, but almost all corporate executives consider themselves moral law-abiding citizens. Paul Morgan writes: Good point. And just because Bill Gates et. al have become

blackhats - Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Alvin Oga
On Fri, 5 Dec 2003, Benedict Verheyen wrote: Benedict writes: Are there people out there that really do this? I mean, try to break in and post this to the people that can fix it? blackhats whitehats grayhats defcon phrack ... - millions of script kiddies ... - they will try

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, Dec 04, 2003 at 04:57:55PM -0500, ScruLoose wrote: It's cracker. Not hacker. http://web.bilkent.edu.tr/Online/Jargon30/JARGON_C/CRACKER.HTML This is a *very* outdated mirror of The Jargon File, please kick the maintainer into updating.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Dec 05, 2003 at 04:32:47PM -0500, Paul Morgan wrote: Personally, I think that the best test of Gates' character is that the highly moral Warren Buffet chooses him as a friend. Well, in every circle of friends, there's the relatively amoral

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-05 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Dec 05, 2003 at 08:30:11AM -0600, John Hasler wrote: Dave writes: He or she had intimate knowledge of the various Debian servers. I see no evidence that the cracker had anything other than public information. Wait...Debian Developer

Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Dave
Whoever broke into the Debian servers did us a big favor by raising awareness without causing any serious damage. Seems like the critical link to be fixed is the vulnerability of daemons that run with root privilege and receive input from users. The other links in the chain are inherently

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Isaac To
Dave == Dave [EMAIL PROTECTED] writes: Dave Seems like the critical link to be fixed is the vulnerability of Dave daemons that run with root privilege and receive input from users. No. The kernel itself has bug. The user (attacker) is running *perfectly legitimate* system calls

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread John Hasler
Isaac writes: And then, due to the kernel bug, the user can write into arbitrary location in the kernel, do whatever he wants. It's rather more complicated than that. The user reportedly must do some pretty subtle stuff to get root via the brk() bug. That's why the kernel developers thought

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Tom
On Thu, Dec 04, 2003 at 10:15:12AM -0600, John Hasler wrote: ... That's why the kernel developers thought it was just an ordinary bug: they could see no way to exploit it. That statement is somewhat disconcerting. The hypothesis is that many eyes detect secure bugs, and here is clear case

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Johannes Zarl
On Thursday 04 December 2003 17:43, Tom wrote: On Thu, Dec 04, 2003 at 10:15:12AM -0600, John Hasler wrote: ... That's why the kernel developers thought it was just an ordinary bug: they could see no way to exploit it. That statement is somewhat disconcerting. The hypothesis is that

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Dave
On Thu, 04 Dec 2003 15:30:31 +0100, Isaac To [EMAIL PROTECTED] wrote: Dave == Dave [EMAIL PROTECTED] writes: Dave Seems like the critical link to be fixed is the vulnerability of Dave daemons that run with root privilege and receive input from users. No. The kernel itself has bug.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Dave
On Thu, 04 Dec 2003 18:00:18 +0100, Tom [EMAIL PROTECTED] wrote: On Thu, Dec 04, 2003 at 10:15:12AM -0600, John Hasler wrote: ... That's why the kernel developers thought it was just an ordinary bug: they could see no way to exploit it. That statement is somewhat disconcerting. The

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Terry Hancock
On Thursday 04 December 2003 12:17 pm, Dave wrote: On Thu, 04 Dec 2003 18:00:18 +0100, Tom [EMAIL PROTECTED] wrote: On Thu, Dec 04, 2003 at 10:15:12AM -0600, John Hasler wrote: ... That's why the kernel developers thought it was just an ordinary bug: they could see no way to exploit

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Joey Hess
Dave wrote: User: CallService DestroyFileSystem victim's partition OS: Sorry, no such service. User: CallService 227 OS: Sorry, no such service. User: CallService 226 226 OpenForWrite victim's filename Sorry, you don't have permission to write to someone else's files. 226 PokeMemory

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Dave
On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock [EMAIL PROTECTED] wrote: [...] There is also the point that *somebody* found this bug. Just not the folks we were hoping would. ;-) Letting real crackers hammer your system is another way to find bugs, although we hope it's a last resort. You

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread ScruLoose
On Thu, Dec 04, 2003 at 01:50:35PM -0700, Dave wrote: On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock [EMAIL PROTECTED] wrote: [...] There is also the point that *somebody* found this bug. Just not the folks we were hoping would. ;-) Letting real crackers hammer your system is another

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread ben_foley
On Thu, Dec 04, 2003 at 04:57:55PM -0500, ScruLoose wrote: On Thu, Dec 04, 2003 at 01:50:35PM -0700, Dave wrote: On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock [EMAIL PROTECTED] wrote: [...] There is also the point that *somebody* found this bug. Just not the folks we were hoping

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Tom
On Fri, Dec 05, 2003 at 12:48:58AM +, [EMAIL PROTECTED] wrote: given the regular stream of ridiculous garbage coming from redmond about linux, while new holes are found in their os and apps on an almost weekly basis, this seems like the next stage in the campaign to buttress the losses

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread John Hasler
ben writes: there's got to be a reason why no calling card was left, i.e., the caller has a vested interest in not claiming credit, which would tend to suggest a contract job. No. It merely suggests that they didn't finish the job. The calling-card would have been left in the archive had

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Thanasis Kinias
scripsit Monique Y. Herman: I find this to be unlikely. I mean, look at the risk vs. reward. Reward: they cause a very temporary disruption to some trusted sources and cause some folks to maybe worry about how secure linux might be. Risk: getting caught funding black hats against the

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread ben_foley
On Thu, Dec 04, 2003 at 04:04:26PM -0800, Tom wrote: almost five years, since i first came across debian. i have no reason not to trust them now. I like them too but faith like that is just made to be broken. well, i am hoping for eventual disclosure, but willing to understand obvious

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread David Palmer.
On Fri, 5 Dec 2003 00:48:58 + [EMAIL PROTECTED] wrote: On Thu, Dec 04, 2003 at 04:57:55PM -0500, ScruLoose wrote: On Thu, Dec 04, 2003 at 01:50:35PM -0700, Dave wrote: On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock [EMAIL PROTECTED] wrote: who benefits from the publicity

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread Isaac To
Dave == Dave [EMAIL PROTECTED] writes: Dave So how many daemons and kernel routines need both root access and Dave input from a user process? Remember that *all* kernel routines are running in kernel-mode of the processor, i.e., having even higher permission than a normal root process.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread ben_foley
On Thu, Dec 04, 2003 at 05:59:34PM -0700, Thanasis Kinias wrote: scripsit Monique Y. Herman: I find this to be unlikely. I mean, look at the risk vs. reward. Reward: they cause a very temporary disruption to some trusted sources and cause some folks to maybe worry about how secure

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread John Hasler
Thanasis Kinias writes: If Foo Corp. wanted to do this, they really wouldn't have anything to fear from the law... Little maybe, but not nothing. And risking the shareholder's (or even your own) money is one thing. Risking prison is quite another. Their biggest risk would be a

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread John Hasler
ben writes: well, i am hoping for eventual disclosure, but willing to understand obvious security priorities. Disclosure of _what_? -- John Hasler [EMAIL PROTECTED] (John Hasler) Dancing Horse Hill Elmwood, WI -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe.

Re: Debian Server Compromise -- A Fire Drill ??

2003-12-04 Thread ScruLoose
On Thu, Dec 04, 2003 at 05:07:59PM -0700, Monique Y. Herman wrote: On Fri, 05 Dec 2003 at 00:48 GMT, [EMAIL PROTECTED] penned: given the regular stream of ridiculous garbage coming from redmond about linux, while new holes are found in their os and apps on an almost weekly basis, this