RE: [Full-Disclosure] Sidewinder G2

From: Ron DuFresne (dufresne_at_winternet.com)
Date: 11/20/03

  • Next message: Gadi Evron: "Re: [Full-Disclosure] .hta virus analysys" 
    To: "Brent J. Nordquist" <b-nordquist@bethel.edu>
Date: Thu, 20 Nov 2003 09:39:18 -0600 (CST)

    On Tue, 18 Nov 2003, Brent J. Nordquist wrote:

    > On Tue, 18 Nov 2003, Kruse, Steve <Steve.Kruse@lakelandgov.net> wrote:
    >
    > > Repeated "hacker challenges" by Secure Computing against the Sidewinder
    > > have proven it hasn't been compromised.
    >
    > "Proven" is much too strong a word. See:
    >
    > http://www.schneier.com/crypto-gram-9812.html#contests
    >

    Agreed, these hacking contests are of little if any real value, yet, the
    real question buried in this thread is;

    How secure is the sidewinder?

    Now, not arguing about this acquisition crazy economy, that will get
    reversed once it settles back into something a tad more solid <such as the
    state of it prior to the 2000 elections>, and secure computings
    acqusition./merger with another large vendor in the not to distant past,
    the issue that begs to be addressed in this whole thread is whether or not
    the history of this device stands up to the claims of it's vendor. So,
    then I have to ask here; do you or anyone else know of a security
    incident that compromised the perimiter guarded by one of these
    blackboxen? And I'd direct folks to the sec-focus vuln listings to
    determine how these systems have faired historically say since oh, 1995 or
    so. Now, if that's not enough information for one to base their decisions
    upon, then go ask those that are using these boxen, the firewall wizards
    list will surely find a number of folks with hands-on experience with the
    product, and refering a question about the solidity of these systems
    and/or how secure they are with a 'sendmail agent' running upon/within the
    system might be addressed with some level of knowledge, rather then the
    mass speculation (outright FUD) the majority of this thread has entailed
    thus far.

    Thanks,

    Ron DuFresne
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    "Cutting the space budget really restores my faith in humanity. It
    eliminates dreams, goals, and ideals and lets us get straight to the
    business of hate, debauchery, and self-annihilation." -- Johnny Hart
            ***testing, only testing, and damn good at it too!***

    OK, so you're a Ph.D. Just don't touch anything.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gadi Evron: "Re: [Full-Disclosure] .hta virus analysys"

    Relevant Pages

    • Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3
      ... companies to not adopt Linux as an operating system, because they can't secure their system. ... Credit card companies insuring the software hasn't been modified to skim cards, or Tivo making sure that their content providers are protected. ... "improve" security and must be vendor held and secret for it to work. ...
      (Linux-Kernel)
    • Making Ink Annotations in Word Protected Form (PC Tablets)
      ... I'm demo-ing a Tablet PC to see if our Area Managers can use them to fill ... out forms while onsite visiting a vendor. ... I've developed some secure forms in Word to test with the Tablet PC. ...
      (microsoft.public.word.vba.userforms)
    • What Discoverers need to know about vulnerability reporting
      ... Make a reasonable effort to contact the Vendor of the product for which ... with your vulnerability reports is substantially incomplete. ... When building an e-commerce site, you want to start with a strong, secure ...
      (NT-Bugtraq)
    • SLQ Injection vulnerability in WPCeasy
      ... My first vulnerability report:) ... vendor: http://www.webpagecity.com/wpceasy/wpceasy.asp ... "WPC.easy" is an interactive self maintained web site, ... The web site has a secure, ...
      (Bugtraq)