Re: [Full-disclosure] Re: pnp worm unknown variant - post infectionactions

From: Jason Coombs (jasonc_at_science.org)
Date: 08/17/05

  • Next message: Morning Wood: "Re: [Full-disclosure] Re: pnp worm unknown variant - postinfectionactions" 
    Date: Tue, 16 Aug 2005 21:56:11 -1000
To: adityad2005@users.sourceforge.net

    Aditya Deshmukh wrote:
    > suppose we have VNC installed and that is used to take control of the
    > computer and the actions show up as done by the user - would it not be
    > caught by law enforcement ?

    What, you expect them to take an inventory of all of your installed
    software? You think there are "scientific standards" for "computer
    forensic" examinations? Are you expecting law enforcement to also be
    expert infosec gurus and do exhaustive searches through hundreds of
    gigabytes of data looking for the needle in the haystack?

    What about Metasploit, which will gladly inject a RAM-only WinVNC server
    and give complete remote control without "installing" WinVNC anywhere on
    the hard drive?

    If your Windows box gets owned by such a thing, and you end up accused
    of the crimes that the attacker committed while they were in control of
    your box, you can kiss your ass goodbye.

    This is what I'm trying to correct. And I'm not alone, but I am in the
    minority. Your help would be most welcome, but I honestly don't know
    what you can do...

    Just be aware, gather proof that "computer forensics" as it is practiced
    today has very serious flaws, and tell others.

    I predict that we will see a wave of convictions overturned, and
    prisoners released, based on faulty computer forensic evidence, that
    will make wrongful convictions based on faulty DNA evidence seem
    insignificant by comparison.

    Regards,

    Jason Coombs
    jasonc@science.org
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Morning Wood: "Re: [Full-disclosure] Re: pnp worm unknown variant - postinfectionactions"

    Relevant Pages

    • RE: ATI Catalyst Control Center with .NET v2
      ... DOWNLOADING and INSTALLING the Catalyst Control Center" Then I rebooted and ... > in control panel. ... > with the Catalyst Control Panel which was developed using the .NET 1.1 ... > practices prescribe not using an admin account for daily tasks. ...
      (microsoft.public.dotnet.general)
    • Re: Giving an application a window icon in a sensible way
      ... Meaning you won't use version control on "hello, world", but you might ... headaches on the Saffer-Simpson scale. ... dowloading the software, installing it, reading the ... download any type of server software, install it, and do "pretty much ...
      (comp.lang.java.programmer)
    • Re: Bridgeport power knee lift
      ... I'm installing it for the same reasons, just too much work to crank. ... it does not have any feed back velocity control for the selected ... This adapter is machined to fit over the 5/8" shaft where the ...
      (rec.crafts.metalworking)
    • Re: On making mistakes (Re: Why most run Microsoft, not RedHat)
      ... I decided to 'yum ... the flip side of removing too much is installing too ... Building a "stripped down" server off Fedora or RHEL is a PITA ... What is needed is a "recommended" dependency, and a switch to control ...
      (Fedora)
    • Quantcast