RE: Limited vs full blown testing

• Previous message: Thompson, Jimi: "RE: Limited vs full blown testing"
• Maybe in reply to: Toby Barrick: "Limited vs full blown testing"
• Next in thread: R. DuFresne: "RE: Limited vs full blown testing"
• Reply: R. DuFresne: "RE: Limited vs full blown testing"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: "'R. DuFresne'" <dufresne@sysinfo.com>, Peter Wood <peterw@firstbase.co.uk>
Date: Thu, 24 Jun 2004 17:06:21 -0500

I believe it depends on how far you want to go with your testing. There has
been some exploits that require a two fold attack. In other words, the DOS
attack in some systems opens up the possibility to gain root by timing it
with a different attack.

But the thing is, a lot of these types of attacks that are currently out are
not published to the public. So its a good chance you will never see them
used against your systems. And this all so brings up the point that, no one
can ever have a completely secure system. As there will always be exploits
available to select individuals that do not publish their work.

In my experience most attacks are from individuals with very little
knowledge as to what they are doing (kiddie scripts).

-----Original Message-----
From: R. DuFresne [mailto:dufresne@sysinfo.com]
Sent: Thursday, June 24, 2004 3:13 PM
To: Peter Wood
Cc: pen-test@securityfocus.com
Subject: Re: Limited vs full blown testing

        [SNIP]

>
> We accept a brief excluding DoS attacks, as most clients just won't
support
> DoS testing. However we include appripriate caveats in our report and
> continue to suggest they do these tests.
>

I'm trying to understand the significance of DDOS testing and importance.
Thing is, if you can spew packets fast enough, or make enough connections
to consume the resources involved, you can take a site/serice down for at
least the duration of the attack, even pipes as large as those of
akami<sp?> were proven to be susceptable in recent days. It's a given
vector of attack that we live with, a risk level we hope to avoid. But,
not something that gives away the insides of the network to thugs and
theives. No root shell and all that, which constitute a real threat, at
least in my mind. Perhaps I'm missing something that has come up in
recent years that redefines DDOS as something that is preventable and a
potential for something other then a blip, however long lasting the
attack, in service?

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart
testing, only testing, and damn good at it too!

• Previous message: Thompson, Jimi: "RE: Limited vs full blown testing"
• Maybe in reply to: Toby Barrick: "Limited vs full blown testing"
• Next in thread: R. DuFresne: "RE: Limited vs full blown testing"
• Reply: R. DuFresne: "RE: Limited vs full blown testing"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]