On Tue, 14 Dec 2004 15:44:41 PST, n30 said: > Guys, > > Looking for few interesting security breach stories... > > Any database / sites that capture these??
Well, there's a problem - where do you get the stories? The black hats probably won't be sharing their version of the stories (at least until the statute of limitations expires ;). The white hats may be unable to share their version - or at least not in a worldwide public forum. As a result, they become things that get told over a pitcher of Guinness and a "You never heard this from me" disclaimer. A story that was interesting when I heard it in "When I was doing a pen test for <named the guilty large finacial institution>, we found a <description of totally stupid self-inflicted vulnerability>" becomes a lot less interesting when I tell it as "Somebody I know was doing a pen test and..." And since people are going to ask :) The guy was doing a pen test for one of the larger banks in NYC, and right at the start he was being watched by the VP-level guy who had hired him. So my friend is doing commentary as he's trying stuff, for the VP's benefit, and the *very first* thing comes out as "Well, we like to check this one first because it was popular years and years ago, but it *never* works anymore. It's a good test of the logging and alert system though, because somebody should notice that it got tried and.. umm.. HOLY <BLEEP> IT WORKED"... See? Somehow it loses something that way.. ;)
pgpJ8n2KZGoCo.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
