mailing list archives
Re: KSpynix ::: the Unix version of KSpyware? (Proof Of Concept)
From: bkfsec <bkfsec () sdf lonestar org>
Date: Wed, 11 May 2005 12:39:58 -0400
James Tucker wrote:
Well, yeah, but I still wouldn't be throwing away GNU/Linux just yet on
that front. I would argue that it's still entirely possible to build a
GNU/Linux system that is more secure than a MS Windows system,
relatively speaking. (Note: I am not saying that GNU/Linux doesn't have
its share of security issues and I am not saying that one can't create a
well-secured Windows server.)
Firefox was safe(r) for a time, now exposure has driven it to become a
viable and "timeworthy" market for the spyware and malware
communities. The same will come of operating systems and any other
highly pervasive applications.
However, that's getting off track. That would be getting into system
configuration and design as they relate to vulnerabilities. That's
another discussion altogether.
Going back on track, I wouldn't support the creation of packages such as
this for any OS. I just don't think it's ethical. Like I said, there's
a big difference between a POC and a worm. Coding POCs is just fine, if
it's done ethically. Coding worms as an example, however, is where you
cross the line from just creating a proof of concept and into turning
that proof onto others in order to harm them. Also, I'm not getting
into rights here, I'm just talking about the ethics of the situation.
In the case of spyware, no proof of concept was needed because anyone
with any knowledge of systems at all could tell you that it could be done.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/