Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: KSpynix ::: the Unix version of KSpyware? (Proof Of Concept)
From: bkfsec <bkfsec () sdf lonestar org>
Date: Wed, 11 May 2005 12:39:58 -0400

James Tucker wrote:

Firefox was safe(r) for a time, now exposure has driven it to become a
viable and "timeworthy" market for the spyware and malware
communities. The same will come of operating systems and any other
highly pervasive applications.

Well, yeah, but I still wouldn't be throwing away GNU/Linux just yet on that front. I would argue that it's still entirely possible to build a GNU/Linux system that is more secure than a MS Windows system, relatively speaking. (Note: I am not saying that GNU/Linux doesn't have its share of security issues and I am not saying that one can't create a well-secured Windows server.)

However, that's getting off track. That would be getting into system configuration and design as they relate to vulnerabilities. That's another discussion altogether.

Going back on track, I wouldn't support the creation of packages such as this for any OS. I just don't think it's ethical. Like I said, there's a big difference between a POC and a worm. Coding POCs is just fine, if it's done ethically. Coding worms as an example, however, is where you cross the line from just creating a proof of concept and into turning that proof onto others in order to harm them. Also, I'm not getting into rights here, I'm just talking about the ethics of the situation.

In the case of spyware, no proof of concept was needed because anyone with any knowledge of systems at all could tell you that it could be done.


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]