mailing list archives
You shady bastards.
From: H D Moore <fdlist () digitaloffense net>
Date: Wed, 6 Jun 2007 08:47:12 -0500
Some friends and I were putting together a contact list for the folks
attending the Defcon conference this year in Las Vegas. My friend sent
out an email, with a large CC list, asking people to respond if they
planned on attending. The email was addressed to quite a few people, with
one of them being David Maynor. Unfortunately, his old SecureWorks
address was used, not his current address with ErrattaSec.
Since one of the messages sent to the group contained a URL to our phone
numbers and names, I got paranoid and decided to determine whether
SecureWorks was still reading email addressed to David Maynor. I sent an
email to David's old SecureWorks address, with a subject line promising
0-day, and a link to a non-public URL on the metasploit.com web server
(via SSL). Twelve hours later, someone from a Comcast cable modem in
Atlanta tried to access the link, and this someone was (confirmed) not
David. SecureWorks is based in Atlanta. All times are CDT.
I sent the following message last night at 7:02pm.
From: H D Moore <hdm[at]metasploit.com>
To: David Maynor <dmaynor[at]secureworks.com>
Subject: Zero-day I promised
Date: Tue, 5 Jun 2007 19:02:11 -0500
Approximately 12 hours later, the following request shows up in my Apache
log file. It looks like someone at SecureWorks is reading email addressed
to David and tried to access the link I sent:
126.96.36.199 - - [05/Jun/2007:19:16:42 -0500] "GET /maynor.tar.gz
HTTP/1.1" 404 211 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en)
AppleWebKit/419 (KHTML, like Gecko) Safari/419.3"
This address resolves to:
The whois information is just the standard Comcast block boilerplate.
Is this illegal? I could see reading email addressed to him being within
the bounds of the law, but it seems like trying to download the "0day"
link crosses the line.
Illegal or not, this is still pretty damned shady.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/