Re: Re: pnp worm unknown variant - post infectionactions

[Jason Coombs <jasonc () science org>]

Madison, Marc wrote:
> Just heard a key not speech from Jim Christy of the Defense Cyber Crime
> Institute Defense Cyber Crime Center, in which he states over eighty
> percent of the labs cases are related to child porn, not Al Qaeda or
> terrorism but these allegedly sick individuals.  Mr. Christy said the
> lab has compiled hashes of know child porn, they use the hashes to
> perform quick scans of suspected criminals computers in order to
> facilitate a quicker response to the investigating agency in the case.


Right. So, let me walk you through the sequence of events that takes 
place in the real world based on these "quick" searches for hashes of 
known child pornography:

1) You are arrested
2) Your computer is seized
3) A Law Enforcement Agency computer forensics crime lab searches for 
hashes of known child pornography on your hard drives
4) Matches are found
5) A report is authored detailing these findings, and nothing else, so 
that the prosecutor's office and investigating agency gets a "quicker 
response" (translation: improved customer service)
6) The prosecutor goes ahead with the case against you
7) You go to trial
8) At your trial, the proof that you possessed child pornography is 
presented by a duly trained, certified, and highly-credentialed law 
enforcement-associated computer forensic examiner
9) The jury convicts you

What's wrong with this picture? Absolutely nothing if you are interested 
in growing an industry and providing good customer service to your law 
enforcement and prosecuting agency clients.

Who cares that you're guilty until you prove yourself innocent, right?

Maybe that's how it should be in all cases... If law enforcement arrest 
you and the prosecutor prosecutes your case, then these good and 
reputable and honest and trustworthy people must know something that the 
general public doesn't know, and their knowledge must be proof of your 
guilt, right?

Regards,

Jason Coombs
jasonc () science org
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/