Re: [Full-Disclosure] Name One Web Site Compromised by Download.Ject?

["Morning Wood" <se_cur_ity@xxxxxxxxxxx>]

> Legal liability question:  Has anyone contacted an attorney yet about
> damage done by either of these two possibly negligent actions

are you serious? this "hunt" is laughable. Why is this any different than 
anything else?
This is not the first time sites have been hacked to include exploits on the 
mainpage that
leveraged Internet Explorer atacks. ( hint: persistant XSS ).
The problem is UNPATCHED BROWSERS period.
They could have just as well compromised HP 4550 printers and embeded a 
malicious
script that contained the same IE bug.
( see 
http://www.securityfocus.com/archive/1/330310/2003-07-18/2003-07-24/0 )

The THOUSANDS of defacements that occur everyday could also do the same..
( see http://zone-h.org/en/defacements ) .

IIS servers just happened to be the target of choice.
It could have been phpNuke portals, Apachee etc.
The media its trying to make this into some sofisticated criminal attack, 
which it isnt.
HYPE HYPE HYPE

This is pure bullsh*t...  hunt / seek / litigate / sue / processecute.
FACT: It is the websites fault they got hacked via UNPATCHED SERVERS,
and the end users that have UNPATCHED BROWSERS.
Why is everone wanting to pass the buck and not take responsibility for 
maintaining current
patch levels? The USA is so f*cking co-dependant and blaming ( look at any 
daytime talk show )
this has gotten INSANE.

Be responsible for your own actions.
If you go into the water... you should know how to swim.
If you go into the net... you should know how to patch

As a side note, I would like to know if using a exploit on a non passworded 
site ( access restriction )
to obtain / change data is in fact illegal ( in the USA ) , as I recall it 
is a violation to bypass
an ACCESS CONTROL DEVCE. If no access control is present is there a 
violation of a law?

my 2bits

m.wood

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html