41–50 of 202 posts
"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system..." I guess whenever I read this kind of statement from now on I'll be thinking of HBGary and chuckling a bit inside.
At the risk of that comment being taken as a joke, I've done a lot of work with the federal government, and I can assure you that while the level of hilarity that HBGary has generated, the typical level of talent in government cleared individuals is not necessarily great. I don't mean to impune the capabilities of the people involved (I don't know who they are,) and it isn't to say that you can't find some AMAZING ta…
Fast-forward to the class, and we're sitting there running tools like BackOrifice that exploit vulnerabilities that had been patched for years, and learning that a SYN flood is "a malicious attack". That's it, just "a malicious attack". When I asked about the difference between a SYN flood and a Christmas tree attack, I got a blank stare and "they're both malicious attacks".
I spent the rest of the class in the back of the room, reading the Armadillo Book.
Also, I did not once in my brief Navy career get to hack an enemy computer. Hugely disappointing.
The blog post is riddled with the words "luck" and "timing" which brings doubt into my mind that the team can actually take full responsibility for their actions. "aware of the potential security threat " but they left it for the next week, who honestly here would do that? I have also seen comments around the web of migrating to Php Fog because of how they handled the situation. If you are one of these people please…
What does realtime mean in this case? Anyway, this isn't the only option. They could keep a few bare instances of their php stack online and simply run the deploy script instead of the image creation script. That ought to be able to run in under ten seconds I think.
Here's an interesting tweet from one of their developers. http://twitter.com/ReinH/status/50348989366796288 > Your password in the database is SHA512 encrypted, but we're not taking chances. I hope he knows what he's talking about and is just tired from the past few days.
Let's hope they are salted and iterated.
I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…
And here's Elliot's "official statement": http://elliotspeck.com/phpfog.html And for anyone who missed it, here's what Elliot posted in the previous HN discussion about the phpFog breach: http://news.ycombinator.com/item?id=2346161
Earlier quoted context omitted.
Hire the hackers. It's what the CIA would do.
Hiring the hackers is a terrible idea. If they had done it ethically, yes. But do you really want to hire someone who has already displayed highly unethical behavior, and is likely a ticking timebomb? There are plenty of smart, ethical hackers out there.
A good example of this would be how Chris Putnam got hired at Facebook.
http://www.quora.com/How-did-Chris-Putnam-get-hired-at-Faceb...
Earlier quoted context omitted.
At the risk of that comment being taken as a joke, I've done a lot of work with the federal government, and I can assure you that while the level of hilarity that HBGary has generated, the typical level of talent in government cleared individuals is not necessarily great. I don't mean to impune the capabilities of the people involved (I don't know who they are,) and it isn't to say that you can't find some AMAZING ta…
Reminds me of when I was in the Navy and I went to Navy Security and Vulnerabilities Technician school. I was all excited, so I went out and bought a copy of Hackers Exposed and read through the whole thing, learning everything from how to determine what family and version of operating system a computer is running by what ports are open, to how a buffer overflow attack actually works. Fast-forward to the class, and w…
Like I said, it isn't all bad. Two of the best security guys I know work in the government, and one of them was actually ex-Navy. But the hurdle for finding people that can get top secret clearances AND tie their shoes often proves too high to hire anybody, much less somebody qualified.
--------- http://www.fullmalls.com ---------
--------- http://www.fullmalls.com ---------
We can supply all kind jersey with good quality and low price. contact me, let’s talk details.
Delivery time: 5-6days, Shipping Method: EMS
Newest stock list: every 3-5days updated
Air jordan (1-24) shoes $33
UGG BOOT $50
Nike Shox (R4,NZ,OZ,TL1,TL2,TL3) $35
Handbags (Coach ,LV ,Fendi ,D&G) $35
Tshirts (Polo ,ED Hardy,Lacoste) $16
Jean (True Religion,ED Hardy,Coogi) $30
Sunglasses (Oakey,Coach,Gucci,A rmaini) $16
New era cap $15
Bikini (Ed hardy,polo) $25
FREE SHIPPING
--------- http://www.fullmalls.com ---------
--------- http://www.fullmalls.com ---------