Security Basics mailing list archives
FW: SMS Banking
From: "Craig S. Wright" <craig.wright () Information-Defense com>
Date: Wed, 10 Feb 2010 14:46:52 +1100
I have a simple answer to this. Forget the debate, rhetoric is not a scientific method of determining truth. "Thor" wants a challenge, let's have one - a real one and not one based on verbalisations, abuse and unfounded assertions. I suggest two components; 1 A selection of software products are tested using both processes, that is I use a model for the risk of these products, and "Thor" can make up whatever guesses he wishes. We model (or "Thor" guesses, pulls from a hat...) the vulnerabilities over a time period. The number of bugs in software as well as the risk are to be presented as a monthly estimate. 2 We model a few systems (say 50). We can use Honeypots (real systems set to log all activity without interference) run by an independent party to each of us. I use probabilistic models to calculate the risk. "Thor" does whatever he wants. Each of the predictions is published by all parties. The one who is most accurate wins. Fairly simple? I will even give a handicap to "Thor", I will offer to predict within a 95% confidence interval and that for me to win, at least 90 of the 100 software products and 45 of the 50 systems have to lie within my predicted range that I calculate and release. "Thor" has to simply guess better than I do no matter how far out he is. I will put up $10,000 Au for my side. Let's see if "Thor" has something real to offer. Regards, ... Dr. Craig S Wright GSE-Malware, GSE-Compliance, LLM, & ... Information Defense Pty Ltd _____________________________________________ From: Valdis.Kletnieks () vt edu [mailto:Valdis.Kletnieks () vt edu] Sent: Wednesday, 10 February 2010 7:03 AM To: Thor (Hammer of God) Cc: pen-test () securityfocus com; full-disclosure; craig.wright () Information-Defense com Subject: Re: [Full-disclosure] SMS Banking * PGP Signed by an unknown key On Tue, 09 Feb 2010 17:39:39 GMT, "Thor (Hammer of God)" said:
how about accepting a challenge to an open debate on the subject at
Defcon? "Alright folks just make yourself at home, Have a snow cone and enjoy the show" -- Webb Wilder * Unknown Key * 0xB4D3D7B0 ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- RE: SMS Banking, (continued)
- RE: SMS Banking Thor (Hammer of God) (Feb 05)
- Message not available
- Re: SMS Banking Markus Matiaschek (Feb 05)
- RE: SMS Banking Craig S. Wright (Feb 08)
- RE: SMS Banking Thor (Hammer of God) (Feb 08)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- RE: [Full-disclosure] SMS Banking Craig S. Wright (Feb 10)
- Re: SMS Banking Dennis Li (Feb 08)
- Re: SMS Banking Tim Clewlow (Feb 08)