Re: [NANOG] IOS rootkits

[n3td3v <xploitable () gmail com>]

On Sat, May 17, 2008 at 9:39 PM, n3td3v <xploitable () gmail com> wrote:
> On Sat, May 17, 2008 at 7:38 PM, n3td3v <xploitable () gmail com> wrote:
> > ---------- Forwarded message ----------
> > From: n3td3v <xploitable () gmail com>
> > Date: Sat, May 17, 2008 at 12:08 PM
> > Subject: Re: [NANOG] IOS rootkits
> > To: nanog () merit edu
> >
> >
> > On Sat, May 17, 2008 at 11:12 AM, Suresh Ramasubramanian
> > <ops.lists () gmail com> wrote:
> > > On Sat, May 17, 2008 at 12:47 PM, Matthew Moyle-Croft
> > > <mmc () internode com au> wrote:
> > > > If the way of running this isn't out in the wild and it's actually
> > > > dangerous then a pox on anyone who releases it, especially to gain
> > > > publicity at the expensive of network operators sleep and well being.
> > > > May you never find a reliable route ever again.
> > >
> > > This needs fixing. It doesnt need publicity at security conferences
> > > till after cisco gets presented this stuff first and asked to release
> > > an emergency patch.
> >
> > Agreed,
> >
> > You've got to remember though that a security conference is a
> > commercial venture, it makes business sense for this to be publically
> > announced at this security conference.
> >
> > I think security conferences have become something that sucks as its
> > all become money making oriented and the people who run these things
> > don't really have security in mind, just the £ signs reflecting on
> > their eye balls.
> >
> > > --srs
> > > --
> > > Suresh Ramasubramanian (ops.lists () gmail com)
> >
> > All the best,
> >
> > n3td3v
>
> Full-Disclosure,
>
> I fully believe British Intelligence are the best in the world and
> that they will pull the plug on this presentation without hesitation
> before it gets to go ahead.
>
> I don't see anyone disagreeing how wrong it is for this presentation
> to go ahead as a business decision.
>
> I know the national security boys at MI5 are listening, so I suggest
> this gets priority and this presentation doesn't go ahead.
>
> What I want is a high profile pulling the plug of this presentation to
> act as a deterrent to any other security conferences across the world
> who think they are going to capitalise through high risk
> vulnerabilities as this one is.
>
> I want UK government officials to walk on stage as this presnetation
> is about to start, infront of the media, infront of everybody,
> including the money makers who thought they were going to use this
> presentation as a way to sell tickets and make money and put UK
> national security at risk.
>
> I don't want a behind the scenes pulling the plug of this
> presentation, I want it to be high profile, infront of the worlds
> media to show that in Britian we don't fuck about with crappy security
> conferences trying to become rich by getting high risk talkers to come
> to their security conference to guarantee a sell out and thousands of
> pounds made, at a cost to UK national security.
>
> I will be talking with my private contacts to try and get this to
> happen, as many of you know I already had a grudge with EUSecWest
> spamming the mailing lists, instead of buying advertisement banners on
> websites, so the announcement of a IOS rootkit presentation is the
> final insult to injury, and the UK national security boys are likely
> to pull the plug on this without hesitation to make an example to
> these security conference owners to say that national security becomes
> before profit and how dare you try to profit and not giving a shit
> about the consequences of this presentation.
>
> Trust me and mark my words EUSecWest, you upset a lot of people
> spamming the mailing lists, this is just the worst possible thing you
> could have done to keep people on side, you've lost any respect I may
> have had for your conference and I guarantee UK government officials
> will pull the plug on your business venture of a security conference.
>
> Blackhat conference with Michael Lynn was under the control of the
> American authorities and they were light weight in response to what
> was going on, trust me, the British authorities will be coming down a
> lot tougher and won't be thinking twice about pulling this
> presentation, but will do it on a grand scale infront of the media, to
> send a clear signal that these security conferences and their money
> making agenda isn't going to get in the way of our national security.
>
> This is a subject I feel strongly and passionate about because if this
> presentation went ahead it would fuck up a lot of ISPs and would put
> national security at risk.
>
> If the British authorites don't pull the plug on this presentation you
> will have let your country down and let your British taxpayers down
> who fund MI5 in the first place.
>
> And its not just me saying this, ISPs are calling for this
> presentation to be pulled as well.
>
> All the best,
>
> n3td3v


---------- Forwarded message ----------
From: Dragos Ruiu <dr () kyx net>
Date: Sun, May 18, 2008 at 2:57 PM
Subject: Re: [NANOG] IOS rootkits
To: Suresh Ramasubramanian <ops.lists () gmail com>
Cc: ivan.arce () coresecurity com, topo () coresecurity com,
fx () recurity-labs com, nanog () merit edu



On 17-May-08, at 3:12 AM, Suresh Ramasubramanian wrote:

> On Sat, May 17, 2008 at 12:47 PM, Matthew Moyle-Croft
> <mmc () internode com au> wrote:
> > If the way of running this isn't out in the wild and it's actually
> > dangerous then a pox on anyone who releases it, especially to gain
> > publicity at the expensive of network operators sleep and well being.
> > May you never find a reliable route ever again.
>
> This needs fixing. It doesnt need publicity at security conferences
> till after cisco gets presented this stuff first and asked to release
> an emergency patch.

Bullshit.

There is nothing to patch.

It needs to be presented at conferences, exactly because people will
play ostrich and stick their heads in the sand and pretend it can't
happen to them, and do nothing about it until someone shows them, "yes
it can happen" and here is how....

Which is exactly why we've accepted this talk. We've all known this is
a possibility for years, but I haven't seen significant motion forward
on this until we announced this talk. So in a fashion, this has
already helped make people more realistic about their infrastructure
devices. And the discussions, and idea interchange that will happen
between the smart folks at the conference will undoubtedly usher forth
other related issues and creative solutions.  Problems don't get fixed
until you talk about them.

cheers,
--dr

--
World Security Pros. Cutting Edge Training, Tools, and Techniques
London, U.K.   May 21/22 - 2008    http://cansecwest.com
pgpkey http://dragos.com/ kyxpgp

Shut up you fucking fag, you just want this presentation given so you
can sell more tickets and become rich you complete dick head, you
don't care about "related issues and creative solutions" all you care
about is people buying a £1100 ticket to line your pocket with to go
sit on a yacht for the rest of the year, and to hell with national
security or the consequences.

What you've done is very clever, you're exploiting the security scene
to become a rich fat bastard, and you've researched the facts into
"idea interchange that will happen between the smart folks at the
conference will undoubtedly usher forth
other related issues and creative solutions.  Problems don't get fixed
until you talk about them." to defend your money making scheming endeavors.

I wouldn't say this presentation is blackmail, but its as close to
blackmail as you're gonna get without breaking the law.

You are one son of a bitch, who I don't respect for making money while
our national security suffers.

By the way i'm pretty confident the British authorities are pulling
the presentation, so have that cake and eat it mother fucker.

I'm sorry for the bad language but this is just frustrating at how
stupid you are just so you can become a rich man.

All the best,

n3td3v

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/