Re: [NANOG] IOS rootkits

[n3td3v <xploitable () gmail com>]

On Tue, May 20, 2008 at 11:53 PM, Dr. J Swift <fdiscsplat () gmail com> wrote:
> Mr. Wallace,
>
> In your rush to reply, you failed to actually respond to my post.
>
> Again, you use the technique of "Supressed Evidence" to forcefully
> reply while not actually responding to the point that was made.
>
> On Tue, May 20, 2008 at 6:31 PM, n3td3v <xploitable () gmail com> wrote:
> > On Tue, May 20, 2008 at 11:25 PM, Dr. J Swift <fdiscsplat () gmail com> wrote:
> > > Mr. Wallace,
> > >
> > > 1.  HD Moore long ago released a kit that could be used to rootkit
> > > Cisco boxes.  This is an obvious statement of fact.
> > > 2.  In-the-wild Cisco rootkits have been known to non-eponymous
> > > security researchers for a considerable time.
> > > 3.  You have said that HD More is a global threat.
> > > 4.  You have repeatedly defamed/slandered/libeled HD Moore among a
> > > global community of peers and coworkers.
> > >
> > > I am providing this opportunity for you to show a correlation between
> > > the current existence of rootkits for Cisco systems and the current
> > > existence of tools from HD Moore.
> >
> >
> > So can you guarantee the HD Moore's of the world won't work out how to
> > do Cisco rootkits after the EUSecWest presentation and won't release a
> > tool to the mailing lists?
> No guarantee is required.  Rootkits and tools already exist.

If you can't guarantee it, then the presentation shouldn't go ahead.

> > You are delusional if you think this presentation won't lead to
> > someone releasing a tool to the script kids, the presentation can't go
> > ahead.
> 1.  It is obvious to security researchers, Mr. Wallace, that a number
> of such tools already exist.
> 2.  There exist a number of Cisco rootkits that are known to security
> researchers.
> Mr. Wallace, I am sure that you are thoroughly versed in these things
> because of your standing in the security community and your
> affiliation with Global Intelligence Services.  So, why do you
> repeatedly cast aspersions on HD Moore?

Because in my opinion it is highly skilled people like HD Moore who
would release a tool for Cisco rootkits after watching or reading the
presentation.

All the best,

n3td3v

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/