3 ms·

The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Pr

The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Presumably he isn't clicking on spear-phishing emails and the like. If they physically accessed the machine, e.g. they sent Jason Bourne in to bug his machine, he's probably headed for some trouble at some point. In general that kind of thing isn't done just for the purposes of poking around.

martinced 14y ago
I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here. Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal. Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! But it still begs the question as to how his computer got owned in the first place.
- coldtea 14y ago
  >Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! Is it mediocrity, or is it intended in order to send a message? "We are on to you", etc?
  - sanswork 14y ago
    I'd say imaginary myself. I'm curious what the systems were that were obviously csis systems. He failed to include any logs or information beyond his claims.
    - coldtea 14y ago
      Failed implies he tried. He didn't try. He just told the story. People seem to know the guy. I'm not sure this is "imaginary" at all.
      - sanswork 14y ago
        The problem is you have a person who constantly has more and more amazing stories like this that he pushes everywhere with no proof. Logs or the hostnames or anything is pretty simple proof but require work to make up beyond a story. He put so much effort into detailing it why leave them out? That is why I want to see some sort of proof before I just believe his claims.
PeterisP 14y ago
Remote-ownage exploits do happen, and there is no reasonable defence against them until they are patched. And given the frequency of exploits being found in common user components such as browsers and content (flash/pdf) plugins, an usual well secured computer still is vulnerable to multiple exploits any day of the week. Of course, he doesn't seem 'valuable' enough to spend a fresh 0-day on him alone as the government backdoors (Flame and friends) did with multiple 0-days included; but I'd guess that every large gov't has a standard rootkit and knows a few vulnerabilities not yet disclosed/patched - it's really not that hard/expensive to do, you can just spend a million and buy that stuff from private researchers.

martinced 14y ago

I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here. Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal. Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! But it still begs the question as to how his computer got owned in the first place.

coldtea 14y ago
>Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! Is it mediocrity, or is it intended in order to send a message? "We are on to you", etc?
- sanswork 14y ago
  I'd say imaginary myself. I'm curious what the systems were that were obviously csis systems. He failed to include any logs or information beyond his claims.
  - coldtea 14y ago
    Failed implies he tried. He didn't try. He just told the story. People seem to know the guy. I'm not sure this is "imaginary" at all.
    - sanswork 14y ago
      The problem is you have a person who constantly has more and more amazing stories like this that he pushes everywhere with no proof. Logs or the hostnames or anything is pretty simple proof but require work to make up beyond a story. He put so much effort into detailing it why leave them out? That is why I want to see some sort of proof before I just believe his claims.

PeterisP 14y ago

Remote-ownage exploits do happen, and there is no reasonable defence against them until they are patched. And given the frequency of exploits being found in common user components such as browsers and content (flash/pdf) plugins, an usual well secured computer still is vulnerable to multiple exploits any day of the week. Of course, he doesn't seem 'valuable' enough to spend a fresh 0-day on him alone as the government backdoors (Flame and friends) did with multiple 0-days included; but I'd guess that every large gov't has a standard rootkit and knows a few vulnerabilities not yet disclosed/patched - it's really not that hard/expensive to do, you can just spend a million and buy that stuff from private researchers.