Legal liability question: Has anyone contacted an attorney yet about
damage done by either of these two possibly negligent actions
are you serious? this "hunt" is laughable. Why is this any different than
anything else?
This is not the first time sites have been hacked to include exploits on the
mainpage that
leveraged Internet Explorer atacks. ( hint: persistant XSS ).
The problem is UNPATCHED BROWSERS period.
They could have just as well compromised HP 4550 printers and embeded a
malicious
script that contained the same IE bug.
( see
http://www.securityfocus.com/archive/1/330310/2003-07-18/2003-07-24/0 )
The THOUSANDS of defacements that occur everyday could also do the same..
( see http://zone-h.org/en/defacements ) .
IIS servers just happened to be the target of choice.
It could have been phpNuke portals, Apachee etc.
The media its trying to make this into some sofisticated criminal attack,
which it isnt.
HYPE HYPE HYPE
This is pure bullsh*t... hunt / seek / litigate / sue / processecute.
FACT: It is the websites fault they got hacked via UNPATCHED SERVERS,
and the end users that have UNPATCHED BROWSERS.
Why is everone wanting to pass the buck and not take responsibility for
maintaining current
patch levels? The USA is so f*cking co-dependant and blaming ( look at any
daytime talk show )
this has gotten INSANE.
Be responsible for your own actions.
If you go into the water... you should know how to swim.
If you go into the net... you should know how to patch
As a side note, I would like to know if using a exploit on a non passworded
site ( access restriction )
to obtain / change data is in fact illegal ( in the USA ) , as I recall it
is a violation to bypass
an ACCESS CONTROL DEVCE. If no access control is present is there a
violation of a law?
my 2bits
m.wood
