On Wed, 16 Jan 2008 20:41:21 CST, reepex said: > woah paul are you talking about stuff you do not know about again? [1] You > like to butt in on conversations. and how do you that this virus has been > put in virustotal, maybe it is new? Most people with decent RE skill ( > unlike you and gadi ), It might come as quite the shock to you in your sheltered corner of the security community, but many of us have jobs and roles in the community that don't directly involve either creating exploits or doing RE. For instance, I will cheerfully admit that I suck at writing exploits, and I'm not the world expert on RE. On the other hand, that's OK, because that's not my job. My job is to answer questions like "What is our exposure if somebody has an exploit for bug #19345" and "What can we do to minimize the damage if somebody in the VP's office gets hit with the FooBar trojan?" and other similar "How do we keep our 30,000 users out of trouble?" questions. And to answer those sorts of questions doesn't take a lot of writing/RE knowledge, but it *does* require understanding things like "escalating privilege" (if attacker has X, can they get to Y?), auditing (how do we know if an attacker did or didn't get Y), deployment issues (how do you get 30,000 users to patch against something, when you don't have administrative control over their boxes), and social engineering (what you resort to when you can't find other ways to get the users to patch :) and social engineering.
Attachment:
pgpYfrk157cj6.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/