This is suprising. Don't download stuff! Why O'Keef would do more than access the system for proof is beyond me. Even that is a stretch and lands in that gray area of 'I am showing proof-of-concept'. In any event, this sort of thing always seems to play against the legitimate professional in court case after case when they seek to hold a product vendor or other entity to be responsible about the systems they run. Tact dictates that one do it through channels. Barring that failure, public disclosure does seem to be the only method to get the entity to do something about their irresponsible system management. Of course, this is not a new debate...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/7098/22718#22718