|Syntactic Confectionery Delight|
Re: Re: Does fatalsToBrowser give too much information to a cracker?by Rhose (Priest)
|on Apr 10, 2002 at 13:57 UTC||Need Help??|
"I'm convinced my source is safe."
Then you really don't even need an exception handler, do you? *Smiles*
The fact that an exception handler is triggered indicates that the software was caused to behave in a way which is not within normal bounds. While I can appreciate your point of view as someone who would like to help me fix the problem, there are just as many (or even more) people who would like to see how they can abuse this new found "feature" to comprimise my system. What you call debugging detail, the others half calls a roadmap.
I bet the developers of the first TCP/IP stacks (with predictable sequence numbers) thought their source was safe... until Kevin Mitnick abused it. I bet the developers of ICMP error messaging never thought it would be used to recon systems. I have to assume that the person on the other side of my system is smarter than me, more clever than me, and would like to comprimise my security.
Update for Juerd
"And exactly how did he abuse TCP/IP?"
The Mitnick attack was based on predicting sequence numbers... this is why most current TCP/IP stacks use non-predictable sequences.