[Full-disclosure] 0day: PDF pwns Windows

[Valdis.Kletnieks at vt.edu]

On Tue, 25 Sep 2007 10:48:22 EDT, "J. Oquendo" said:

> Counterpoint... You're trying to shoot me down with 0day crap:
> 
> You --> 0day attack --> My Infrastructure
> 
> Me --> Botnet --> Your infrastructure
> 
> Never having to consume any resources other than a point and click shoot
> em up attack, I necessarily won't even have to use my own resources. So
> shoot away as your network becomes saturated.

The point you're missing is that in an actual war, more than just infantry and
artillery shooting happens.  Espionage happens, scouting happens, snipers
happen.  And remember that your forward artillery observers are *always*
high-value targets for the opponent, so you want those to be stealthy.

Plus, there's blended attacks - how about using a 0day to drop botnet drones
onto the targeted network, so you DDoS it *from within* (quite interesting
if there's DDoS mitigation hardware on the external face of the network,
but none inside).

I'd fully expect that any cyber-warfare team worth the name would be attacking
with DDoS, 0days, social engineering, and every other tool they can think of.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070925/f0866415/attachment.bin