http://www.osvdb.org/blog/?p=70 December 6th, 2005 Just over ten years ago (95-09-15) *Hobbit* wrote a little tool called netcat (aka nc), swiftly dubbed the "TCP/IP Swiss Army knife". *Hobbit* was affiliated with the l0pht, which was later purchased by @stake, which was later purchased by Symantec. At some point (circa 1998), Weld Pond ported the netcat utility to Windows. Weld was an original member of the l0pht and later the Director of Research and Development with @stake. Weld's version was distributed at @stake for some time. Suffice it to say, the l0pht, @stake and its members/employees supported netcat's use and distribution. Jump forward to today, and Symantec now classifies netcat on a system as a High Risk Impact. As aj reznor asked, "is that to say that SYM bought a company known then for offering naughty things?" Let us also remember that Symantec owns SecurityFocus which conveniently offers the tool in their tool repository. Also amusing are Symantec's "technical details" for this "hacker tool": Hacktool.NetCat arrives as a tool commonly carried by malicious components and dropped on the compromised computer for remote exploitation. When Hacktool.NetCat is executed, it performs the following actions: 1. Transmits data across network connections. Yes, there is no number two on the list. Hopefully Symantec will have the foresight to classify TCP/IP stacks as "Hacktool.TCPIP" and label it a "High Risk Impact" if found on a system. _________________________________________ Earn your Master's degree in Information Security ONLINE www.msia.norwich.edu/csi Study IA management practices and the latest infosec issues. Norwich University is an NSA Center of Excellence.
This archive was generated by hypermail 2.1.3 : Tue Dec 06 2005 - 23:12:59 PST