<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Malicious Mobile Code Meets Exploit Selling</title>
	<atom:link href="http://www.veracode.com/blog/2010/03/malicious-mobile-code-meets-exploit-selling/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.veracode.com/blog/2010/03/malicious-mobile-code-meets-exploit-selling/</link>
	<description>Application security testing, analysis, and metrics</description>
	<lastBuildDate>Tue, 15 May 2012 22:16:53 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: OscarZ</title>
		<link>http://www.veracode.com/blog/2010/03/malicious-mobile-code-meets-exploit-selling/comment-page-1/#comment-4017</link>
		<dc:creator>OscarZ</dc:creator>
		<pubDate>Thu, 17 Jun 2010 15:01:41 +0000</pubDate>
		<guid isPermaLink="false">http://www.veracode.com/blog/?p=1214#comment-4017</guid>
		<description>&quot;Gonzalez paid Jethro 60$K for the exploit while Jethro had no indication that Gonzalez intended to use the exploit code in any illegitimate way.&quot;

Are you sure about that? Is that what you really think about this case?

I think for security researchers what concerns them is we can be hard to understand, outside the norms of society, and so on. When we see cases go through without what looks like adequate evidence, this can increase paranoia that guys in suits are out to get us... and can make cases where there is no evidence at all.

But, he is a smart guy. He probably had a smart lawyer. Why, then, did he agree to a plea bargain, really?

And you are not a lawyer - nor am I - yet it is easy to see here that this would have been - apparently - a very difficult to prove case that would kick up a big media storm.


Even the investigation kicked up a huge media storm.

Have you looked at the recent edition of Rolling Stone? Jethro is in it, big glossy pictures, partying his head off.


Mobile phones are being exploited and will be exploited, just like cloud based services. (Which, essentially, in a sense, is what the goatse issue really revolves around.)

The value is there. It is advantageous for a gigantic range of potential criminal. Extremely so. Walking gps unit. Personal bugging system. Phone calls tapped at the same time. Email contacts. Conversations. Documents.


It is more interesting then someone&#039;s pc. Far more so in most cases.

Is this something just comp sec researchers understand? Any criminal with half a brain is likely to understand it. There are plenty of smart criminals. And even if they did not, just takes someone they know to bring up the idea.</description>
		<content:encoded><![CDATA[<p>&#8220;Gonzalez paid Jethro 60$K for the exploit while Jethro had no indication that Gonzalez intended to use the exploit code in any illegitimate way.&#8221;</p>
<p>Are you sure about that? Is that what you really think about this case?</p>
<p>I think for security researchers what concerns them is we can be hard to understand, outside the norms of society, and so on. When we see cases go through without what looks like adequate evidence, this can increase paranoia that guys in suits are out to get us&#8230; and can make cases where there is no evidence at all.</p>
<p>But, he is a smart guy. He probably had a smart lawyer. Why, then, did he agree to a plea bargain, really?</p>
<p>And you are not a lawyer &#8211; nor am I &#8211; yet it is easy to see here that this would have been &#8211; apparently &#8211; a very difficult to prove case that would kick up a big media storm.</p>
<p>Even the investigation kicked up a huge media storm.</p>
<p>Have you looked at the recent edition of Rolling Stone? Jethro is in it, big glossy pictures, partying his head off.</p>
<p>Mobile phones are being exploited and will be exploited, just like cloud based services. (Which, essentially, in a sense, is what the goatse issue really revolves around.)</p>
<p>The value is there. It is advantageous for a gigantic range of potential criminal. Extremely so. Walking gps unit. Personal bugging system. Phone calls tapped at the same time. Email contacts. Conversations. Documents.</p>
<p>It is more interesting then someone&#8217;s pc. Far more so in most cases.</p>
<p>Is this something just comp sec researchers understand? Any criminal with half a brain is likely to understand it. There are plenty of smart criminals. And even if they did not, just takes someone they know to bring up the idea.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

