I can't help but comment that makeing it easier for "script kiddies" and other low level crackers to get in to stupidly vulnerable sites is a service. They are much more likly to do something that will get them caught or at least make it obvious that the site was cracked. If you leave the easy prey for the top level bot masters, the total damage is much higher.

Having said that, I would love to see an open source, volunteer effort to expose and notify responsible parties of these vulnerable sites. I regularly report spam to abuse addresses via spamcop and port probes to dshield, but there is no good system for reporting source of emailed virii and security problems.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/224/33415#33415