Re: On classifying attacks
> >Using this definition the email example is local and both bind examples
> >are remote.
> .. and any definition that classifies the e-mail example as "local" is
> just broken.
This really depends on the situation. Say I write an exploit that
when run as a user spawns a listening ssh service with root priv. I
get on the system however I do, download this file and exec it. I
think everyone would agree that is a local exploit.
I send that same file as an email attachment to some dolt and peer
pressure him into running it. Just because I downloaded the file by
emailing it to said dolt doesn't change the exploit from local to
remote. It potentially changes it from 'exploit' to trojan, but it is
still being executed locally.
And, I agree with Crispin that the local/remote distinction is a huge
gaping hole in the taxonomy, but rather than not using it I think it
should be added to and improved on.
C