Thomas Kristensen Quotes (12 Quotes)

I don't think many software vendors would be willing to run the risk of deliberately placing a back door in their software. The benefits compared to the huge risk of disclosure simply aren't worth it.

Three of the vulnerabilities can launch malicious code that allows an attacker to snoop on users. The other vulnerability is a DOS attack that will only work in a few cases and crash the media player when it tries to open a file.

Why bother writing a virus for Linux and Mac when you can get so many other users by writing one for Windows This is especially true because, for a virus to become serious, it has to find other vulnerable systems, and with Macs, that would be a very limited spread.

We don't have an 'extremely critical' ranking very often. We use the rating sparingly so people will know when the danger is very serious.

Apple has done much better at dealing with issues in the past couple years than it did before.

Since printers are connected to the network, they can be vulnerable. Attackers might use a printer connection to get to other parts of a system, and sometimes it's very easy to get into a company that way.

This is big problem because a very large number of corporations use Lotus Notes. When users receive an e-mail with an attachment, all they have to do is click on the attachment to read it, and their systems are vulnerable to a remote attack.

Because of all the barriers, it just seems like virus writers won't bother unless they see Macs as some kind of new frontier. Even then, few won't want to put in that kind of time and effort.

I think Steve has got some good points on why comparing vulnerability numbers is difficult.

It certainly is a serious threat, but given the amount of information available from Cisco you would think there would only be an extremely limited number of vulnerable systems. Most people should have patches in place before there are any exploits.

Vendors can take months to create patches, and sometimes users grumble about that, ... But the alternative is to have patches that can be circumvented or aren't appropriate for the vulnerability. It's a difficult balance.

While the bug in itself could look like a back door, I find it highly unlikely that it actually is a deliberately placed back door.