From: mike 

On Mon, 26 Mar 2007 08:49:36 -0400, Mike N.  wrote:

>On Mon, 26 Mar 2007 07:58:12 -0400, mike  wrote:
>
>>Still, the proxy problem isn't a critical security issue, Paget and
>>fellow IOActive security expert Dan Kaminsky said. An attack is possible
>>only with access to the target network, not from the Internet, they
>>noted. "The biggest risk inside a corporation would come from a
>>malicious insider," Paget said. "This is not worthy of
mass panic or
>>critical advisories."
>
>   He's downplaying things .. it's relatively easy for intruders to get
>behind the firewall with web- and email- based malware.   Once they set up
>shop inside, they have all they need for this attack.


Let's not forget the USB-sticks-strewn-in-the-parking-lot attack vector...


  /m

--- BBBS/NT v4.01 Flag-5