The email sent here is informative.
http://seclists.org/fulldisclosure/2009/Jul/0095.htmlIt's informative because it pretends to imply a little information about how imageshack.us was compromised:
> anti-sec:~/pwn# perl img-scan.pl
> Found img1.imageshack.us - lighttpd/1.4.18 - SSH-1.99-OpenSSH_4.5
>
> [snip]
>
> Found img998.imageshack.us - lighttpd/1.4.18 - SSH-1.99-OpenSSH_4.5
> anti-sec:~/pwn# perl mass-pwn.pl
This would lead one to believe that imageshack was scanned, a system with
lighttpd and SSH was found, and it was immediately compromised due to
at least one of those two services.
Similar to the copy and paste from the OpenSSH 0-day rumor.
This is information voluntarily provided by the perpetrator, apparently.
Since this person is interested in "anti-security" and keeping exploit
knowledge secret, why would he let on any information about the compromise,
including which service was involved in his gain of unauthorized access?
Why go to the effort to make out lighttpd or SSH were involved, when
disclosing this goes against his proclaimed agenda?
Because it likely has nothing to do with the compromise, and these guys
enjoy starting rumors and watching the effects spread across the internet?
Hmmm, could be?