Re: [Full-disclosure] [EMAIL PROTECTED]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://gcc.gnu.org/ml/gcc-help/2006-05/msg00267.html On Sat, 13 Oct 2007 17:44:53 -0400 worried security [EMAIL PROTECTED] wrote: On 10/13/07, Dude VanWinkle [EMAIL PROTECTED] wrote: On 10/13/07, worried security [EMAIL PROTECTED] wrote: On 10/13/07, Richard Golodner [EMAIL PROTECTED] wrote: Why don't you keep this offline between you and full- disclosure? I know Valdis and he does not give a damn about any of this sophomoric stuff. When you post legitimate security information your credibility is increased as well as the amount of respect you receive amongst the security community. Take this as friendly advice and nothing more. You should not threaten to play games as you may not be aware of who is reading this stuff. I know NSA, Interpol and FBI personnel who read this but will never reveal themselves, but you expose yourself to possible investigation by making threats. And that is never a good idea. I dont think that The Douchebag can be charged with threatening himself... You do realize that some trolls register multiple accounts on the same mailing list so that they can have the benefit of annoying everyone else while only talking to themselves. This is done in order to make people like you think that there is a serious discussion going on. -JP[EMAIL PROTECTED] boyee' And you do realise you are nothing more than an alias as well? I have nothing to do with [EMAIL PROTECTED], gobbles or anyone else. I clearly sign my e-mails with n3td3v if changing e-mail address. So thanks for playing, I am a serious security person who is British, I have nothing to do with any other alias, unless signed with the n3td3v tag, Thanks for playing JP, and btw, what does JP stand for? -BEGIN PGP SIGNATURE- Note: This signature can be verified at https://www.hushtools.com/verify Charset: UTF8 Version: Hush 2.5 wpwEAQECAAYFAkcSK7kACgkQ+dWaEhErNvQtOwP/SAyiRMqc7DLshwBMw8nLlqgilCRl yJ1fIHfCFeO3Q5GqZ/ZX/wx37DvpjY40JTnNREJErWJVlUVoqYSTh44DwPIZ1f/THzDJ X2+S6zrn2G2SKfbstkpHvID+sz1Az7Qhb768xIrAK1OWCDJvBd6oQhB4xmcAzqdIxHUO 5IC7PkA= =5o9z -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
Why is that shocking? this list of full of cissps who have never done anything but setup simple windows networks and 'hackers' who have never even wrote an exploit ( see pdp and his post about 'hacking with guis' for confirmation or his other posts about 'hacking' those routers when all he did was find xss and other web bugs ) On 10/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://gcc.gnu.org/ml/gcc-help/2006-05/msg00267.html On Sat, 13 Oct 2007 17:44:53 -0400 worried security [EMAIL PROTECTED] wrote: On 10/13/07, Dude VanWinkle [EMAIL PROTECTED] wrote: On 10/13/07, worried security [EMAIL PROTECTED] wrote: On 10/13/07, Richard Golodner [EMAIL PROTECTED] wrote: Why don't you keep this offline between you and full- disclosure? I know Valdis and he does not give a damn about any of this sophomoric stuff. When you post legitimate security information your credibility is increased as well as the amount of respect you receive amongst the security community. Take this as friendly advice and nothing more. You should not threaten to play games as you may not be aware of who is reading this stuff. I know NSA, Interpol and FBI personnel who read this but will never reveal themselves, but you expose yourself to possible investigation by making threats. And that is never a good idea. I dont think that The Douchebag can be charged with threatening himself... You do realize that some trolls register multiple accounts on the same mailing list so that they can have the benefit of annoying everyone else while only talking to themselves. This is done in order to make people like you think that there is a serious discussion going on. -JP[EMAIL PROTECTED] boyee' And you do realise you are nothing more than an alias as well? I have nothing to do with [EMAIL PROTECTED], gobbles or anyone else. I clearly sign my e-mails with n3td3v if changing e-mail address. So thanks for playing, I am a serious security person who is British, I have nothing to do with any other alias, unless signed with the n3td3v tag, Thanks for playing JP, and btw, what does JP stand for? -BEGIN PGP SIGNATURE- Note: This signature can be verified at https://www.hushtools.com/verify Charset: UTF8 Version: Hush 2.5 wpwEAQECAAYFAkcSK7kACgkQ+dWaEhErNvQtOwP/SAyiRMqc7DLshwBMw8nLlqgilCRl yJ1fIHfCFeO3Q5GqZ/ZX/wx37DvpjY40JTnNREJErWJVlUVoqYSTh44DwPIZ1f/THzDJ X2+S6zrn2G2SKfbstkpHvID+sz1Az7Qhb768xIrAK1OWCDJvBd6oQhB4xmcAzqdIxHUO 5IC7PkA= =5o9z -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
If gadi evron was killed who would read the named.conf man page at defcon every year? I was also wondering why does it happen that every year *right* before gadi talks the botnet he was going to take down live *disappears*. conspiracy? On 10/13/07, worried security [EMAIL PROTECTED] wrote: You do know criminals read the mailing lists don't you? and if MI6 speak about preventing criminals and terrorists on the internet, they are very careful about what they say and their voice is distorted. http://news.bbc.co.uk/player/nol/newsid_615/newsid_6153000/6153092.stm?bw=bbmp=rmnol_storyid=6153092news=1 those are obviously security folks who know what they're doing. but what do ferg and gadi do, they speak on public mailing lists about preventing criminal and terrorist activity, while inviting people to join them at security conferences, inviting them to their blogs and not all, their photographs are openly available on the internet. ever tried suicide lately? the subject title is from a currently active thread on Nanog mailing list, which I have big problem over in terms of the saftey of gadi and ferg, because already someone on Full-Disclosure threatened to kill Gadi Evron, and even if it was just a kiddie joke, there are probably real gangsters and terrorists on the list who would kill you. Be careful what you say in public. Here is the thread related to what i'm talking about: http://www.merit.edu/mail.archives/nanog/msg03638.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
I believe this discussion is about people who have real skills ( which is why you are confused ).. not o so I couldn't finish my CS degree or function outside of computers so now I am doing XSS for a living If XSS is the extent of your knowledge then I guess it will get food on your table but I think you should switch to this: http://www.securityfocus.com/archive/105 mailing list. and btw: needing someone to visit a webpage so you can xsrf isnt exactly military grade 0day nor is it stealthy ( not that you would know anything about stealthy exploits) but i guess people jumped on it so much so that their cissp capable minds wouldn't be confused by sql injection [1]. I also do not know why you assume someone that doesnt consider lame XSS as an 'exploit' could not work professionally. Maybe you just have no skill and thats all your job requires of you? [1] http://seclists.org/dailydave/2007/q4/0016.html On 10/14/07, pdp (architect) [EMAIL PROTECTED] wrote: I really don't know what you refer to as an exploit.. :) and more over, it is obvious that you have a lack of knowledge on what's more valuable nowadays. don't take it personal. do you work professionally? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
On 10/14/07, pdp (architect) [EMAIL PROTECTED] wrote: military grade exploits? :) dude, I am sorry man.. but you are living in some kind of a dream world. get real, So you pick apart three words of the message and the rest is null? you seem to follow techniques of the great valdis [1] when trying to defend worthless things ( in this case your career). most of the military hacks are as simple as bruteforcing the login prompt.. or trying something as simple as XSS. Stop reading yahoo news the reason XSS is soo neat is because it bypasses all firewalls It doesnt bypass firewalls it has nothing to do with them .. this is like saying you beat pax because you used sql injection to get cmd exec on a machine ( something the selinux team probably has in their presentations ). ... what?, your military grade exploit can do that? your military grade exploit can attack only the things that are visible from outside. Or what about attacking the outside itself? Did you not see the core impact talk or were you too busy giving gadi a reach around by the pool? if you want to sink into the stuff then do web hacking cuz it just works. You mean do web hacking because you do not need any skills to look good and automated tools do it all for you. No thanks ill pass different people do different things and are experienced in different disciplines. To me this sounds like i couldnt write an exploit for a strcpy bug so now I write xss code so i can still put hacker on my business card. btw, this is your 3rd message on FD, right? I guess I should whore the list more and then people will listen to me? Is this the secret to why gadi evron is still allowed to post here? I am just in a mood for philosophical conversations today. you should stay that way since you cant handle much else [1] http://archives.neohapsis.com/archives/fulldisclosure/2007-05/0226.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
I guess there's some logic in spreading FUD about security in depth not working. It might be a nice way to scare potential customers who don't know much about security into whatever services Gnucitizen team sells. However, these kind of tricks simply won't work with any seasoned security professional. It'll actually backfire if you are not careful... because you won't be taken seriously in the industry. I'm pretty sure Pdp's rating in the books of many security professionals went down quite a few notches :-) It's a small world... and most likely it'll affect your and your company's future... because you'll need to do business with people like Thor (who gave a great and very logical description with proper supporting examples of what security in depth is and what's mean to do). The chances are that they'll simply choose to work with someone else... who betters understands the big picture in security :-) CQ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay (W3bd4v)
(see attached) Mikis Theodorakis Grigoris Bithikotsis//Tis Dikaiosynis ilie noite: http://kypros.org/Occupied_Cyprus/epiktitos/audio/patriotic/THEODORAKIS%20%20BITHIKOTSIS%20-%20Tis%20Dikaiosynis%20Ilie%20Noite.mp3 (see attached) signed, eliteb0y/2007 -- Pt! Schon vom neuen GMX MultiMessenger gehört? Der kanns mit allen: http://www.gmx.net/de/go/multimessenger apache.pl Description: Binary data ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] !!! W4RN1NG N1GS und P1GZ !!!
MISS DUDE VAN WINKLE, VALDIS KINIETIKZ AND GAY EVRON OFF OF THIS LIST NOW. GTFO PLZ U R RUINING THE INTERNET. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] ACHTUNG
btw did some1 audited mailman? lulz ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200710-15 ] KDM: Local privilege escalation
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: KDM: Local privilege escalation Date: October 14, 2007 Bugs: #192373 ID: 200710-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis KDM allows logins without password under certain circumstances allowing a local user to gain elevated privileges. Background == KDM is the Display Manager for the graphical desktop environment KDE. It is part of the kdebase package. Affected packages = --- Package / Vulnerable / Unaffected --- 1 kde-base/kdm 3.5.7-r2 = 3.5.7-r2 2 kde-base/kdebase 3.5.7-r4 = 3.5.7-r4 --- 2 affected packages on all of their supported architectures. --- Description === Kees Huijgen discovered an error when checking the credentials which can lead to a login without specifying a password. This only occurs when auto login is configured for at least one user and a password is required to shut down the machine. Impact == A local attacker could gain root privileges and execute arbitrary commands by logging in as root without specifying root's password. Workaround == There is no known workaround at this time. Resolution == All KDM users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =kde-base/kdm-3.5.7-r2 All kdebase users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =kde-base/kdebase-3.5.7-r4 References == [ 1 ] CVE-2007-4569 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4569 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-15.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to [EMAIL PROTECTED] or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHEpUMuhJ+ozIKI5gRAhP4AJ9tJbrr9vjqjUZYwS3z83AZKvzB2gCfVy8Y sufqCod8vQdMHkyDxK1Ypfs= =7bv4 -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] !!! W4RN1NG N1GS und P1GZ !!!
next week on animal planet: the mating habits of security noobs ... On 10/15/07, Dude VanVinkle [EMAIL PROTECTED] wrote: MISS DUDE VAN WINKLE, VALDIS KINIETIKZ AND GAY EVRON OFF OF THIS LIST NOW. GTFO PLZ U R RUINING THE INTERNET. -- mike http://lets.coozi.com.au/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200710-16 ] X.Org X server: Composite local privilege escalation
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: X.Org X server: Composite local privilege escalation Date: October 14, 2007 Bugs: #191964 ID: 200710-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis A vulnerability has been discovered in the Composite extension of the X.Org X server, allowing for a local privilege escalation. Background == The X Window System is a graphical windowing system based on a client/server model. Affected packages = --- Package / Vulnerable / Unaffected --- 1 x11-base/xorg-server 1.3.0.0-r1 = 1.3.0.0-r1 Description === Aaron Plattner discovered a buffer overflow in the compNewPixmap() function when copying data from a large pixel depth pixmap into a smaller pixel depth pixmap. Impact == A local attacker could execute arbitrary code with the privileges of the user running the X server, typically root. Workaround == Disable the Composite extension by setting ' Option Composite disable ' in the Extensions section of xorg.conf. Note: This could affect the functionality of some applications. Resolution == All X.Org X server users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =x11-base/xorg-server-1.3.0.0-r1 References == [ 1 ] CVE-2007-4730 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4730 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-16.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to [EMAIL PROTECTED] or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHEppiuhJ+ozIKI5gRAmOeAJ46xK+4nH8LWGxbNmnlmPrltBqsHgCfUTNK 8qUzM6SvnXk2c2yZgp50GTk= =DiOR -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Why criticize security researchers? On the recent PDP case.
Fist of all sorry for my English, I'm from Russia and can't speak very well. I'm very sad for the current state of security, that includes people who contest great contributions to the industry from people like pdp (architect) and call them bullshit. pdp does not give a damn about any of this sophomoric stuff. When he and the other members of the think tank group post legitimate security information in the true spirit of GNUCITIZEN half(partial)-disclosure initiative pdp's and group's credibility is increased as well as the amount of respect they receive amongst the security community. GNUCITIZEN is more then a cutting-edge security blog. It is culture, way of life, community. The GNUCITIZEN *ethos expands beyond* the boundaries of the current domain (http://en.wikipedia.org/wiki/Same_origin_policy). You clearly haven't read http://www.gnucitizen.org/blog/clear where Petko D. Petkov, a.k.a pdp (architect), the founder and leading contributer of the GNUCITIZEN group, explains why you are wrong. You know when people is in right why the hell would admit to be in wrong? A clear example of extremely important and military grade industrial nuclear plant contribution is: pdp (architect) wrote: http://www.gnucitizen.org/blog/intel-video-ad-on-security-directed-by-christopher-guest the video is quite interesting I must say. He is only trying to show you that *while* ppl can be in the industry from *many many years doing serious stuff* (that doesn't mention _http_ requests and responses) he (that is younger) can *exploit and 0wn* devices at a faster rate using techniques like Strategic Hacking using a specially crafted GEOIP database and a specially crafted mouse cursor that will not be revealed. All an attacker needs to do to exploit the weakness is to lure a victim, part of an integrated network, to a malicious website or trick them into opening specially crafted ICA file. Now i ask you: How can you ignore this and show criticism to somebody that is that clear? I guess you have not read his explanation of how things are since he won't in any way support his thesis and what he says is as-is, immutable and perfectly spheric. The first general misconception is regarding the CITRIX posts [..] my intention was not to familiarize you with the techniques but to draw your attention to the ridiculous number of wide open CITIRIX service located on government and military facilities. I don't know about you but to me this is concerning. It has become even more concerning when I accidentally stumbled across some nuclear power I don't know what, a global logistics system and US Federal funding portal. Since, I don't have the time and the facilities to contact each of the affected organization individually I decided to go public and let the people know about the problem, hoping that someone will bother. Fortunately for all of us, the operation was successful! This is *ethics*, using informations contained in a document of many years before written by somebody else to publicly show how critical infrastructures are vulnerable by the hand of anybody who is able to read GNUCITIZEN's web 2.1 blog. It's pretty clear and easy to understand: he don't have the time and the facilities to contact each of the targets that were vulnerable and reachable by a google dork he provided: Nuclear power plants, a global logistics system and US Federal funding portal were respectably at page 14, 5 and 32 of the Google results so people can contact them or just interact with the terminal server and leave the admins a txt file on the desktop pointing them to the issue. Everybody especially who is in the security industry and owns a CISP CPSTER COPCOP knows that script kiddies can't go far than the second results page in Google an YAHOO InterTUBES (a great hacking tool). _*No joke. We all should be thankful to pdp for this.*_ Additionally he and Adrian published a post (BT Home Flub: Pwnin the BT Home Hub) on the vulnerabilities they found in BT Home Hub/Thomson/Alcatel Speedtouch 7G router, currently affecting more then 2 000 000+ (two millions plus) users. You know it's pretty cool to find high risk security holes like XSS and CRSF in SOHO appliances because they are generally really locked down and secured. Dunno why HDM didn't this before. They don't even know the exact number of the 2 000 000 and plus affected users, nor their names. As you can see they are a pretty good think thank hackers trying to lower the high level of crime emanating from the internet. They don't know the exact number and the SSN of all the vulnerable users because they have not exploited all of them (in fact they just hacked 200 000+ users to make sure the attack was working). They believe the number has to be at least 4 or 5 millions (GLOBALLY!) mainly because of similar issues found on the Speedtouch routers shipped by other ISPs. People from FD and BUGTRAQ have responded with some very interesting but quite groundless claims stating that this is
[Full-disclosure] Renaissance
I am not sure if this will be of any interest to anyone. anyway http://www.gnucitizen.org/projects/renaissance/ Renaissance is Web2.0 client-side API which was designed to easy the development of surface agents (ajax bots). The library was intended to be used for cutting-edge Web2.0 security research, although later it was found that it may serve other purposes as well. The project is still at development stage. We recommend you to have a look at the For my next trick… hacking Web2.0 purple paper for some insights how to use the project. the API documentation can be found over here: http://www.gnucitizen.org/renaissance Let me know if you find it useful. cheers, pdp -- pdp (architect) | petko d. petkov http://www.gnucitizen.org ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
This wasn't a flame... It was a simple observation. Having read your reply I also see that you are trying to reinvent the wheel... when you talk about crisis management and other planning. Risk analysis, business continuity and disaster recovery planning, well prepared incident response procedures and policies, etc have been practiced by security professionals for quite a while, so they are not new concepts. There's still a lot of work to do when it comes implementing proper security and compliance solutions. Many companies either don't do it or don't do it effectively, but there has been some progress over the years. Many companies don't even have a CSO/CISO because security and compliance are only starting to gain the recognition they require. Obviously, there's much more work to do... and that's good for all of us in the information security business :-) As far as defense in depth goes, just like with everything else it can be improperly implemented to a point where it's ineffective or prohibitively disrupted to the business. Your example is a great example of that :-) However, it doesn't mean that the concept is useless. Simple analogy... Let's say I pick up a cook book to make a fancy dish, but I end up with something that can even turns my dog green :-) Does it mean that the recipe was bad or does it mean I shouldn't quit my day job to become a chef? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Why criticize security researchers? On the recent PDP case.
rpcxfsmd rpcxfsmd wrote: Fist of all sorry for my English, I'm from Russia and can't speak very well. Your English is better than my Russian. ;) I'm very sad for the current state of security, that includes people who contest great contributions to the industry from people like pdp (architect) and call them bullshit. Filters are your friend. -- Hawaiian Astronomical Society: http://www.hawastsoc.org HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Why criticize security researchers? On the recent PDP case.
Nichego strashnogo anglijskij normal'nij vot tol'ko soderzhanie poxozhe na propagandu :-) Couple of reasons why people in the security industry are somewhat critical of pdp... 1. Social engineering is 99% of an exploit it's pretty much a given that people will question the plausibility of a successful mass exploitation in a real world. 2. When somebody makes a claim that's totally off base people will correct it. That's the whole idea of a community... We share knowledge and help each other better understand how things work. Some people (like pdp) are going through growing pains in the security industry where they try to interpret the world based on their limited understanding and experience. Sometimes those interpretations are incorrect. What is wrong in pointing it out. Finding a 0day doesn't automatically make somebody an all knowing security expert. It takes a lot of time and experience to gain the proper understanding of security. CQ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
On 10/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://gcc.gnu.org/ml/gcc-help/2006-05/msg00267.html Oh yeah? two can play that game: http://www.forbiddenweb.org/topic/10084/index.html -JP ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
I wonder if I can start billing for the waste of storage space and time that these stupid emails are causing me. I know it has been proposed to bill spammers before. If you all want to see who has the longest then please spare the rest of us. As to everyone else: show some restraint already and stop feeding the trolls. Now pardon me while I go see if some filtering software exists for my blackberry so I can have it automatically can emails from some of the waste of oxygen that's lurking around here. Geoff Sent from my BlackBerry wireless handheld. -Original Message- From: Dude VanWinkle [EMAIL PROTECTED] Date: Sun, 14 Oct 2007 20:31:16 To:[EMAIL PROTECTED] [EMAIL PROTECTED] Cc:full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] [EMAIL PROTECTED] On 10/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://gcc.gnu.org/ml/gcc-help/2006-05/msg00267.html Oh yeah? two can play that game: http://www.forbiddenweb.org/topic/10084/index.html -JP ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Explain your joke Mister Vranesevich. On Sun, 14 Oct 2007 20:31:16 -0400 Dude VanWinkle [EMAIL PROTECTED] wrote: On 10/14/07, [EMAIL PROTECTED] full- [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://gcc.gnu.org/ml/gcc-help/2006-05/msg00267.html Oh yeah? two can play that game: http://www.forbiddenweb.org/topic/10084/index.html -JP -BEGIN PGP SIGNATURE- Note: This signature can be verified at https://www.hushtools.com/verify Charset: UTF8 Version: Hush 2.5 wpwEAQECAAYFAkcS2CQACgkQ+dWaEhErNvQpvwP+P1RDr9QqRNFPSbxv/BHcLZlW9Ux1 1HPdWMZcsQoFfaFMCMj8l2b3GYjE6bcKc8jd9hxGc0OFfxpsTeVehlnCnhattgz8i1hQ 9/JP/nFpp1NIsLgGhCBwTlh0WTSCBYqvOau4dmLAGn80qwlzb8EThDP1KDY8UPvlTlfq 5ezUoIE= =YTfZ -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
OK Dudette and VanWanker, Take it to the street!Have it out,just not here!!! Some people actually like a clean list. Regards, Scott Dude VanWinkle wrote: On 10/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Explain your joke Mister Vranesevich. Nah, I give up. I was just trying to annoy you as much as you try and annoy everyone else, but you have 100 times my annoyance factor(which is pretty impressive), and its a hopeless battle. Congrats! You win the scorn of hundreds! -JP ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Is this an attack?
In the Control Field of a TCP segment I noticed the following values: URG 0 ACK 0 PSH 0 RST 0 SYN 1 FIN 1 I assume the checksum is OK, is this an attack packet? If not, why not? If so, what is the attacker probably trying to achieve? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] I made third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling)
Reposted for better visibility (I love attention). Have a nice week. Hope this makes you feel less vulnerable 3 http://spacebunny.xepher.net/hack/shellexecutefiasco/ ShellExecuteFiasco - third-party patch for CVE-2007-3896 Copyright (C) 2007 KJK::Hyperion [EMAIL PROTECTED] http://spacebunny.xepher.net/ ABOUT - This is an unofficial, third-party patch for vulnerability CVE-2007-3896 [1], intended to protect supported Microsoft operating systems until an official patch is released, and unsupported systems as well. You only need this patch if you have Internet Explorer 7 on any operating system older than Windows Vista, and only until Microsoft releases an official fix. The present patch is dramatically under-tested and it has underwent no quality assurance procedure whatsoever, so please deploy with the greatest care. It has a very good chance of misbehaving and making your system unusable; should this happen, rebooting in safe mode with command prompt might make it possible to uninstall it, or it might as well not. The patch consists of a ShellExecuteEx hook [2] that prevents the execution of malformed URLs and enforces normalization of valid URLs. Programs registering custom URL schemes might not like, support or even know about normalized URLs: this patch will interfere with any such program to the point of unusability. The normalization proper is performed by Internet Explorer's low-level internet engine, which could mangle unknown URL schemes or otherwise act unpredictably when presented with abnormal input. Notes [1] URL:http://www.microsoft.com/technet/security/advisory/943521.mspx [2] URL:http://msdn2.microsoft.com/en-us/library/bb775101.aspx INSTALLATION 1. Copy shellexecutefiasco.dll anywhere; %windir%\system32 will do. 2. Run the command: A. regsvr32 full path to shellexecutefiasco.dll or regsvr32 /n /i:s full path to shellexecutefiasco.dll to install for all users B. regsvr32 /n /i:u full path to shellexecutefiasco.dll to install for the current user only. 3. A message box will report whether the installation was successful. You need to be a privileged user to install this patch. UNINSTALLATION -- 1. Run the command regsvr32 /u full path to shellexecutefiasco.dll. 2. A message box will report whether the uninstallation was successful. 3. Delete shellexecutefiasco.dll. You need to be a privileged user to fully uninstall this patch. LICENSE --- The patch is released as open source under the following license: Copyright (c) 2007 KJK::Hyperion Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the Software), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED AS IS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -- KJK:: HYPE RION ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] I made third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling)
And of course Thunderbird now preserves the thread references when you edit as new and now I look like an idiot. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Is this an attack?
On 10/15/07, Kelly Robinson [EMAIL PROTECTED] wrote: In the Control Field of a TCP segment I noticed the following values: URG 0 ACK 0 PSH 0 RST 0 SYN 1 FIN 1 I assume the checksum is OK, is this an attack packet? If not, why not? If so, what is the attacker probably trying to achieve? SYN/FIN portscan. Someone simply portscanning you or a huge range of hosts looking for a particular service. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
Please do not bring up non-technical things that even the random user can comment on. These actions have been known to make people like gadi evron and valdis post random non-sense and fill my inbox.[1][2][3][4][5][6] [1] http://www.merit.edu/mail.archives/nanog-futures/msg01386.html [2] http://www.merit.edu/mail.archives/nanog-futures/msg01385.html [3] http://www.merit.edu/mail.archives/nanog-futures/msg01402.html [4] http://marc.info/?l=bugtraqm=119030476022347w=2 [5] http://marc.info/?l=bugtraqm=119075756905837w=2 -- key example [6] http://marc.info/?l=pen-testm=118902465322862w=2 -- another key example On 10/14/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: I wonder if I can start billing for the waste of storage space and time that these stupid emails are causing me. I know it has been proposed to bill spammers before. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [EMAIL PROTECTED]
Some people don't know when to quit when they're behind. Thank you for volunteering to be the first on my ban list. Your stupidity has been duly rewarded. *plonk* Next volunteer... Geoff Sent from my BlackBerry wireless handheld. -Original Message- From: phioust [EMAIL PROTECTED] Date: Sun, 14 Oct 2007 23:28:31 To:full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] [EMAIL PROTECTED] Please do not bring up non-technical things that even the random user can comment on. These actions have been known to make people like gadi evron and valdis post random non-sense and fill my inbox.[1][2][3][4][5][6] [1] http://www.merit.edu/mail.archives/nanog-futures/msg01386.html http://www.merit.edu/mail.archives/nanog-futures/msg01386.html [2] http://www.merit.edu/mail.archives/nanog-futures/msg01385.html http://www.merit.edu/mail.archives/nanog-futures/msg01385.html [3] http://www.merit.edu/mail.archives/nanog-futures/msg01402.html http://www.merit.edu/mail.archives/nanog-futures/msg01402.html [4] http://marc.info/?l=bugtraqamp;m=119030476022347amp;w=2 http://marc.info/?l=bugtraqamp;m=119030476022347amp;w=2 [5] http://marc.info/?l=bugtraqamp;m=119075756905837amp;w=2 http://marc.info/?l=bugtraqamp;m=119075756905837amp;w=2 -- key example [6] http://marc.info/?l=pen-testamp;m=118902465322862amp;w=2 http://marc.info/?l=pen-testamp;m=118902465322862amp;w=2 -- another key example On 10/14/07, [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: I wonder if I can start billing for the waste of storage space and time that these stupid emails are causing me. I know it has been proposed to bill spammers before. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
