[Full-disclosure] OMG - I just won the lottery! For real!!11!

[Kelly Robinson]

 Oh my god! I am going to be rich beyond my wildest dreams. All I need to do
it give these guys...

* All my personal details
* All my contact details
* All my banking details (including a swift code which I dont know what that
is. I will have to call the bank in the Netherlands to find out)

...And I can retire :o) I wont have to find some rich guy to marry afterall.

Although ... I dont remember entering this lottery - because I havent been
18 that long and it wouldnt be legal!?

-- Forwarded message --
From: postcodeloterij claim section <[EMAIL PROTECTED]>
Date: Oct 16, 2007 9:08 PM
Subject: From Remittance Department
To: [EMAIL PROTECTED]


 From Remittance Department
Tel:+31 619 289 644
Fax:+31 619 289 645
sns Bank
Marienplaatz 78,
5291HM,Den Haag
The Netherlands
Date:16th-10-2007.

Dear Kelly Robinson,

Your email has been awarded a lump sum pay-out from the free (Computer Email
Ballot) international Lottery Program by the
Postcodeloterij.nl
.

We the entire staff of sns Bank wish to congratulate you as a result of our
verification exercise for being one of the lucky winners in this season's
lottery promotion. This is an independent promotion and is unconnected to
any publication. No purchase of ticket necessary. You are picked as one of
the winners because you have been using Internet services for some time. So
we can say with confidence that your email was selected as lucky one among
others. Be informed that this lottery promotion was conducted through the
Internet worldwide random selection, the participants and winners were
picked randomly through a computer ballot system. For payment of your
winning prize of the 'B' draw 1st category winning prize of Euro 1,000,
000.00 (One Million Euros) to be transferred to your nominated account by
sns Bank.Our bank will contact your bank officially about it during the
cause of transfer.

Outlined herein are the terms and conditions for claiming your prize:

1. You must be the age of 18 and above.

2. The account opening forms must be properly filled out. Any wrong
information provided will result to automatic disqualification.

3. You are to work with your accounting officer here by providing him with
all required information's for smooth transfer of your fund to your
designated account in your country.

4. As the winner, you are responsible for the minimum initial deposit( MID )
of your account to be activated with sns Bank,as this minimum initial
deposit ( MID )is non deductible from the prize won.

5. Any leakage of your winning information resulting to a double claims,
will disqualify your winnings.

6. Note also that, you are not obliged in any way to claim this prize award
and you have every right to reject it, this does not affect your statutory
rights.

7. Employees, relatives of Postcodeloterij-nl and sns Bank are excluded from
participating in this program.

8. To be eligible for claims,you must complete the claim process before the
deadline.

9. Filling the claim form means acceptance of the full terms and conditions
enumerated above.
If you agree to the terms and conditions,send back the account opening form
by email attachment and that you agree to the terms and conditions to
proceed in claiming your prize .You are to fill the Account opening Form and
send back by FAX or as email attached file for the Account Activation.

Attached with this mail is the Account Activation Form  which must be
completed and sent back to this office for the process of Activation of your
Account with sns Bank. You are to send a scanned copy of your ID,passport or
driver's license for proof of identity for us to proceed with the transfer
of your winning prize to you.

The Form allows you choose the kind of account you will like to own with sns
Bank. Remember to quote your winning numbers in all correspondence with us.

Note: The claiming process must be completed before the claims expiration
date of 10 working days from today,after which all unclaimed prizes will be
forfeited.

Thanks in advance for banking with us.

Yours Faithfully,
Marie Young(Mrs)
For:Mr.David Matoya
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[cocoruder .]

Why everybody said it is a zero day about PDF? it's just a fault in IE7, or 
just want to make a big media hit? real PDF zero day will exists in the 
PDF's file format, or some Adobe's expanded functions.



welcome to my blog:
http://ruder.cdut.net






From: [EMAIL PROTECTED]
To: full-disclosure@lists.grok.org.uk
Subject: [Full-disclosure] 0-day PDF exploit
Date: Tue, 16 Oct 2007 15:00:14 +0300

Zero day PDF exploit for Adobe Acrobat


Link to exploit:

Please download and open it locally in Adobe Acrobat (not in Adobe Acrobat
ActiveX control):

http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf


Description:

0-day proof of concept (PoC) exploit for Adobe Acrobat.


Software affected:

+ Adobe Reader 8.1 (and earlier)
+ Adobe Acrobat Standard, Pro and Elements 8.1 (and earlier)
+ Adobe Acrobat 3D


System affected:

+ Windows XP with IE7


Details:

To view exploit code in Adobe Acrobat go to: Pages -> Page Properties ->
Actions
(trigger: Page Open, action: Open a web link)

This is URL handling bug in shell32!ShellExecute()


Workaround:

Currently unavailable.


Thanks to:

pdp (at) gnucitizen.org for his investigation


regards,
cyanid-E <[EMAIL PROTECTED]>




___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_
享用世界上最大的电子邮件系统― MSN Hotmail。  http://www.hotmail.com  

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] List Charter

[John Cartwright]

[Full-Disclosure] Mailing List Charter
John Cartwright <[EMAIL PROTECTED]>
 

- Introduction & Purpose -

This document serves as a charter for the [Full-Disclosure] mailing 
list hosted at lists.grok.org.uk.

The list was created on 9th July 2002 by Len Rose, and is primarily 
concerned with security issues and their discussion.  The list is 
administered by John Cartwright.

The Full-Disclosure list is hosted and sponsored by Secunia.


- Subscription Information -

Subscription/unsubscription may be performed via the HTTP interface 
located at http://lists.grok.org.uk/mailman/listinfo/full-disclosure.

Alternatively, commands may be emailed to 
[EMAIL PROTECTED], send the word 'help' in 
either the message subject or body for details.

 
- Moderation & Management -

The [Full-Disclosure] list is unmoderated. Typically posting will be
restricted to members only, however the administrators may choose to 
accept submissions from non-members based on individual merit and 
relevance.

It is expected that the list will be largely self-policing, however in
special circumstances (eg spamming, misappropriation) then offending 
members may be removed from the list by the management.

An archive of postings is available at 
http://lists.grok.org.uk/pipermail/full-disclosure/.
 

- Acceptable Content -

Any information pertaining to vulnerabilities is acceptable, for 
instance announcement and discussion thereof, exploit techniques and 
code, related tools and papers, and other useful information.

Gratuitous advertisement, product placement, or self-promotion is 
forbidden.  Disagreements, flames, arguments, and off-topic discussion 
should be taken off-list wherever possible.

Humour is acceptable in moderation, providing it is inoffensive. 
Politics should be avoided at all costs.

Members are reminded that due to the open nature of the list, they 
should use discretion in executing any tools or code distributed via
this list.
 

- Posting Guidelines -

The primary language of this list is English. Members are expected to 
maintain a reasonable standard of netiquette when posting to the list. 

Quoting should not exceed that which is necessary to convey context, 
this is especially relevant to members subscribed to the digested 
version of the list.

The use of HTML is discouraged, but not forbidden. Signatures will 
preferably be short and to the point, and those containing 
'disclaimers' should be avoided where possible.

Attachments may be included if relevant or necessary (e.g. PGP or 
S/MIME signatures, proof-of-concept code, etc) but must not be active 
(in the case of a worm, for example) or malicious to the recipient.

Vacation messages should be carefully configured to avoid replying to 
list postings. Offenders will be excluded from the mailing list until 
the problem is corrected.

Members may post to the list by emailing 
[EMAIL PROTECTED] Do not send subscription/
unsubscription mails to this address, use the -request address 
mentioned above.


- Charter Additions/Changes -

The list charter will be published at 
http://lists.grok.org.uk/full-disclosure-charter.html.

In addition, the charter will be posted monthly to the list by the 
management.

Alterations will be made after consultation with list members and a 
concensus has been reached.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] AST-2007-023: SQL Injection vulnerability in cdr_addon_mysql

[The Asterisk Development Team]

   Asterisk Project Security Advisory - AST-2007-023

   ++
   |  Product   | Asterisk-Addons   |
   |+---|
   |  Summary   | SQL Injection Vulnerability in cdr_addon_mysql|
   |+---|
   | Nature of Advisory | SQL Injection |
   |+---|
   |   Susceptibility   | Remote Unauthenticated Sessions   |
   |+---|
   |  Severity  | Minor |
   |+---|
   |   Exploits Known   | Yes   |
   |+---|
   |Reported On | October 16, 2007  |
   |+---|
   |Reported By | Humberto Abdelnur|
   |+---|
   | Posted On  | October 16, 2007  |
   |+---|
   |  Last Updated On   | October 16, 2007  |
   |+---|
   |  Advisory Contact  | Tilghman Lesher|
   |+---|
   |  CVE Name  | CVE-2007-5488 |
   ++

   ++
   | Description | The source and destination numbers for a given call are  |
   | | not correctly escaped by the cdr_addon_mysql module when |
   | | inserting a record. Therefore, a carefully crafted   |
   | | destination number sent to an Asterisk system running|
   | | cdr_addon_mysql could escape out of a SQL data field and |
   | | create another query. This vulnerability is made all the |
   | | more severe if a user were using realtime data, since|
   | | the data may exist in the same database as the inserted  |
   | | call detail record, thus creating all sorts of possible  |
   | | data corruption and invalidation issues. |
   ++

   ++
   | Resolution | The Asterisk-addons package is not distributed with   |
   || Asterisk, nor is it installed by default. The module may  |
   || be either disabled or upgraded to fix this issue. |
   ++

   ++
   |   Affected Versions|
   ||
   |   Product|   Release   |   |
   |  |   Series|   |
   |--+-+---|
   | Asterisk Open Source |1.0.x| All versions  |
   |--+-+---|
   | Asterisk Open Source |1.2.x| All versions prior to |
   |  | | asterisk-addons-1.2.8 |
   |--+-+---|
   | Asterisk Open Source |1.4.x| All versions prior to |
   |  | | asterisk-addons-1.4.4 |
   |--+-+---|
   |  Asterisk Business   |A.x.x| Unaffected|
   |   Edition| |   |
   |--+-+---|
   |  Asterisk Business   |B.x.x| Unaffected|
   |   Edition| |   |
   |--+-+---|
   | AsteriskNOW  | pre-release | Unaffected|
   |--+-

[Full-disclosure] Secunia Research: IrfanView Palette File Importing Buffer Overflow Vulnerability

[Secunia Research]

== 

 Secunia Research 16/10/2007

  - IrfanView Palette File Importing Buffer Overflow Vulnerability -

== 
Table of Contents

Affected Software1
Severity.2
Vendor's Description of Software.3
Description of Vulnerability.4
Solution.5
Time Table...6
Credits..7
References...8
About Secunia9
Verification10

== 
1) Affected Software 

IrfanView 3.99 and 4.00

NOTE: Other versions may also be affected.

== 
2) Severity 

Rating: Moderately critical
Impact: System access
Where:  From remote

== 
3) Vendor's Description of Software 

"IrfanView is a very fast, small, compact and innovative FREEWARE
(for non-commercial use) graphic viewer for Windows 9x/ME/NT/2000/
XP/2003/Vista. It is trying to be simple for beginners and powerful
for professionals.".

Product Link:
http://www.irfanview.com/

== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in IrfanView, which
can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when importing
palette (*.pal) files. This can be exploited to cause a stack-based
buffer overflow by tricking a user into importing a specially crafted
palette (*.pal) file.

Successful exploitation allows the execution of arbitrary code.

== 
5) Solution 

Update to version 4.10.
http://www.irfanview.com/main_download_engl.htm

== 
6) Time Table 

28/08/2007 - Vendor notified.
28/08/2007 - Vendor response.
16/10/2007 - Public disclosure.

== 
7) Credits 

Discovered by Stefan Cornelius, Secunia Research.

== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2007-4343 for the vulnerability.

== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://corporate.secunia.com/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://corporate.secunia.com/secunia_research/33/

Secunia regularly hires new skilled team members. Check the URL below to
see currently vacant positions:

http://secunia.com/secunia_vacancies/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/ 

== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2007-71/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

==

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] AST-2007-023 - SQL Injection Vulnerabilty in cdr_addon_mysql

[Asterisk Security Team]

   Asterisk Project Security Advisory - AST-2007-023

   ++
   |  Product   | Asterisk-Addons   |
   |+---|
   |  Summary   | SQL Injection Vulnerability in cdr_addon_mysql|
   |+---|
   | Nature of Advisory | SQL Injection |
   |+---|
   |   Susceptibility   | Remote Unauthenticated Sessions   |
   |+---|
   |  Severity  | Minor |
   |+---|
   |   Exploits Known   | Yes   |
   |+---|
   |Reported On | October 16, 2007  |
   |+---|
   |Reported By | Humberto Abdelnur|
   |+---|
   | Posted On  | October 16, 2007  |
   |+---|
   |  Last Updated On   | October 16, 2007  |
   |+---|
   |  Advisory Contact  | Tilghman Lesher|
   |+---|
   |  CVE Name  | CVE-2007-5488 |
   ++

   ++
   | Description | The source and destination numbers for a given call are  |
   | | not correctly escaped by the cdr_addon_mysql module when |
   | | inserting a record. Therefore, a carefully crafted   |
   | | destination number sent to an Asterisk system running|
   | | cdr_addon_mysql could escape out of a SQL data field and |
   | | create another query. This vulnerability is made all the |
   | | more severe if a user were using realtime data, since|
   | | the data may exist in the same database as the inserted  |
   | | call detail record, thus creating all sorts of possible  |
   | | data corruption and invalidation issues. |
   ++

   ++
   | Resolution | The Asterisk-addons package is not distributed with   |
   || Asterisk, nor is it installed by default. The module may  |
   || be either disabled or upgraded to fix this issue. |
   ++

   ++
   |   Affected Versions|
   ||
   |   Product|   Release   |   |
   |  |   Series|   |
   |--+-+---|
   | Asterisk Open Source |1.0.x| All versions  |
   |--+-+---|
   | Asterisk Open Source |1.2.x| All versions prior to |
   |  | | asterisk-addons-1.2.8 |
   |--+-+---|
   | Asterisk Open Source |1.4.x| All versions prior to |
   |  | | asterisk-addons-1.4.4 |
   |--+-+---|
   |  Asterisk Business   |A.x.x| Unaffected|
   |   Edition| |   |
   |--+-+---|
   |  Asterisk Business   |B.x.x| Unaffected|
   |   Edition| |   |
   |--+-+---|
   | AsteriskNOW  | pre-release | Unaffected|
   |--+-

[Full-disclosure] [ GLSA 200710-17 ] Balsa: Buffer overflow

[Raphael Marichez]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory   GLSA 200710-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
 Title: Balsa: Buffer overflow
  Date: October 16, 2007
  Bugs: #193179
ID: 200710-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis


Balsa is vulnerable to a buffer overflow allowing for the user-assisted
execution of arbitrary code.

Background
==

Balsa is a highly configurable email client for GNOME.

Affected packages
=

---
 Package/  Vulnerable  /Unaffected
---
  1  mail-client/balsa  < 2.3.20 >= 2.3.20

Description
===

Evil Ninja Squirrel discovered a stack-based buffer overflow in the
ir_fetch_seq() function when receiving a long response to a FETCH
command (CVE-2007-5007).

Impact
==

A remote attacker could entice a user to connect to a malicious or
compromised IMAP server, possibly leading to the execution of arbitrary
code with the rights of the user running Balsa.

Workaround
==

There is no known workaround at this time.

Resolution
==

All Balsa users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/balsa-2.3.20"

References
==

  [ 1 ] CVE-2007-5007
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5007

Availability


This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200710-17.xml

Concerns?
=

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
[EMAIL PROTECTED] or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
===

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


pgpa3NtDImtPA.pgp
Description: PGP signature
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [MailServer Notification]Content Filtering Notification

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

stop swearing in email please

On Tue, 16 Oct 2007 16:18:11 -0400 [EMAIL PROTECTED] wrote:
>This email has violated the PROFANITY.
>and Quarantine entire message has been taken on 16/10/2007
>22.17.33.
>Message details:
>Server:MAIL1RELAY
>Sender: [EMAIL PROTECTED];
>Recipient:full-
>[EMAIL PROTECTED];[EMAIL PROTECTED];
>Subject:Re: [Full-disclosure] password hash, funny myth in the
>industry!
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVICcACgkQ+dWaEhErNvQ//AP+PnEr5cSv7XHBr5gw476OVeV4aoO9
TpPANAPgP6/6UMcZmLcwt7pQKhYXj/nJhJOr6YW/poh8+OsPmzo09vhDDAAnZ0/iWPl/
+e0GS4jMn8cdLL9QdtxUaK7K9tOn9yfiUpMgvzpToqv3hyjvjV4pnrLO04uXfxVil609
R0UwNAY=
=QZ02
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Do you understand how email technologies work?  I would like to
point out that you don't.  I'm sure Vladis will have something to
say.  Since *clearly* you should become an hero.

Except for the hushmail part.



On Tue, 16 Oct 2007 16:13:52 -0400 Dude VanWinkle
<[EMAIL PROTECTED]> wrote:
>Those are some pretty good faked headers guys (except for the
>hushmail part)
>
>FYI: No one will notice the difference if you spoof my addy,
>'cause I
>have been filtered for years!
>
>-JP
>
>On 10/16/07, Dude VanVinkle <[EMAIL PROTECTED]> wrote:
>> Someone on FD works for Yambo Financials. lulz
>>
>> - JP.
>>
>> On 10/16/07, [EMAIL PROTECTED] [EMAIL PROTECTED]> wrote:
>> > -BEGIN PGP SIGNED MESSAGE-
>> > Hash: SHA1
>> >
>> > What is it then?
>> >
>> > On Tue, 16 Oct 2007 13:57:55 -0400 [EMAIL PROTECTED]
>wrote:
>> > >On Tue, 16 Oct 2007 11:55:17 EDT, full-
>[EMAIL PROTECTED]
>> > >said:
>> > >> Why am I getting emails like this?
>> > >
>> > >Obviously, the spammers have learned the secret of targeted
>> > >marketing.
>> > -BEGIN PGP SIGNATURE-
>> > Note: This signature can be verified at
>https://www.hushtools.com/verify
>> > Charset: UTF8
>> > Version: Hush 2.5
>> >
>> >
>wpwEAQECAAYFAkcVAcQACgkQ+dWaEhErNvSa3gP5AXq4yJqozOQhpaJg/WtXwUcRrxz
>6
>> >
>ncYXpsrN5Lt2ZU3ehbwiTUZHuSq3JCo259u/9+KhL8fM5UBM1YScPnh6GA+dTEB4iGN
>b
>> >
>/aFymB4V26wUXV/NJLk/hcPEWKrxJ08dznUg4qJGYD2q/mT/Voff9OKbtVc8wIBwR+T
>f
>> > 9ddML2Q=
>> > =VF6Y
>> > -END PGP SIGNATURE-
>> >
>> >
>> > ___
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> >
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVH/IACgkQ+dWaEhErNvTXXgP+MENm+a+vnXL34+nux03kMN4H6icV
bZ+IyIvvkLzQ421OvNWMeLwGLcLKZqALtzkJVd4cUJCb152G7ANzkLF+xB2kX8BOpWN6
ItM6p7Gkq6zEawh7P+q+2MFom5RAYATQgC9Tjk0VqDWcC04CO5+qmdMpel/EdD5XXIyp
0Z28WGk=
=kfq3
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[Dude VanWinkle]

Those are some pretty good faked headers guys (except for the hushmail part)

FYI: No one will notice the difference if you spoof my addy, 'cause I
have been filtered for years!

-JP

On 10/16/07, Dude VanVinkle <[EMAIL PROTECTED]> wrote:
> Someone on FD works for Yambo Financials. lulz
>
> - JP.
>
> On 10/16/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA1
> >
> > What is it then?
> >
> > On Tue, 16 Oct 2007 13:57:55 -0400 [EMAIL PROTECTED] wrote:
> > >On Tue, 16 Oct 2007 11:55:17 EDT, [EMAIL PROTECTED]
> > >said:
> > >> Why am I getting emails like this?
> > >
> > >Obviously, the spammers have learned the secret of targeted
> > >marketing.
> > -BEGIN PGP SIGNATURE-
> > Note: This signature can be verified at https://www.hushtools.com/verify
> > Charset: UTF8
> > Version: Hush 2.5
> >
> > wpwEAQECAAYFAkcVAcQACgkQ+dWaEhErNvSa3gP5AXq4yJqozOQhpaJg/WtXwUcRrxz6
> > ncYXpsrN5Lt2ZU3ehbwiTUZHuSq3JCo259u/9+KhL8fM5UBM1YScPnh6GA+dTEB4iGNb
> > /aFymB4V26wUXV/NJLk/hcPEWKrxJ08dznUg4qJGYD2q/mT/Voff9OKbtVc8wIBwR+Tf
> > 9ddML2Q=
> > =VF6Y
> > -END PGP SIGNATURE-
> >
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] password hash, funny myth in the industry!

[phioust]

On 10/16/07, Bipin Gautam <[EMAIL PROTECTED]> wrote:
>
> Consider the fact, many websites/forums don't use password hash+salt,
> just password hash( generally SHA1, MD5) that gets computer client
> side and POSTED to the web-forum for user authentication.


Is "computer" supposed to be "computed" ? Based on your post i think its
supposed to be and if so you are an idiot. The browser does not hash your
password in anyway nor is there directives to tell your browser to do so.
the clear text pass is sent in the post so of course you can sniff but at
this post says 1000s of username/password combos were dropped so who is
going to sniff all those machines?

instead just using the password hash itself
> manipulating the POST request.


The hash is not sent in the request - the clear text is and the server side
code (php,asp,whatever) hashes it before checking it against the databse.
you suck at life.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] password hash, funny myth in the industry!

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Revolutionary wording!

On Tue, 16 Oct 2007 15:46:20 -0400 Thierry Zoller
<[EMAIL PROTECTED]> wrote:
>BG> makes sense? :)
>Holds true for authentication shemes not designed to be protected
>against "Replay attacks".
>
>Challenge-Response - DH -
>
>--
>http://secdev.zoller.lu
>Thierry Zoller
>Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVFWcACgkQ+dWaEhErNvS3LgP/UkYt5O1VFU4D95R26/ysQwP6RIT8
TagOd4DCYX4TlDRTiZ3E9pMsYjvSpLMfzFQ2LazeFJX5YzgDWojicMquntOeFZhsa7CW
ii4DqvsrsBqkbAspLREChXP4EhgSTu96jpvZyawV8FFXrrzqVRouSAPg/Jhk98sbXtW9
Qj8DVsM=
=Uihi
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] password hash, funny myth in the industry!

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Hi 3APAPA,

On Tue, 16 Oct 2007 15:30:56 -0400 Bipin Gautam
<[EMAIL PROTECTED]> wrote:
>hi list,
>i was reading the article, http://www.f-
>secure.com/weblog/archives/1293.html
>but just an example.

blah blah blah, this is full-disclosure not some dear diary/myspace
bullshit,

>why do many people out there think password hash "can't be" as
>good as
>the password itself and needs to be computed/cracked first before
>it
>can be used?

dunno why don't you tell me?

>Consider the fact, many websites/forums don't use password
>hash+salt,
>just password hash( generally SHA1, MD5) that gets computer client
>side and POSTED to the web-forum for user authentication.

done

>If someone can sniff this, given that, user name is available
>using
>simple GUI tools as 'Tamper Data' ( firefox plug in ) even a low
>tech
>malicious user can log on with someones credentials without having
>to
>crack the password hash, instead just using the password hash
>itself
>manipulating the POST request.
>
>makes sense? :)

no please clarify!!!

>thanks,
>-bipin
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVFTIACgkQ+dWaEhErNvT69AP/f2E9mQoWjU+Tf9/zSAT4LKV6k4jR
sozte7HJXySMyvPnku1th5BW5nGBj8uJuvetrmvGAYKjsjhsOpwDSCuwZXbY/kzXJSg2
WZcMOvn/3HCgMxx44MvsgtfjAJAvUa7QoArC7LabPsAVOZrHOy9Ipn/EjOZW7LvRXoVH
Nmr86ZE=
=IuAp
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] password hash, funny myth in the industry!

[Thierry Zoller]

BG> makes sense? :)
Holds true for authentication shemes not designed to be protected
against "Replay attacks".

Challenge-Response - DH -

-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] password hash, funny myth in the industry!

[Bipin Gautam]

hi list,
i was reading the article, http://www.f-secure.com/weblog/archives/1293.html
but just an example.

why do many people out there think password hash "can't be" as good as
the password itself and needs to be computed/cracked first before it
can be used?

Consider the fact, many websites/forums don't use password hash+salt,
just password hash( generally SHA1, MD5) that gets computer client
side and POSTED to the web-forum for user authentication.

If someone can sniff this, given that, user name is available using
simple GUI tools as 'Tamper Data' ( firefox plug in ) even a low tech
malicious user can log on with someones credentials without having to
crack the password hash, instead just using the password hash itself
manipulating the POST request.

makes sense? :)

thanks,
-bipin

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Who?

On Tue, 16 Oct 2007 14:29:21 -0400 Dude VanVinkle
<[EMAIL PROTECTED]> wrote:
>Someone on FD works for Yambo Financials. lulz
>
>- JP.
>
>On 10/16/07, [EMAIL PROTECTED] [EMAIL PROTECTED]> wrote:
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA1
>>
>> What is it then?
>>
>> On Tue, 16 Oct 2007 13:57:55 -0400 [EMAIL PROTECTED]
>wrote:
>> >On Tue, 16 Oct 2007 11:55:17 EDT, [EMAIL PROTECTED]
>> >said:
>> >> Why am I getting emails like this?
>> >
>> >Obviously, the spammers have learned the secret of targeted
>> >marketing.
>> -BEGIN PGP SIGNATURE-
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>> Charset: UTF8
>> Version: Hush 2.5
>>
>>
>wpwEAQECAAYFAkcVAcQACgkQ+dWaEhErNvSa3gP5AXq4yJqozOQhpaJg/WtXwUcRrxz
>6
>>
>ncYXpsrN5Lt2ZU3ehbwiTUZHuSq3JCo259u/9+KhL8fM5UBM1YScPnh6GA+dTEB4iGN
>b
>>
>/aFymB4V26wUXV/NJLk/hcPEWKrxJ08dznUg4qJGYD2q/mT/Voff9OKbtVc8wIBwR+T
>f
>> 9ddML2Q=
>> =VF6Y
>> -END PGP SIGNATURE-
>>
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVA+0ACgkQ+dWaEhErNvQ2zwQAhiRYar806zHHoKyp+yLerWJeWwiu
5qycLcr3yVNLhKV6WqourZsLxOsp4RXIhgPWNsaP4Me+5gHH1ZeaKKd44qxtUU9Yomgh
C+qkIahuCGkZiOKMT3AoiDiL9gJ2m9Pfi+Wk1IFkzmmS9RGxNiXI5guQIM7ebAKt2r53
b+YL288=
=qbLc
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

with all the conditions that need to be met, and the fact that it
is still going to be "user assisted" wouldn't it be easier to just
get the targeted user to run the executable directly?

i suppose with this xss/xsrf/b4b0 tactic you can bypass the
firewalls at least and militarily grade brute force the login for
the win.

whatever pays the bills bro.

On Tue, 16 Oct 2007 14:25:52 -0400 [EMAIL PROTECTED] wrote:
>no, it's my PoC exploit and product of my researching based on
>public
>information that pdp given in his blog
>
>regards,
>cyanid-E
>
>2007/10/16, phioust <[EMAIL PROTECTED]>:
>>
>> is pdp architect releasing more 0day into the wild without his
>companies
>> knowledge? I think this breaks the contract from any serious
>security
>> company.  I believe a message from him explaining his positions
>on such
>> things is appropriate or maybe a message from his employeer
>about their
>> disclosure policies?
>>
>> On 10/16/07, [EMAIL PROTECTED] < [EMAIL PROTECTED]> wrote:
>> >
>> > Zero day PDF exploit for Adobe Acrobat
>> >
>> > Workaround:
>> >
>> > Currently unavailable.
>> >
>> > Thanks to:
>> >
>> > pdp (at) gnucitizen.org for his investigation
>> >
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVA50ACgkQ+dWaEhErNvSG/wP+KcpZEhZuS5fp8uZd4zEUVgskRCy9
oM9otn0DmulfIY27rkpsdX6fsqPkSc8rgUweWcplkjgCyIsrlco/DPI/oxOgQZZAB3HF
E83WVJ62tQBHSaDfWwSJyNCy1t7xfNI7SNWQJs8EZY2AiizO+pYkkidMZRFfkvRjXRVa
aiH3ltg=
=bWnt
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[Dude VanVinkle]

Someone on FD works for Yambo Financials. lulz

- JP.

On 10/16/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> What is it then?
>
> On Tue, 16 Oct 2007 13:57:55 -0400 [EMAIL PROTECTED] wrote:
> >On Tue, 16 Oct 2007 11:55:17 EDT, [EMAIL PROTECTED]
> >said:
> >> Why am I getting emails like this?
> >
> >Obviously, the spammers have learned the secret of targeted
> >marketing.
> -BEGIN PGP SIGNATURE-
> Note: This signature can be verified at https://www.hushtools.com/verify
> Charset: UTF8
> Version: Hush 2.5
>
> wpwEAQECAAYFAkcVAcQACgkQ+dWaEhErNvSa3gP5AXq4yJqozOQhpaJg/WtXwUcRrxz6
> ncYXpsrN5Lt2ZU3ehbwiTUZHuSq3JCo259u/9+KhL8fM5UBM1YScPnh6GA+dTEB4iGNb
> /aFymB4V26wUXV/NJLk/hcPEWKrxJ08dznUg4qJGYD2q/mT/Voff9OKbtVc8wIBwR+Tf
> 9ddML2Q=
> =VF6Y
> -END PGP SIGNATURE-
>
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[biz4rre]

no, it's my PoC exploit and product of my researching based on public
information that pdp given in his blog

regards,
cyanid-E

2007/10/16, phioust <[EMAIL PROTECTED]>:
>
> is pdp architect releasing more 0day into the wild without his companies
> knowledge? I think this breaks the contract from any serious security
> company.  I believe a message from him explaining his positions on such
> things is appropriate or maybe a message from his employeer about their
> disclosure policies?
>
> On 10/16/07, [EMAIL PROTECTED] < [EMAIL PROTECTED]> wrote:
> >
> > Zero day PDF exploit for Adobe Acrobat
> >
> > Workaround:
> >
> > Currently unavailable.
> >
> > Thanks to:
> >
> > pdp (at) gnucitizen.org for his investigation
> >
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

What is it then?

On Tue, 16 Oct 2007 13:57:55 -0400 [EMAIL PROTECTED] wrote:
>On Tue, 16 Oct 2007 11:55:17 EDT, [EMAIL PROTECTED]
>said:
>> Why am I getting emails like this?
>
>Obviously, the spammers have learned the secret of targeted
>marketing.
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVAcQACgkQ+dWaEhErNvSa3gP5AXq4yJqozOQhpaJg/WtXwUcRrxz6
ncYXpsrN5Lt2ZU3ehbwiTUZHuSq3JCo259u/9+KhL8fM5UBM1YScPnh6GA+dTEB4iGNb
/aFymB4V26wUXV/NJLk/hcPEWKrxJ08dznUg4qJGYD2q/mT/Voff9OKbtVc8wIBwR+Tf
9ddML2Q=
=VF6Y
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] pdp architect, drraid, beastiality, and incest

[phioust]

morning wood what are you doing in a serious discussion about security?
havent you learned your place yet?

On 10/16/07, Morning Wood <[EMAIL PROTECTED]> wrote:
>
> > Do you understand the concept of protecting people and corporations from
> > total idiots trying to gain access to their systems?PDP just lets others
> > know what he found,while the offending company is working on a fix,in a
> > minimal way.
> >
> > If you were a true researcher,you should be able to find the same with
> > the clues he provides.Yay for PDP not feeding script kiddies!
> >
>
> dunno but every sec researcher I know in the private sector would never
> release any info without it being fully authorized by his / her employer.
>
> Possibly we will see these idiots looking for a new job soon?
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] IRM Vendor Alerts: Six critical remote vulnerabilities in TIBCO SmartPGM FX

[phioust]

LOL

Results *1* - *10* of about *464* for *"TIBCO SmartPGM FX"*. (*0.24*seconds)

why does irm waste their research on shit that no one uses? Is irm going to
be the next morning_wood?

ps: thanks for your ollydbg tutorial at http://milw0rm.com/papers/178.
There is not already 1000s of guides online explaining how to set
breakpoints and find imports so thanks for this valuable information.

On 10/16/07, Andy Davis <[EMAIL PROTECTED]> wrote:
>
> IRM have discovered six critical remote vulnerabilities in TIBCO SmartPGM
> FX. Five of these vulnerabilities could potentially result in an attacker
> gaining remote administrative control of the server on which SmartPGM FX is
> running and therefore, also allow access to any data stored on or being
> communicated by the server.
>
> The final vulnerability, a Denial of Service attack, would stop the
> SmartPGM FX service so that file transfers could not be performed.
>
> More information can be found at the following location:
>
> http://www.irmplc.com/index.php/111-Vendor-Alerts
>
> Once TIBCO has produced either workarounds or patches to mitigate these
> vulnerabilities, IRM will release advisories which will include full
> technical details.
>
>
>
> Andy Davis| Chief Research Officer
>
> Information Risk Management Plc
> 8th Floor | Kings Building | Smith Square | London SW1P 3JJ
> Tel: +44 (0) 1242 225 205
> Fax: +44 (0) 1242 225 215
> www.irmplc.com
>
> The information contained in this email is privileged and confidential and
> is intended only for the use of the addressee. Unauthorised disclosure,
> copying or distribution of the contents is strictly prohibited. Please reply
> immediately if you receive this email in error and then immediately delete
> it from your system.
>
> Where relevant, any quotation contained within this email is exclusive of
> VAT at the current rate and valid for 30 days from the date of this email.
> Information Risk Management Plc (IRM) does not authorise the creation of
> contracts on its behalf by email. All information contained within this
> email and its attachments are subject to IRM's standard terms and
> conditions, a copy of which is available upon request.
>
> All attachments have been scanned for viruses using regularly updated
> programs. IRM cannot accept liability for any damage you incur as a result
> of virus infection and we advise that you should carry out such virus and
> other checks as you consider appropriate.
> IRM is a company registered in England with company number 3612719. The
> above address is the official registered office of IRM.
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[phioust]

is pdp architect releasing more 0day into the wild without his companies
knowledge? I think this breaks the contract from any serious security
company.  I believe a message from him explaining his positions on such
things is appropriate or maybe a message from his employeer about their
disclosure policies?

On 10/16/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
>
> Zero day PDF exploit for Adobe Acrobat
>
> Workaround:
>
> Currently unavailable.
>
> Thanks to:
>
> pdp (at) gnucitizen.org for his investigation
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[Valdis . Kletnieks]

On Tue, 16 Oct 2007 11:55:17 EDT, [EMAIL PROTECTED] said:
> Why am I getting emails like this?

Obviously, the spammers have learned the secret of targeted marketing.


pgpgpjUNZ4oyD.pgp
Description: PGP signature
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[Brandon S. Allbery KF8NH]

On Oct 16, 2007, at 11:55 , <[EMAIL PROTECTED]> wrote:
> Why am I getting emails like this?

 because f-d is 99% wanking anyway? 

-- 
brandon s. allbery [solaris,freebsd,perl,pugs,haskell] [EMAIL PROTECTED]
system administrator [openafs,heimdal,too many hats] [EMAIL PROTECTED]
electrical and computer engineering, carnegie mellon universityKF8NH


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Experience masturbation like never before.

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

hahahahahahaha good one

On Tue, 16 Oct 2007 13:05:56 -0400 "Brandon S. Allbery KF8NH"
<[EMAIL PROTECTED]> wrote:
>On Oct 16, 2007, at 11:55 , <[EMAIL PROTECTED]> wrote:
>> Why am I getting emails like this?
>
> because f-d is 99% wanking anyway? 
>
>--
>brandon s. allbery [solaris,freebsd,perl,pugs,haskell]
>[EMAIL PROTECTED]
>system administrator [openafs,heimdal,too many hats]
>[EMAIL PROTECTED]
>electrical and computer engineering, carnegie mellon university
>KF8NH
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcU8NYACgkQ+dWaEhErNvR9owP/dC+6n5drr/gXwOvt2qzp30DUHeW1
a5RsZhDDNrIHzyeTnjVx8YQzM9bm812PpUP/xoLEkN4/DTlO+Z9BJy6Z23c0YOnp9/XN
JlM4ebHF9SJFTXuHxkTSRtVu6IIDD/zBfQw9vPFyY1huTWhecUvUVosJQG+6F+d4yBIK
1agtkIU=
=Gy76
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

You're about as funny as the severity of your hacking tools or
something.

On Tue, 16 Oct 2007 13:07:48 -0400 [EMAIL PROTECTED] wrote:
>negative. just a ':' and ')' concatenated characters
>
>with love,
>cyanid-E
>
>2007/10/16, [EMAIL PROTECTED] [EMAIL PROTECTED]>:
>>
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA1
>>
>> Theoretically that is a smiley face right?
>>
>> On Tue, 16 Oct 2007 11:56:47 -0400 [EMAIL PROTECTED] wrote:
>> >:)
>> >
>> >2007/10/16, [EMAIL PROTECTED] > >[EMAIL PROTECTED]>:
>> >>
>> >> -BEGIN PGP SIGNED MESSAGE-
>> >> Hash: SHA1
>> >>
>> >> Dear 3APAPA,
>> >>
>> >> Please configure your Internet Exploring mechanisms in a
>fashion
>> >> compliant with my exploitation technologies to demonstrate
>the
>> >> severity of my proof of concept attack tools.  Here is a list
>of
>> >> criteria to fulfill to make the hacker attack possible.  This
>is
>> >> severe!  Millions who follow the instructions in detail might
>be
>> >> vulnerable under the right situations sometimes... yawn.
>> >>
>> >> - -JP
>> >>
>> >> On Tue, 16 Oct 2007 11:27:23 -0400 [EMAIL PROTECTED] wrote:
>> >> >...some additional information about 0day PDF exploit PoC:
>> >> >
>> >> >Please download and open PDF PoC _locally_ in Adobe Acrobat
>> >(not
>> >> >in Adobe
>> >> >Acrobat ActiveX control
>> >> >because of some internal restrictions within Adobe ActiveX,
>it
>> >may
>> >> >be
>> >> >bypassed via:
>> >> >http://seclists.org/bugtraq/2007/Oct/0213.html but i didn't
>> >made
>> >> >tests).
>> >> >
>> >> >Also make sure that "mailto" handler is set to Internet
>> >Explorer 7
>> >> >(any 3rd
>> >> >party mail
>> >> >clients is not installed).
>> >> >
>> >> >PoC tested on WinXP SP2 Eng updated + Internet Explorer 7 +
>> >Adobe
>> >> >Acrobat
>> >> >Reader 8.1
>> >> >
>> >> >PoC: http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf
>> >> >Details: http://security.fedora-
>> >hosting.com/0day/pdf/pdf_poc.txt
>> >> >
>> >> >
>> >> >regards,
>> >> >cyanid-E <[EMAIL PROTECTED]>
>> >> -BEGIN PGP SIGNATURE-
>> >> Note: This signature can be verified at
>> >https://www.hushtools.com/verify
>> >> Charset: UTF8
>> >> Version: Hush 2.5
>> >>
>> >>
>>
>>wpwEAQECAAYFAkcU2sAACgkQ+dWaEhErNvTD2AP9GWi6tgjXfSS6mmSEcNXCngEnJA
>X
>> >f
>> >>
>>
>>8p8i57pby3KmK6Os29OeesSIedRgM81MxrF8bZ2itPpNYtyrVAC5ztWEfAVJDP01z9
>C
>> >L
>> >>
>>
>>93B9OS/IdedZSvXokQAHrtEdO6wZHarddeE772GG3RfWlY5a/SA8agWUIkGAALugJy
>v
>> >R
>> >> gPyqE40=
>> >> =sCNw
>> >> -END PGP SIGNATURE-
>> >>
>> >>
>> >>
>> -BEGIN PGP SIGNATURE-
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>> Charset: UTF8
>> Version: Hush 2.5
>>
>>
>wpwEAQECAAYFAkcU7oUACgkQ+dWaEhErNvTuzAP/bgT6FkLr1a/g4ICZ+G+vIFympNG
>2
>>
>LRHvwum/30YdR4i3SCeASVioRI7N4Cty6cH0jKjF2DMp/uRJORsdHFXv4lJnquGo2lV
>H
>>
>li1RC5L8XsJkQ15S6MlHfIGPUvQri60h8DZwEtHn5eKzi8pQmTcBR8EKq9LkbrCMrnM
>l
>> ObNbaRU=
>> =gaS9
>> -END PGP SIGNATURE-
>>
>>
>>
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcU8MgACgkQ+dWaEhErNvR8pQP/d3WTIy9grtZOnVXBUkIGN8PskQkY
9c/UqQwTsWYvhbH18zcwI/5KGeBRKU3EoNvSsg2fVUQMAlG+V7HkkcVB389RkrntSlsq
nLDBDy5e6Rf7lGsENwCT0RWq8nCIhO7cKjrMGaUfR/jC5c4F13JJEgqC4j20wjG9FP6Y
aoH2Qms=
=ZERQ
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] pdp architect, drraid, beastiality, and incest

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

LOL

On Tue, 16 Oct 2007 12:35:57 -0400 Morning Wood
<[EMAIL PROTECTED]> wrote:
>> Do you understand the concept of protecting people and
>corporations from
>> total idiots trying to gain access to their systems?PDP just
>lets others
>> know what he found,while the offending company is working on a
>fix,in a
>> minimal way.
>>
>> If you were a true researcher,you should be able to find the
>same with
>> the clues he provides.Yay for PDP not feeding script kiddies!
>>
>
>dunno but every sec researcher I know in the private sector would
>never
>release any info without it being fully authorized by his / her
>employer.
>
>Possibly we will see these idiots looking for a new job soon?
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcU7mUACgkQ+dWaEhErNvSvkwP+MOv7/viMMSZM+0MjjoO7Zw85d77U
UqixbZf1SqnWSb/MyxlAYd8YSbRLzVU4nKFyvxH8Y6xBGODIYZ99Cd1TnMnKngWlcEME
V24jpRerL0q6Mi0e37El+4ooHlAzgpklzLCRUPSsAn/RxUdvkOy3Ys+u30nzR8wNOY5m
9wSj0jk=
=vUn5
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] pdp architect, drraid, beastiality, and incest

[Morning Wood]

> Do you understand the concept of protecting people and corporations from
> total idiots trying to gain access to their systems?PDP just lets others
> know what he found,while the offending company is working on a fix,in a
> minimal way.
> 
> If you were a true researcher,you should be able to find the same with
> the clues he provides.Yay for PDP not feeding script kiddies!
> 

dunno but every sec researcher I know in the private sector would never
release any info without it being fully authorized by his / her employer.

Possibly we will see these idiots looking for a new job soon?

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] IRM Vendor Alerts: Six critical remote vulnerabilities in TIBCO SmartPGM FX

[Andy Davis]

IRM have discovered six critical remote vulnerabilities in TIBCO SmartPGM FX. 
Five of these vulnerabilities could potentially result in an attacker gaining 
remote administrative control of the server on which SmartPGM FX is running and 
therefore, also allow access to any data stored on or being communicated by the 
server.

The final vulnerability, a Denial of Service attack, would stop the SmartPGM FX 
service so that file transfers could not be performed.

More information can be found at the following location:

http://www.irmplc.com/index.php/111-Vendor-Alerts

Once TIBCO has produced either workarounds or patches to mitigate these 
vulnerabilities, IRM will release advisories which will include full technical 
details.



Andy Davis | Chief Research Officer

Information Risk Management Plc
8th Floor | Kings Building | Smith Square | London SW1P 3JJ
Tel: +44 (0) 1242 225 205
Fax: +44 (0) 1242 225 215
www.irmplc.com

The information contained in this email is privileged and confidential and is 
intended only for the use of the addressee. Unauthorised disclosure, copying or 
distribution of the contents is strictly prohibited. Please reply immediately 
if you receive this email in error and then immediately delete it from your 
system.

Where relevant, any quotation contained within this email is exclusive of VAT 
at the current rate and valid for 30 days from the date of this email. 
Information Risk Management Plc (IRM) does not authorise the creation of 
contracts on its behalf by email. All information contained within this email 
and its attachments are subject to IRM's standard terms and conditions, a copy 
of which is available upon request.

All attachments have been scanned for viruses using regularly updated programs. 
IRM cannot accept liability for any damage you incur as a result of virus 
infection and we advise that you should carry out such virus and other checks 
as you consider appropriate.
IRM is a company registered in England with company number 3612719. The above 
address is the official registered office of IRM.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] FW: [Dailydave] Canada's Response to Black Hat - SecTor 2007

[Taylor, Gord]

www.SecTor.ca - Join world IT Security experts at Security Education
Conference Toronto, running two full days, November 20-21. 

Collaborate with your peers and learn from the likes of Ira Winkler,
Steve Riley, Johnny Long, Mark Fabro, Dan Kaminsky, Kevin Mandia,
Renderman and Joanna Rutkowska. 

This is hardcore security education, not a vendor fair. 

SecTor is bringing the world's brightest (and darkest) minds together to
identify, discuss, dissect and debate the latest digital threats facing
corporations today.  Visit the site for more details.
___

This e-mail may be privileged and/or confidential, and the sender does not 
waive any related rights and obligations.
Any distribution, use or copying of this e-mail or the information it contains 
by other than an intended recipient is unauthorized.
If you received this e-mail in error, please advise me (by return e-mail or 
otherwise) immediately.  

Ce courrier électronique est confidentiel et protégé. L'expéditeur ne renonce 
pas aux droits et obligations qui s'y rapportent.
Toute diffusion, utilisation ou copie de ce message ou des renseignements qu'il 
contient par une personne autre que le (les) destinataire(s) désigné(s) est 
interdite.
Si vous recevez ce courrier électronique par erreur, veuillez m'en aviser 
immédiatement, par retour de courrier électronique ou par un autre moyen.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Fwd: Experience masturbation like never before.

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Why am I getting emails like this?

- - Forwarded message from Alexander Murdock
<[EMAIL PROTECTED]> -
It so hard to find a virgin nowadays. With the Personal Puss! your
dreams come true! Ordering your Personal Puss! you'll receive a
virgin pussy and experience new sensations of breaking the hymen.
   Try this really amazing Personal Puss! that gives you a
sensation of a nice hot and gooey pussy. Designed to be soft
stretchable and allow you a proper firm grip, it is made of the
best modern materials, safe and non-allergic.

http://dbbride.com

 Your own Personal Puss! is just waiting for you.
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcU3uUACgkQ+dWaEhErNvQ71QP5Aezm7O5wI15UnBoNm4hpJ7anNSNn
0qRMv1PW5ZEoWuEht/XJLrpITVORFppLEMGUPneBrJOYDWlKL+qga5n0wNqkwQAQEpSY
ggdFtRM5+mzULv5V4+L85uAM+X6SUXWgFLO9VqD//EggDpc+1Uv0D5HIKSXToJBh0jPw
jYqXjjA=
=GOkK
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] 0-day PDF exploit

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Dear 3APAPA,

Please configure your Internet Exploring mechanisms in a fashion
compliant with my exploitation technologies to demonstrate the
severity of my proof of concept attack tools.  Here is a list of
criteria to fulfill to make the hacker attack possible.  This is
severe!  Millions who follow the instructions in detail might be
vulnerable under the right situations sometimes... yawn.

- -JP

On Tue, 16 Oct 2007 11:27:23 -0400 [EMAIL PROTECTED] wrote:
>...some additional information about 0day PDF exploit PoC:
>
>Please download and open PDF PoC _locally_ in Adobe Acrobat (not
>in Adobe
>Acrobat ActiveX control
>because of some internal restrictions within Adobe ActiveX, it may
>be
>bypassed via:
>http://seclists.org/bugtraq/2007/Oct/0213.html but i didn't made
>tests).
>
>Also make sure that "mailto" handler is set to Internet Explorer 7
>(any 3rd
>party mail
>clients is not installed).
>
>PoC tested on WinXP SP2 Eng updated + Internet Explorer 7 + Adobe
>Acrobat
>Reader 8.1
>
>PoC: http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf
>Details: http://security.fedora-hosting.com/0day/pdf/pdf_poc.txt
>
>
>regards,
>cyanid-E <[EMAIL PROTECTED]>
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcU2sAACgkQ+dWaEhErNvTD2AP9GWi6tgjXfSS6mmSEcNXCngEnJAXf
8p8i57pby3KmK6Os29OeesSIedRgM81MxrF8bZ2itPpNYtyrVAC5ztWEfAVJDP01z9CL
93B9OS/IdedZSvXokQAHrtEdO6wZHarddeE772GG3RfWlY5a/SA8agWUIkGAALugJyvR
gPyqE40=
=sCNw
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] 0-day PDF exploit

[biz4rre]

...some additional information about 0day PDF exploit PoC:

Please download and open PDF PoC _locally_ in Adobe Acrobat (not in Adobe
Acrobat ActiveX control
because of some internal restrictions within Adobe ActiveX, it may be
bypassed via:
http://seclists.org/bugtraq/2007/Oct/0213.html but i didn't made tests).

Also make sure that "mailto" handler is set to Internet Explorer 7 (any 3rd
party mail
clients is not installed).

PoC tested on WinXP SP2 Eng updated + Internet Explorer 7 + Adobe Acrobat
Reader 8.1

PoC: http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf
Details: http://security.fedora-hosting.com/0day/pdf/pdf_poc.txt


regards,
cyanid-E <[EMAIL PROTECTED]>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] pdp architect, drraid, beastiality, and incest

[full-disclosure]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

What have you ever done for security

On Tue, 16 Oct 2007 01:13:41 -0400 scott
<[EMAIL PROTECTED]> wrote:
>Do you understand the concept of protecting people and
>corporations from
>total idiots trying to gain access to their systems?PDP just lets
>others
>know what he found,while the offending company is working on a
>fix,in a
>minimal way.
>
>If you were a true researcher,you should be able to find the same
>with
>the clues he provides.Yay for PDP not feeding script kiddies!
>
>
>
>phioust wrote:
>> While it may be immature to make fun of pdp architect and drraid
>about
>> incest and beastiality while its probably not true, I still
>wonder why they
>> would post info about vulnerabilities only to not release them.
>The only
>> thing i can think of is 'fame' and its obviously working against
>them.
>>
>> "*pdp architect, drraid, beastiality, and incest"*
>>
>> On 10/15/07, scott <[EMAIL PROTECTED]> wrote:
>>
>>> Why don't you grow up and go away!
>>>
>>>
>>> [EMAIL PROTECTED] wrote:
>>>
 What do these things have in common?

 Well for one pdp and drraid share an extremme fetish for sick
>porn,
 but also they love to post info on "future" ( read non-
>existant )
 0day/exploits that they have possession of. As noted in
>previous
 research [1] drraid posted claims of ssh 0day [2] which were
>never
 verified and no advisory has been made. Our email to Avert
>labs at
 McAfee went unanswered. We still wonder why its employees are
 holding 0day information from the public.

 We also wonder why pdp architect ( incest fetish lover ) makes
 similar types of posts [3] about skype when he works for a
 pentration testing company. We have also heard news that pdp
>is
 using 0day xss bugs in incestboards.com to view the members
>only
 board where he shares stories about love affaris between him,
>his
 dog, and his grandfather.

 To pdp architect: incest isnt natural no matter how good it
>feels.
 [4]

 ps: many lulz @ [5]

 [1] http://seclists.org/fulldisclosure/2007/Sep/0705.html
 [2] http://drraid.blogspot.com/2007/09/ssh-keep-it-secret.html
 [3] http://www.gnucitizen.org/about/pdp#comment-50201
 [4] http://www.way2hope.org/incest_survivors_help.htm
 [5] http://www.gnucitizen.org/about/pdp#comment-3

 imul martinez (heil brazil)
 (imul AT hushmail DOT com)
 Food Director of lul-disclosure Corp.

>>> ___
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>>
>>>
>>> ___
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>>
>>
>>
>> -
>---
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcUwAkACgkQ+dWaEhErNvQaKwP+J23QcLECyvOmIadv4ideZwX7iMRL
ObqbPA04OWoExesLA+EAZBvXQtH/+iEVN6UmKK7LT5Dq/rR3vHEEoON10UVvLy9acZJb
l9XKMsB0GcdxDcJ3CiZeBUUimgNTjoFy90GLjvWBx77/idyLBQyeGceJTXXfhG4c51B8
27dtExw=
=/feB
-END PGP SIGNATURE-


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [EMAIL PROTECTED]

[Joey Mengele]

More valid technical content has come from hushmail.com than from 
your lava.net bullshit LOLOLOLOLOLOL. Stop running your mouth Peter!

J

On Mon, 15 Oct 2007 02:53:59 -0400 Peter Besenbruch <[EMAIL PROTECTED]> 
wrote:
>[EMAIL PROTECTED] wrote:
>> Some people don't know when to quit when they're behind.  Thank 
>you for volunteering to be the first on my ban list.  Your 
>stupidity has been duly rewarded.
>
>I small tip: Ban all of Hushmail. Nothing good ever comes from 
>that domain.
>
>-- 
>Hawaiian Astronomical Society: http://www.hawastsoc.org
>HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] 0-day PDF exploit

[biz4rre]

Zero day PDF exploit for Adobe Acrobat


Link to exploit:

Please download and open it locally in Adobe Acrobat (not in Adobe Acrobat
ActiveX control):

http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf


Description:

0-day proof of concept (PoC) exploit for Adobe Acrobat.


Software affected:

+ Adobe Reader 8.1 (and earlier)
+ Adobe Acrobat Standard, Pro and Elements 8.1 (and earlier)
+ Adobe Acrobat 3D


System affected:

+ Windows XP with IE7


Details:

To view exploit code in Adobe Acrobat go to: Pages -> Page Properties ->
Actions
(trigger: Page Open, action: Open a web link)

This is URL handling bug in shell32!ShellExecute()


Workaround:

Currently unavailable.


Thanks to:

pdp (at) gnucitizen.org for his investigation


regards,
cyanid-E <[EMAIL PROTECTED]>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/