from:"Ivan ."

[Full-disclosure] How a teenager helpfully reported a government security flaw – and could be charged in return

2014-01-23 Thread Ivan .Heca

In Australia, individuals who report critical security flaws face potential
legal action, while corporations who fail to report data breaches to paying
customers go unpunished

http://www.theguardian.com/commentisfree/2014/jan/24/how-a-teenager-helpfully-reported-a-government-security-flaw-and-could-be-charged-in-return
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] WordPress User Account Information Leak / Secunia Advisory SA23621

2013-07-04 Thread Ivan Carlos

Can't you open a new bt about this issue?

Regards,
Em 04/07/2013 10:16, Sven Kieske svenkie...@gmail.com escreveu:

 Hi,

 the mentioned User account Enumeration Weakness
 stated in Advisory https://secunia.com/advisories/23621/
 still exists in the actual version 3.5.2 .

 The corresponding trac entry for wordpress is closed as
 wontfix:
 https://core.trac.wordpress.org/ticket/1129

 Why?

 Maybe, because the trac bug mentions just version 1.5 as affected?

 I can easily reproduce this in version 3.5.2 .

 Please fix this, this bug is 8 years old!

 Kind Regards

 Sven Kieske

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Why PRISM kills the cloud | Computerworld Blogs

2013-06-12 Thread Ivan .Heca

Thw commercial espionage angle is another interesting aspect of this

http://www.techdirt.com/articles/20130611/10014923405/is-us-using-prism-to-engage-commercial-espionage-against-germany-others.shtml
On 13/06/2013 3:08 AM, Michael Hallgren m.hallg...@free.fr wrote:


 http://www.internetsociety.org/news/internet-society-statement-importance-open-global-dialogue-regarding-online-privacy

 mh

 Le 12/06/2013 16:05, William Reyor a écrit :
  * are protected -- fixed that for ya.
 
  - William Reyor
 
  On Jun 12, 2013, at 10:01 AM, laurent gaffie laurent.gaf...@gmail.com
 wrote:
 
  is protected
  ___
  Full-Disclosure - We believe in it.
  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
  Hosted and sponsored by Secunia - http://secunia.com/

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Why PRISM kills the cloud | Computerworld Blogs

2013-06-11 Thread Ivan .Heca

Maybe all is forgiven if they discount enough

http://www.networkworld.com/news/2013/061113-google-amazon-cloud-270730.html?hpg1=bn
A Canadian and what appears to be a British subject discussing the not
so finer points of American legislation. I'm sure at some point the
irony will become apparent.

On Tue, Jun 11, 2013 at 6:58 PM, Philip Whitehouse phi...@whiuk.com wrote:

 Seems like some people spend way to much time focusing on the second
 amendment rather than the first one...

 Well this relates mainly to the fourth amendment, not the first. The first
 tends to get decent coverage. Publication of the leak by journalists is
the
 only under the realm of the first.

 Philip Whitehouse

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Why PRISM kills the cloud | Computerworld Blogs

2013-06-10 Thread Ivan .Heca

http://m.blogs.computerworld.com/cloud-storage/22305/why-prism-kills-cloud
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Why PRISM kills the cloud | Computerworld Blogs

2013-06-10 Thread Ivan .Heca

A number of cloud provider business plans will need tweaking now
On 11/06/2013 11:30 AM, Jeffrey Walton noloa...@gmail.com wrote:

 On Mon, Jun 10, 2013 at 9:15 PM, laurent gaffie
 laurent.gaf...@gmail.com wrote:
  Why is the Prims program such a big deal today?  Most of us  knew about
  echelon and the patriot act didn't we? This program was unconstitutional
 at
  the first place and should have raised indignation when it was approved
 at
  that time...
 +1.

 Below is my standard verbiage on clouds and backups to clouds.

 Jeff

 clouds and drop boxes. If you don’t want your data analyzed,
 inspected, shared, or mishandled, then don’t provide it in the first
 place. Data migration includes backups, so ensure you are using the
 proper attributes on your files. For Apple systems, the file should
 have kCFURLIsExcludedFromBackupKey file property or
 com.apple.MobileBackup extended attribute (see Technical QA QA1719
 for details). Android applications should add android:allowBackup on
 the application tag and set it to false in AndroidManifest.xml.
 Windows’ integrated cloud backup is new, and there’s currently no way
 for an application to back up to the cloud (and hence, no way to stop
 it).

 A layman’s analysis of License Agreements and Terms and Conditions
 will reveal how little security is afforded to your documents in cloud
 storage. For those who don’t read them, one popular platform has 142
 separate documents covering Terms of Conditions for its cloud
 alone.[18] The documents discuss your rights if the company (1) gives
 away your data, (2) shares you data with partners, (3) looses your
 data, (4) provides your data to authorities (sometimes without an
 order or warrant), (5) does not provide reasonable skill or care, (6)
 commits willful misconduct or fraud, and (7) acts with negligence or
 gross negligence. “Your rights” is misleading since it is consent, and
 the document effectively states you indemnify the company: “You agree
 to defend, indemnify and hold [company], its affiliates, subsidiaries,
 directors, officers, employees, agents, partners, contractors, and
 licensors harmless from any claim or demand, including reasonable
 attorneys’ fees, made by a third party.”[19]

 [18] iCloud Terms and Conditions,
 https://www.apple.com/legal/internet-services/icloud/ww/
 [19] iCLOUD TERMS AND CONDITIONS,
 https://www.apple.com/legal/internet-services/icloud/en/terms.html

  Le 2013-06-10 19:46, Ivan .Heca ivan...@gmail.com a écrit :
 
 
 http://m.blogs.computerworld.com/cloud-storage/22305/why-prism-kills-cloud
 

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] cloudsafe365 for wordpress: file disclosure

2012-08-28 Thread Ivan Carlos

I suppose that's fixed, or they just disabled the plugin itselfon his wp

Ivan Carlos
CISO, Consultant
+55 (11) 98112-0666
www.icarlos.net

-Original Message-
From: full-disclosure-boun...@lists.grok.org.uk 
[mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of Henri Salo
Sent: terça-feira, 28 de agosto de 2012 07:47
To: Christian Sciberras
Cc: full-disclosure@lists.grok.org.uk
Subject: Re: [Full-disclosure] cloudsafe365 for wordpress: file disclosure

On Tue, Aug 28, 2012 at 11:00:25AM +0200, Christian Sciberras wrote:
 So this plugin supposedly helps securing a website?

I do not know anything about this plugin but at least we can coordinate the 
fixes or get the plugin disabled so that more people don't start using it.

- Henri Salo

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Tech journalists: Stop hyping unproven security tools

2012-08-12 Thread Ivan .Heca

*Cui bono

*
http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html?utm_source=Contextlyutm_medium=RelatedLinksutm_campaign=AroundWeb

ouch

http://blog.alexanderhiggins.com/2012/08/10/experts-idiots-war-security-165251/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] hacking FB Ads

2012-08-01 Thread Ivan .Heca

interesting bit of research

“A couple months ago, when we were preparing to launch the new Limited Run,
we started to experiment with Facebook ads. Unfortunately, while testing
their ad system, we noticed some very strange things. Facebook was charging
us for clicks, yet we could only verify about 20% of them actually showing
up on our site. At first, we thought it was our analytics service. We tried
signing up for a handful of other big name companies, and still, we
couldn’t verify more than 15-20% of clicks. So we did what any good
developers would do. We built our own analytic software. Here’s what we
found: on about 80% of the clicks Facebook was charging us for, JavaScript
wasn’t on. And if the person clicking the ad doesn’t have JavaScript, it’s
very difficult for an analytics service to verify the click.

What’s important here is that in all of our years of experience, only about
1-2% of people coming to us have JavaScript disabled, not 80% like these
clicks coming from Facebook. So we did what any good developers would do.
We built a page logger. Any time a page was loaded, we’d keep track of it.
You know what we found? The 80% of clicks we were paying for were from
bots. That’s correct. Bots were loading pages and driving up our
advertising costs.”

http://techcrunch.com/2012/07/30/startup-claims-80-of-its-facebook-ad-clicks-are-coming-from-bots/

http://blog.alexanderhiggins.com/2012/07/31/latest-facebook-scandal-widespread-advertising-fraud-156521/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Congress Capitulates To TSA; Refuses To Let Bruce Schneier Testify

2012-03-26 Thread Ivan .Heca

http://yro.slashdot.org/story/12/03/26/2221246/congress-capitulates-to-tsa-refuses-to-let-bruce-schneier-testify
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Stakeout: how the FBI tracked and busted a Chicago Anon

2012-03-07 Thread Ivan .Heca

*Yesterday, we learned that one of the top members of LulzSec (Sabu) had
been an FBI informant for almost 6
monthshttp://tech.slashdot.org/story/12/03/06/1437241/lulzsec-leader-sabu-unmasked-arrested-and-caught-collaborating,
and that this confidant of the LulzSec leader 'anarchaos' had given the
feds what they needed to take him down. More details have come out
nowhttp://arstechnica.com/tech-policy/news/2012/03/stakeout-how-the-fbi-tracked-and-busted-a-chicago-anon.ars,
completing a picture of how the sting took place from start to finish. It
turns out that even the server space given from Sabu to anarchaos storing
the details of 30,000 credit cards (from the Stratfor hack) had been funded
by the FBI.

*
http://arstechnica.com/tech-policy/news/2012/03/stakeout-how-the-fbi-tracked-and-busted-a-chicago-anon.ars
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Full disclosure is arrest of Sabu

2012-03-06 Thread Ivan .Heca

http://gizmodo.com/5890825/lulzsec-leader-betrays-all-of-anonymous

On Wed, Mar 7, 2012 at 10:43 AM, Sanguinarious Rose 
sanguiner...@occultusterra.com wrote:

 lol, as far as I know she didn't accuse nenolod of a botnet, you did
 and said he built the botnet for her from what it looks like to me.
 Then you went on an epic lulz spree comparable to that of a retarded
 child trying to bit his ear calling it winning.

 Sorry, forgot to add FD in the to field

 On Tue, Mar 6, 2012 at 4:35 PM, Laurelai laure...@oneechan.org wrote:
  On 3/6/2012 5:32 PM, Sanguinarious Rose wrote:
  I raise you this: http://pastebin.com/R3AL0im6
 
  On Tue, Mar 6, 2012 at 3:51 PM, Laurelai laure...@oneechan.org wrote:
  On 3/6/2012 2:24 PM, Ferenc Kovacs wrote:
 
 
  2011/7/25 Laurelai Storm laure...@oneechan.org
  Oh and im not a part of lulzsec, FYI sabu tweeted 2 minutes ago wtf
 are
  you on about sir?
 
  maybe we could resurrect this thread. :)
 
  Sure lets.
 
  http://gizmodo.com/5890825/lulzsec-leader-betrays-all-of-anonymous
 
  Im going to paste my favorite part of this article.
 
  6:12:32 PM virus: I don't have proof of him being a snitch, and he
 doesn't
  have proof of me being a snitch. it's my word against his.
  6:15:39 PM virus: he disappeared for a week, I don't recall what day
  6:15:52 PM virus: but when he returned he said his grand mother died
 and
  that's why he was MIA
  6:16:01 PM virus: after that he started offering me money to own people
  6:16:14 PM Sam Biddle: anyone important?
  6:16:55 PM virus: backtrace security and laurelai
  6:17:22 PM virus: he gave me IPs, asked me to access their accounts
 with
  their IP and asked me to access their emails
  6:17:25 PM virus: told me he would pay me
  6:17:42 PM Sam Biddle: did you?
  6:17:53 PM virus: no, I found that to be suspicious and declined
 
  Sabu tried to pay someone to hack me and it didn't work, sabu also got
  caught because he connected to IRC one time with his real IP, so this
 proves
  what i said already, sabu hated me and i didn't know anything that the
 feds
  didn't already. For a supposed ring leader of a group of master cyber
  terrorists as the feds like to paint them they couldn't take down one
 loud
  mouthed trans woman on the internet. Hell even their ddos against my
  imageboard failed and i didn't even have cloudflare.
 
 
  And speaking of backtrace security here is Jen giving away government
  secrets to win internet points on reddit
 
  http://imgur.com/a/0g9VG
 
  Looks like Jen can't be trusted by anon or the feds.
 
 
 
 
  ___
  Full-Disclosure - We believe in it.
  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
  Hosted and sponsored by Secunia - http://secunia.com/
  Sorry sanguine i had too, i do feel bad about lying to you. I figured
  she would hear about it and she would go full retard on nenolod , and
  she did today. She can't help herself . This of course was great timing
  with the screenshots so im pretty sure her days as a fed contractor are
  over since her dumb ass accused the creator of dronebl of having a
 botnet.

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Carrier IQ for your phone

2011-12-13 Thread Ivan .Heca

http://www.gizmodo.com.au/2011/12/carrier-iq-explains-what-it-does-with-your-data/

On Wed, Dec 14, 2011 at 9:06 AM, coderman coder...@gmail.com wrote:

 On Sat, Dec 3, 2011 at 4:14 AM, Alan J. Wylie
 shyyqvfpybf...@wylie.me.uk wrote:
  ...
  Interesting response from Carrier IQ in a long article on The Register:
 
  http://www.theregister.co.uk/2011/12/02/carrier_iq_interview/


 interesting response from FBI in regards to Carrier IQ

 http://www.muckrock.com/news/archives/2011/dec/12/fbi-carrier-iq-files-used-law-enforcement-purposes/

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Carrier IQ for your phone

2011-12-13 Thread Ivan .Heca

another nice one

http://www.techdirt.com/blog/wireless/articles/20111213/00271717060/fbi-admits-that-it-uses-carrier-iq-law-enforcement-purposes-wont-say-how.shtml

On Wed, Dec 14, 2011 at 10:19 AM, coderman coder...@gmail.com wrote:

 On Tue, Dec 13, 2011 at 2:50 PM, Ivan .Heca ivan...@gmail.com wrote:
 
 http://www.gizmodo.com.au/2011/12/carrier-iq-explains-what-it-does-with-your-data/

 
 These logs [full debug, keylogging, etc.] are generated on phones sold
 with the Carrier IQ program preloaded but the company says it’s
 working with manufacturers and networks to adjust the certification
 process and turn off debugging messages when the phone is activated.
 

 what a convenient little bit to flip. debug mode on!
 anyone else found a way to toggle this remotely? :)

 also fun:
  https://collector.iota.spcsdns.net:10003/collector/
 anyone got a list of other iq collector URLs?

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Researchers Uncover 'Massive Security Flaws' In Amazon Cloud

2011-11-06 Thread Ivan .

http://www.crn.com/news/cloud/231901911/researchers-uncover-massive-security-flaws-in-amazon-cloud.htm;jsessionid=kT0u8aBKblF5Y14-kIidtA**.ecappj03
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [OT] Obama said: American people understand that not everybody's been following the rules

2011-10-16 Thread Ivan .

15 Mind-Blowing Facts About Wealth And Inequality In America
http://www.businessinsider.com/facts-about-inequality-in-america-2011-11?op=1

On Sat, Oct 15, 2011 at 12:58 PM, Laurelai laure...@oneechan.org wrote:

  On 10/14/2011 8:21 PM, Christian Sciberras wrote:

 You think I'm biting that?

  Skinny and under-age  is just about everything you could come up with.
 Congrats for creativity.

  Just because two of you decided you found common grounds for insult
 doesn't mean you're god-almighty-indisputably-right in every piece of shit
 you come up with. Did I mention it's shit?

  With that, I give you one, you have a point, I should have stopped
 responding ever since some guy decided to equate a couple dozen of people
 into America's 1%.

  Strange, thought security guys would have been better with numbers...






 On Sat, Oct 15, 2011 at 2:32 AM, Laurelai laure...@oneechan.org wrote:

   On 10/14/2011 6:32 PM, xD 0x41 wrote:

 Cristiano , per favor' mi dai dieci minuti scusa mi ma, e' essentiale ..
 You really dont realise how much, you attack others when they post,
 NOMATTER what the topic... yet you are still wondering why somany people
 seem to despise your skinny little nerdy ass... well, nerdy isnt bad, but,
 your a downright lookalike for mr.Bean aka rowan atkinson. You could maybe
 do his stunts, to ?
 Your the one who is usually abusing others, before the finality wich is
 simply adults not reesponding, to the baby whos crying out for more
 aarguements.
 You should stfu, and learn more, you assume to know all, in every post,
 your the brain, yet you are lame, i looked everything up abiout you, and
 yes, go ahead, and setup a nice wordpress secure setting, php wise to,  then
 yes, id maybe hink your atleast a halfwit ;)
 Anyhow, your basically a tr0ll, and, you seem to keep goading, even AFTER
 the others, have completely stopped responding to you, simply because,
 Laurelai was right, why would anyone want to keep up a thread wich has now
 turned malign, as i forsaw a week ago, but, i did not think it would even
 make a week, People like you, keep inspiring the flame to burn brighter..
 wich to me, is nastier than any *abuse* names, wich, you clearly have not
 counted howmany times you have actually called others, some form of rude
 name/word/personal attack.
 Maybe when you GROW UP, and behave as an adult, then I would assume the
 list will start to hear you, even through the bs.
 Anyhow, i applaud you, for *coming out* as to say, I mean, putting your
 pic up, like that, mate, you could be a pornstar! what you doin online
 :P~~~bahahaha
 go back to grade.2 then repeate it, then move on... then, if you work out
 how to call 911, call someone who gives a shit.
 Idiotic kid, grow the hell up.
 xd--

 // IND SEC CONSILTANT FOR Yep yep Security (simply coz it sounds good) YEP
 YEP for all your Hat attire needs!

 On 15 October 2011 08:57, Christian Sciberras uuf6...@gmail.com wrote:

 Yeah, let's just all ignore low insults. The world would be a much better
 place without them and whoever said them in the first place...








 On Fri, Oct 14, 2011 at 11:02 PM, Laurelai laure...@oneechan.orgwrote:

   On 10/14/2011 2:25 PM, Christian Sciberras wrote:

 Resorting to personal attacks? Nice.

  Technical skills in what? Running a wordpress blog? Defacing a
 website? Growing pot?

  I rarely publicise any materials, most of the time I just tell whoever
 is responsible to do a fix.
 I'm not really running after publicity, unlike you guys.
 Also note that I never said I'm a seasoned hacker... in fact, my
 occupation is quite on the opposite side of the spectrum...

  You also seem to know more than I do what the Ubuntu VM I have
 contains.

  But that must make all the difference! I mean, people that don't know
 qubits from bits shouldn't be allowed in such discussions
 (of course there's wikipedia...)




 On Fri, Oct 14, 2011 at 6:38 PM, Georgi Guninski gunin...@guninski.com
  wrote:

 Christian Sciberras,

 I have trouble judging your technical skills - all I have seen is bad
 smalltalk.

 Do you have any technical publications you can share so I can judge?

 btw, the best i found was you could could reproduce a bug in a CMS and
 in addition you can't tell root from user password on vanilla ubuntu.

 --
 joro

 On Fri, Oct 14, 2011 at 02:11:13AM +0200, Christian Sciberras wrote:
   So if they cause damage for profit that makes it ok?
 
  No. But it's certainly better than doing damage without profit.
 Making
  profit means that at the end of the day, the money's going to go
 somewhere
  further in the chain.
  Flattening a tower, for instance, or attacking the local bank that
 refused
  to give you a loan because of the time you spent in a cell, isn't as
  productive.
  Neither is it making a company loose clients/profit just because they
  decided they don't want you to use their services (as if you did have
 a
  right in the first place...).
 
   And yes I acknowledge the American public has a

[Full-disclosure] Meet the Guy Who Snitched on Occupy Wall Street to the FBI and NYPD

2011-10-16 Thread Ivan .

http://gawker.com/5850054/meet-the-guy-who-snitched-on-occupy-wall-street-to-the-fbi-and-nypd
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Two Remote Code Execution Vulnerabilities in Internet Explorer

2011-10-13 Thread Ivan Fratric

###
Vulnerability 1: Internet Explorer Select Element Remote Code Execution
###

Original advisory:
http://ifsec.blogspot.com/2011/10/internet-explorer-select-element-remote.html

I. OVERVIEW

There is a vulnerability in Internet Explorer which enables execution
of arbitrary code if the user visits a web page controlled by the
attacker. The vulnerability is caused by incorrectly validating
integer parameter passed to the 'add' method of the Select HTML
element. This vulnerability has been observed in Internet Explorer 8.
The vulnerability has been patched by Microsoft on October 11, 2011.

II. THE BUG

The bug is caused by incorrectly validating integer parameter passed
to the 'add' method of the Select HTML element under certain
conditions. The 'add' method of the Select HTML element is used to add
an Option to the Select element. It accepts two parameters:
1. An Option object to be added
2. An integer, specifying the index of the new Option element
Under certain conditions, the second parameter is not properly
validated, which can lead to corrupting memory at arbitrary address
and, in turn, code execution.

III. IMPACT

The vulnerability can be used to execute arbitrary code in the context
of the currently logged in user if the user visits a specially crafted
web page. JavaScript needs to be enabled in order for the attacker to
be able to exploit the vulnerability (it is enabled by default in all
versions of Internet Explorer).

IV. PoC

A PoC exploit that demonstrates reliable code execution on Internet
Explorer 8 on Windows 7 SP1 has been developed. The release of the
exploit code is planned on a later date, once everyone has had plenty
of time to patch.
However, the description of the method that was used to bypass ASLR
and otherwise enable reliable code execution can be found here:
http://ifsec.blogspot.com/2011/06/memory-disclosure-technique-for.html

V. REFERENCES

http://ifsec.blogspot.com/2011/10/internet-explorer-select-element-remote.html
http://technet.microsoft.com/en-us/security/bulletin/ms11-081
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1999
http://www.zerodayinitiative.com/advisories/published/


###
Vulnerability 2: Internet Explorer Option Element Remote Code Execution
###

Original advisory:
http://ifsec.blogspot.com/2011/10/internet-explorer-option-element-remote.html

I. OVERVIEW

There is a vulnerability in Internet Explorer which enables execution
of arbitrary code if the user visits a web page controlled by the
attacker. The vulnerability is caused by an use-after-free bug
triggered by accessing a previously deleted Option element. This
vulnerability has been observed in Internet Explorer versions 6, 7 and
8. The vulnerability has been patched by Microsoft on October 11,
2011.

II. THE BUG

In Internet Explorer, the implementation of Select HTML element
contains an array of pointers to the Option elements the Select
element contains. This array is called the Option cache. Normally,
whenever an Option element inside a Select element is accessed via
JavaScript, Option cache is rebuilt, thus ensuring its consistency.
However, there are some JavaScript methods that can be used to delete
and modify the Option elements contained inside the Select element
without rebuilding the Option cache. In combination, these methods
enable modifying a previously deleted Option element.

III. IMPACT

The vulnerability can be used to execute arbitrary code in the context
of the currently logged in user if the user visits a specially crafted
web page. JavaScript needs to be enabled in order for the attacker to
be able to exploit the vulnerability (it is enabled by default in all
versions of Internet Explorer).

IV. PoC

A PoC exploit that demonstrates code execution has been developed.
However, due to the severity of the vulnerability, release of the
exploit code is not planned at this time.

V. REFERENCES

http://ifsec.blogspot.com/2011/10/internet-explorer-option-element-remote.html
http://technet.microsoft.com/en-us/security/bulletin/ms11-081
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1996
http://www.zerodayinitiative.com/advisories/published/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Possible German Governmental Backdoor found (R2D2)

2011-10-13 Thread Ivan .

interesting

*DigiTask Remote Forensic Spyware *

http://cryptome.org/0005/michaelthomas.pdf

On Fri, Oct 14, 2011 at 11:38 AM, valdis.kletni...@vt.edu wrote:

 On Thu, 13 Oct 2011 14:44:32 PDT, Andrew Wallace said:
  No, they started moderating the list January 2009.
 
  ---
 
 
  Andrew Wallace
 
  Independent consultant
 
  www.n3td3v.org.uk
 
 
 
  
  From: Byron Sonne byron.so...@gmail.com
  To: full-disclosure@lists.grok.org.uk
  Sent: Thursday, October 13, 2011 10:33 PM
  Subject: Re: [Full-disclosure] Possible German Governmental Backdoor
 found (R2D2)
 
  I thought this was an unmoderated list? It appears my submission has
  been held back.

 To clarify:  the list itself is (to the best of my knowledge), in fact
 *not*
 moderated, which involves somebody actually looking at all postings and
 doing a yes/
 no check on the enclosed content.

 That is *different* from *certain user addresses* being set to permanent
 moderation status.

 There's unfortunately some people that are still fuzzy on the difference,
 and
 some that insist on conflating the two.

 https://www.gnu.org/s/mailman/mailman-admin/node22.html

 tl;dr: No, the list isn't moderated, Andrew is (and other individuals may
 or
 may not be at any given time).

 Byron: Having said that, I have no idea what delayed your original posting
 to
 the list.  Your follow-up appears to have cleared the list in about 6
 seconds
 from arrival to queued for delivery, so was almost certainly unmoderated.


 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [OT] Obama said: American people understand that not everybody's been following the rules

2011-10-13 Thread Ivan .

don't feed the trolls

http://whatreallyhappened.com/

On Fri, Oct 14, 2011 at 2:53 PM, Laurelai laure...@oneechan.org wrote:

On 10/13/2011 7:11 PM, Christian Sciberras wrote:

So if they cause damage for profit that makes it ok?

No. But it's certainly better than doing damage without profit. Making
profit means that at the end of the day, the money's going to go somewhere
further in the chain.
Flattening a tower, for instance, or attacking the local bank that refused
to give you a loan because of the time you spent in a cell, isn't as
productive.
Neither is it making a company loose clients/profit just because they
decided they don't want you to use their services (as if you did have a
right in the first place...).

So by your logic the civil disobedience that helped sparked the
revolutionary war is worse than if someone had done the same acts just to
drive up tea prices? Again I also remind you the trickle down theory doesn't
work

And yes I acknowledge the American public has a measure of
responsibility in the situation too, human beings are by nature imperfect,
but the largest share of responsibility lies with the names listed below.

The largest share? I can see Ex-president Bush trying to sell you a
bottle of beer for $10 dollars ($7 profit). Wait, I can't.

But we did see him increase deregulation and allow this to happen, we
also saw him provoke a war with another country based on a known lie for the
sole purpose of gaining resources and more control in the middle east. We
saw him legalize torture and saw him strip away a good chunk of our civil
liberties so the anti terror industry could make a buck. But like you said
its ok since someone is making money off of it. Who needs civil liberties
anyways right?

That sort of thing has happened to me and I paid back every dime of it,
most people are decent human beings and would do the same.

Most people? I could have sworn 90% of the people in the NYC subway would
thank $deity if you suddenly dropped dead so they could get things off you.
Call me cynical, but I wouldn't trust anyone else in such cases, other than
myself.

Frankly 90% of people on this list would just thank $deity i suddenly
dropped dead regardless of how much stuff i had :)

Regarding that list of yours, great! Now we just need a little more
effort. For each of those persons, please enlighten us as to what they did
legally wrong.
Of course, the people that landed in jail shouldn't be counted. The 99%
protest is a modern one committed to change, it just can't right wrongs by
pointing at jailed people.

http://www.time.com/time/specials/packages/article/0,28804,1877351_1877350_1877339,00.html

On Thu, Oct 13, 2011 at 11:35 PM, Laurelai laure...@oneechan.org wrote:

On 10/13/2011 9:18 AM, Christian Sciberras wrote:

I simply acknowledge the fact that some people work hard to get obscenely
rich, but I just can't stand people that cause damage for the fun of it.

So if they cause damage for profit that makes it ok?

Yes, I stick for everyone that minds his business, instead of ruining
others' for the fun of it.

What bothers me is the fact that those hypocrites (protesters) are
crying out loud against some people they're highly envious of with the
excuse of the depression.
Well, here's the news; the famous depression has been brought about by
these same people!

And yes I acknowledge the American public has a measure of responsibility
in the situation too, human beings are by nature imperfect, but the largest
share of responsibility lies with the names listed below.

If someone above is collecting free money because of incentives for
people to spend money (and which seem to work well), I can't blame him.

Yes because trickle down theory worked *so* well

How many times in your life have you paid back something you received by
mistake and which wasn't yours?
While I would foremost applaud anyone that would right such a wrong, I
just can't ignore the fact that those people out there representing the
99% are big-time hypocrites.

That sort of thing has happened to me and I paid back every dime of it,
most people are decent human beings and would do the same.

On a different argument, since you seem to know well enough how some of
the 1% are doing immoral things, why don't you start by handing out names
instead of talking air just as the 99% crowd has been doing up till now?

*Alan Greenspan, chairman of US Federal Reserve 1987- 2006
**Mervyn King, governor of the Bank of England
**Bill Clinton, former US president*
*Gordon Brown, prime minister*
*George W Bush, former US president*
*Senator Phil Gramm
**Abby Cohen, Goldman Sachs chief US strategist
**Kathleen Corbet, former CEO, Standard Poor's
**Hank Greenberg, AIG insurance group
**Andy Hornby, former HBOS boss
**Steve Crawshaw, former BB boss
**Adam Applegarth, former Northern Rock boss
**Dick Fuld, Lehman Brothers chief

Re: [Full-disclosure] [OT] the nigger said: American people understand that not everybody's been following the rules

2011-10-12 Thread Ivan .

fast and furious
http://www.youtube.com/watch?v=IC2C2lIwNSA

On Wed, Oct 12, 2011 at 5:51 PM, Christian Sciberras uuf6...@gmail.comwrote:

 Darren's and indeed many other people's lame excuse is that they're too
 humble to be greedy. As if!
 If anything, most people are greedier than that 1%. The only difference is
 that people are bad at it, unlike that 1%.

 Just consider the fact that Average Joe would be just too happy to evade
 tax.
 Richer Joe, instead, might be doing the same with his $1bn business.
 In both cases, they're breaking the law.

 The occupy wallstreet movement is simply hypocrisy.

 Did I happen to mention that I'm far from rich? In the coming years, I'll
 be struggling to get my own drop of land.
 The only unfair part I see is people complaining while buying iPads and
 iCrap over Facebook, Twitter etc..


 On Tue, Oct 11, 2011 at 6:07 PM, Jeffrey Walton noloa...@gmail.comwrote:

 On Tue, Oct 11, 2011 at 9:25 AM, Darren Martyn
 d.martyn.fulldisclos...@gmail.com wrote:
  Chris - Empathy, guilt, and morals. Guilt being a major factor. The
  possibility was always there to make millions via evil means, but morals
 and
  knowing it would be hard to live with.
 
  The problem is not getting lots of money. That is the easy part. The
 issue
  is with living with yourself afterward.
 How about illegal? Check out the Hobbs Act [1]. I'm not making this
 crap up - the US has laws on the books for negatively affecting
 commerce (which the crash did), and using fear to peddle their warez
 (how financial institutions market their instruments). There's
 probably provisions in the PATRIOT Act, too.

 The last tine I checked (about a year ago), the SEC had opened fewer
 than 100 civil investigations. No criminal investigations, despite the
 fact that some of the financial institutions created spurious ratings
 companies just to rate their instruments 'good'.

 Jeff

 [1]
 http://www.justice.gov/usao/eousa/foia_reading_room/usam/title9/131mcrm.htm

  On Tue, Oct 11, 2011 at 12:43 AM, Bob Dobbs bobd10...@gmail.com
 wrote:
 
  On Mon, Oct 10, 2011 at 10:57 AM, Jeffrey Walton noloa...@gmail.com
  wrote:
 
  Who are the real threats to the US: terrorist who try to dream up ways
  to do the US harm, or Corporate and Congress which does the US harm?
 
  I hate to contribute to an off-topic thread but you've successfully
  trolled me here: Congress has done FAR more harm to the US than
 terrorists
  over the last 10 years by just about every measure.

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/



 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [OT] Obama said: American people understand that not everybody's been following the rules

2011-10-12 Thread Ivan .

http://endoftheamericandream.com/archives/fast-and-furious-22-shocking-facts-about-the-scandal-that-could-bring-down-the-obama-administration

On Thu, Oct 13, 2011 at 10:33 AM, David Alanis can...@dalan.us wrote:

Quoting Paul Schmehl pschmehl_li...@tx.rr.com:

The thing these stupid people don't seem to get is that millionaires
and billionaires are the only ones that can afford to move elsewhere.

You're an idiot.

If you think that Obama is a Muslim, that Obama care will bring upon
death panels, that Obama is a socialist, and that all millionaires and
billionaires (including Thor), will move out just because they're
called upon to pay more taxes and help America out of debt, you're an
idiot.

Please don't call me *stupid* just because you disagree with me
politically.

If you're not a millionaire or billionaire, how *would you know* that
the 1% are packing getting ready to move?

Did you pick this up from Fox News?

(I won't respond to any of your response, I am done with this silly thread)

Tax them enough and they'll simply move to another country. That's
already what's happening with corporations and with some individuals.
As their tax load increases, the incentive to simply move gets greater
and greater until one day they do. Then their tax load goes to zero
and the money is gone forever.

We've already seen these within the US, where millionaires are leaving
CA and NY for greener pastures. If they leave the US entirely, they
won't be back. Then who will the government get the money from?

--On October 12, 2011 8:31:34 PM + Thor (Hammer of God)
t...@hammerofgod.com wrote:

Well, you said nor do I care so I too am confused. However, since
you
did ask, there is an important aspect to your retort that you seem ok
with dancing over, and that is the fact the taxing millionaires and
billionaires would be *additional* taxes. Mine won't go down, and in
fact, will probably go up. And I guarantee, without question and as
definitely as the sun will rise tomorrow, when whatever x population
is
taxed more, and whatever resolution these people think will come from
all of this noise, that they will CONTINUE to bitch and moan when other
people have more than they do.

The premise of I am the 99% or your use of average is specious.
Average what? Income? No, that can't be it. Education? No, that's
clearly not it. Average tax payer? Certainly not. Average person
bitching about how they don't have what they want and think it should
magically be given to them? Well, that's more like it, isn't it?

The entire movement is a waste of time, and the let them eat cake-ers
will find that out, as they always do, when they become the ones that
have to start baking.

The reason I posted the link is because it's freaking FUNNY to call out
the ME-TOO'S! Now if you'll excuse me, I must get back to my job so
that
I can try to afford the taxes taken out.

-Original Message-
From: full-disclosure-boun...@lists.grok.org.uk [mailto:
full-disclosure-
boun...@lists.grok.org.uk] On Behalf Of David Alanis
Sent: Wednesday, October 12, 2011 12:19 PM
To: full-disclosure@lists.grok.org.uk
Subject: Re: [Full-disclosure] [OT] Obama said: American people
understand that not everybody's been following the rules

Quoting Thor (Hammer of God) t...@hammerofgod.com:

No, it goes to show you how much most of the people bitching about
all of this are full of shit, as per the oldie but goodie Holiday
in Cambodia by the Dead Kennedy's.

The people who REALLY need help are not the ones sitting around all
day posting shite on the internet.

I don't know where you're getting at or what political stance you take
nor do I care.

If you don't think the people who are protesting against the greed of
wall street are average Americans, then you need help.

Tell us then, since you cared enough to post a link trying to discredit
the anti- wall-street movement based on exifs. Who are the people who
need the help?

Corporations? Cause I've heard opposing arguments by *average*
Americans that corporations are people.

Last time I checked, Obama's Job Act gives even more tax breaks to
companies and extends unemployment benefits to *Americans* with out
jobs by taxing millionaires and billionaires.

You have me confused.

-Original Message-
From: full-disclosure-boun...@lists.grok.org.uk
[mailto:full-disclosure- boun...@lists.grok.org.uk] On Behalf Of
David Alanis
Sent: Wednesday, October 12, 2011 10:21 AM
To: full-disclosure@lists.grok.org.uk
Subject: Re: [Full-disclosure] [OT] Obama said: American people
understand that not everybody's been following the rules

Quoting Thor (Hammer of God) t...@hammerofgod.com:

I saw this on FB and thought I would pass it along:
http://99percentexif.tumblr.com/

It's the exif data from the photos the 99%'ers are

Re: [Full-disclosure] [OT] Obama said: American people understand that not everybody's been following the rules

2011-10-12 Thread Ivan .

http://www.businessinsider.com/what-wall-street-protesters-are-so-angry-about-2011-10?op=1

On Thu, Oct 13, 2011 at 10:29 AM, Ivan . ivan...@gmail.com wrote:

http://endoftheamericandream.com/archives/fast-and-furious-22-shocking-facts-about-the-scandal-that-could-bring-down-the-obama-administration

On Thu, Oct 13, 2011 at 10:33 AM, David Alanis can...@dalan.us wrote:

Quoting Paul Schmehl pschmehl_li...@tx.rr.com:

The thing these stupid people don't seem to get is that millionaires
and billionaires are the only ones that can afford to move elsewhere.

You're an idiot.

Please don't call me *stupid* just because you disagree with me
politically.

If you're not a millionaire or billionaire, how *would you know* that
the 1% are packing getting ready to move?

Did you pick this up from Fox News?

(I won't respond to any of your response, I am done with this silly
thread)

--On October 12, 2011 8:31:34 PM + Thor (Hammer of God)
t...@hammerofgod.com wrote:

The entire movement is a waste of time, and the let them eat cake-ers
will find that out, as they always do, when they become the ones that
have to start baking.

The reason I posted the link is because it's freaking FUNNY to call out
the ME-TOO'S! Now if you'll excuse me, I must get back to my job so
that
I can try to afford the taxes taken out.

Quoting Thor (Hammer of God) t...@hammerofgod.com:

No, it goes to show you how much most of the people bitching about
all of this are full of shit, as per the oldie but goodie Holiday
in Cambodia by the Dead Kennedy's.

The people who REALLY need help are not the ones sitting around all
day posting shite on the internet.

I don't know where you're getting at or what political stance you take
nor do I care.

If you don't think the people who are protesting against the greed of
wall street are average Americans, then you need help.

Tell us then, since you cared enough to post a link trying to
discredit
the anti- wall-street movement based on exifs. Who are the people who
need the help?

Corporations? Cause I've heard opposing arguments by *average*
Americans that corporations are people.

Last time I checked, Obama's Job Act gives even more tax breaks to
companies and extends unemployment benefits to *Americans* with out
jobs by taxing millionaires and billionaires.

You have me confused.

-Original Message-
From: full-disclosure-boun...@lists.grok.org.uk
[mailto:full-disclosure- boun...@lists.grok.org.uk] On Behalf Of
David Alanis
Sent: Wednesday, October 12, 2011 10:21 AM
To: full-disclosure@lists.grok.org.uk
Subject: Re: [Full-disclosure] [OT] Obama said: American people
understand that not everybody's been following the rules

Quoting Thor (Hammer of God) t

Re: [Full-disclosure] [OT] the nigger said: American people understand that not everybody's been following the rules

2011-10-12 Thread Ivan .

Welcome to Ameristan

majority of street lights have been removed from one Michigan city that was
having trouble paying its electricity bill
http://12160.info/profiles/blogs/majority-of-street-lights-have-been-removed-from-one-michigan-cit

Colorado empties popular lake to pay its water bill
http://www.telegraph.co.uk/news/worldnews/northamerica/usa/8816656/Colorado-empties-popular-lake-to-pay-its-water-bill.html

and so on. Your tax $$$ go to bailouts

On Thu, Oct 13, 2011 at 10:20 AM, Ivan . ivan...@gmail.com wrote:

fast and furious
http://www.youtube.com/watch?v=IC2C2lIwNSA

On Wed, Oct 12, 2011 at 5:51 PM, Christian Sciberras uuf6...@gmail.comwrote:

Darren's and indeed many other people's lame excuse is that they're too
humble to be greedy. As if!
If anything, most people are greedier than that 1%. The only difference is
that people are bad at it, unlike that 1%.

Just consider the fact that Average Joe would be just too happy to evade
tax.
Richer Joe, instead, might be doing the same with his $1bn business.
In both cases, they're breaking the law.

The occupy wallstreet movement is simply hypocrisy.

Did I happen to mention that I'm far from rich? In the coming years, I'll
be struggling to get my own drop of land.
The only unfair part I see is people complaining while buying iPads and
iCrap over Facebook, Twitter etc..

On Tue, Oct 11, 2011 at 6:07 PM, Jeffrey Walton noloa...@gmail.comwrote:

On Tue, Oct 11, 2011 at 9:25 AM, Darren Martyn
d.martyn.fulldisclos...@gmail.com wrote:
Chris - Empathy, guilt, and morals. Guilt being a major factor. The
possibility was always there to make millions via evil means, but
morals and
knowing it would be hard to live with.

The problem is not getting lots of money. That is the easy part. The
issue
is with living with yourself afterward.
How about illegal? Check out the Hobbs Act [1]. I'm not making this
crap up - the US has laws on the books for negatively affecting
commerce (which the crash did), and using fear to peddle their warez
(how financial institutions market their instruments). There's
probably provisions in the PATRIOT Act, too.

The last tine I checked (about a year ago), the SEC had opened fewer
than 100 civil investigations. No criminal investigations, despite the
fact that some of the financial institutions created spurious ratings
companies just to rate their instruments 'good'.

Jeff

[1]
http://www.justice.gov/usao/eousa/foia_reading_room/usam/title9/131mcrm.htm

On Tue, Oct 11, 2011 at 12:43 AM, Bob Dobbs bobd10...@gmail.com
wrote:

On Mon, Oct 10, 2011 at 10:57 AM, Jeffrey Walton noloa...@gmail.com
wrote:

Who are the real threats to the US: terrorist who try to dream up
ways
to do the US harm, or Corporate and Congress which does the US harm?

I hate to contribute to an off-topic thread but you've successfully
trolled me here: Congress has done FAR more harm to the US than
terrorists
over the last 10 years by just about every measure.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [OT] Obama said: American people understand that not everybody's been following the rules

2011-10-12 Thread Ivan .

do your own research, read your own shit, make your own decisions

2011/10/13 夜神 岩男 supergiantpot...@yahoo.co.jp

On 10/13/2011 08:53 AM, Jeffrey Walton wrote:
On Wed, Oct 12, 2011 at 7:47 PM, Ivan .ivan...@gmail.com wrote:

http://www.businessinsider.com/what-wall-street-protesters-are-so-angry-about-2011-10?op=1

Very nice.

All the pictures make it very easy to take in quickly. It should help
those who don't want to take a detailed look at the issues. If I could
only get it on my etch-a-sketch

Jeff

Funny how accurate your statement is about those who don't want to take
a detailed look at the issues. Those are the ones making all the noise.

I would like to draw your attention to the Featured Comment at the
bottom of the article. It is spot on and a critical counterpoint.

The entire article is full of leading indicators and trailing
indicators, but arguing them as if their meaning were reversed. The most
interesting part about all this is looking at them with an eye to
predictive analysis. The charts show that we are not in uncharted
territory, and that corporate profits in a down season is a leading
indicator in a sharp reduction in unemployment (that is, job creation)
and another prolonged boom cycle. This will eventually be interrupted by
a sharp, short recession, like the one now. The charts used in this
article do tell a story, and its not the one the whole 99%/1% argument
crowd is about.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [OT] the nigger said: American people understand that not everybody's been following the rules

2011-10-06 Thread Ivan .

MSNBC labels AP ‘inherently racist’ for accurate translation of Obama speech
http://investmentwatchblog.com/msnbc-labels-ap-inherently-racist-for-accurate-translation-of-obama-speech/

some 1% on the list

*Chicago Traders Respond To Protesters With Signs Reading ‘We Are The
1%’http://thinkprogress.org/economy/2011/10/05/336590/chicago-protests-we-are-1-percent/|
* The Occupy Wall Street movement spread to Chicago this week, where
protesters have gathered outside the Chicago Board of Trade, the world’s
oldest options and futures trading center. Like the protesters in New York
and other cities around the country, the group gathered to protest our
nation’s growing income
inequalityhttp://thinkprogress.org/politics/2011/05/04/163476/us-unequal-uganda-pakistan/,
as the top 1 percent of Americans continue to see their incomes rise
rapidlyhttp://thinkprogress.org/politics/2011/04/18/159261/tax-disparity-chart/and
their tax rates fall. The Chicago traders, confronted by the
protesters’
“We are the 99 percent http://wearethe99percent.tumblr.com/” message,
crafted their own not-so-subtle reply, hanging signs in eighth-floor windows
that said, “We are the
1%http://chicagoist.com/2011/10/05/board_of_trade_has_a_message_for_oc.php
“:

On Fri, Oct 7, 2011 at 9:13 AM, xD 0x41 sec...@gmail.com wrote:

Hrm very good point there.
It is obviously monitored, but really, would the mnitors, even get involved
in things... i dont know if that is just part of how to stay under, but
could be.
I do not know how mi5/6 works but, i have heard rumors, that he is wsome
form of undercover something... wich is kinda cool with me.I would prefer to
know that, or even think that, than think he is a bad guy and, just being an
arse because he can be...
i would love some independant input from people who are working as
operatives, as Valdis said,it is good to see these peoples input, especially
on some topics like ITsec and exploits/pocs and anything wondeful in this
area.
I know i am fine with that but, amazing to howmany actual results point at
n3td3v as this... i certainly wont be using crazycoders.com/.us for any
posts for n3td3v,but sertainly other peoples blogs, are full of him/he ?
Anyhow.. enough for me, cappucino time.
cheers,
xd

On 7 October 2011 08:59, valdis.kletni...@vt.edu wrote:

On Thu, 06 Oct 2011 14:25:18 PDT, andrew.wallace said:

MI6 operative - I didn't know you delt in conspiracy. My web page
clearly
states independent.

Which is exactly what it *would* say if you were an undercover operative.

http://www.google.com/search?q=n3td3v+mi5
http://www.google.com/search?q=n3td3v+mi6
http://www.google.com/search?q=andrew+wallace+mi5
http://www.google.com/search?q=andrew+wallace+mi6

Certainly a lot of history there.

In any case, whether or not you're an MI6 operative, if the list *is* for
national security advisors, isn't it silly for you to try to shut it down
because
of your anti-disclosure stance?

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-26 Thread Ivan .

http://www.h-online.com/security/news/item/VPN-provider-helped-track-down-alleged-LulzSec-member-1349666.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Vulnerabilities in GlobalWoW

2011-09-01 Thread Ivan Carlos

C'mon... isn't that (gaming non-licensed server over a patented application) 
illegal?

Reporting vulns on counterfeit applications is useless.

Ivan Carlos
CISO, Consultant
+55 (11) 8112-0666
www.icarlos.net

-Original Message-
From: full-disclosure-boun...@lists.grok.org.uk 
[mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of MustLive
Sent: quarta-feira, 31 de agosto de 2011 17:44
To: submissi...@packetstormsecurity.org; full-disclosure@lists.grok.org.uk
Subject: [Full-disclosure] Vulnerabilities in GlobalWoW

Hello list!

I want to warn you about Insufficient Anti-automation and Denial of Service 
vulnerabilities in GlobalWoW. Also GlobalWow can be included in ArcEmu and WOW 
Emulator Server.

This is the last of few advisories which I've made in April 2010. In this 
advisory I'm continue to inform readers of mailing lists about vulnerable web 
applications which are using CaptchaSecurityImages.php.

-
Affected products:
-

Vulnerable are GlobalWow 3.0.9 and previous versions (and potentially next 
versions).

Also the next products are affected: ArcEmu and WOW Emulator Server with which 
GlobalWow can be bundled.

I've already wrote last year the recommendations about fixing these issues in 
another my advisory concerning vulnerable web application with 
CaptchaSecurityImages.php. As I wrote earlier 
(http://www.securityfocus.com/archive/1/511023), developers of 
CaptchaSecurityImages.php fixed this hole at 27.03.2007. So one of the way to 
fix these issues is to use fixed version of the script or to make appropriate 
changes in com_bookman's version of the script.

--
Details:
--

These are Insufficient Anti-automation and Denial of Service vulnerabilities.

The vulnerabilities exist in captcha script CaptchaSecurityImages.php, which is 
using in this system. I already wrote at my site about vulnerabilities in 
CaptchaSecurityImages (http://websecurity.com.ua/4043/).

Insufficient Anti-automation (WASC-21):

http://site/acs/CaptchaSecurityImages.php?width=150height=100characters=2

Captcha bypass is possible as via half-automated or automated (with using of
OCR) methods, which were mentioned before (http://websecurity.com.ua/4043/),
as with using of session reusing with constant captcha bypass method 
(http://websecurity.com.ua/1551/), which was described in project Month of Bugs 
in Captchas.

DoS (WASC-10):

http://site/acs/CaptchaSecurityImages.php?width=1000height=9000

With setting of large values of width and height it's possible to create large 
load at the server.


Timeline:


2010.04.16 - disclosed at my site.
2010.04.17 - informed developers.
2010.04.18 - informed developers on another e-mail.

I mentioned about these vulnerabilities at my site 
(http://websecurity.com.ua/4134/).

Best wishes  regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] DEF CON 19 - hackers get hacked!

2011-08-11 Thread Ivan .

*A German technology researcher on Wednesday showed global mobile makers
and technology firms how General Packet Radio
Servicehttp://en.wikipedia.org/wiki/General_Packet_Radio_Servicecan
easily be tapped, intercepted, and decrypted with an average mobile
phone and a few applications. According to the New York Times, Karsten Nohl,
a computer engineer and mobile security researcher, demonstrated to fellow
researchers gathered to attend Chaos Communication
Camphttp://events.ccc.de/2010/08/10/chaos-communication-camp-2011/,
a Berlin-based hackers event, how to intercept the voice or data messages
sent between mobile
deviceshttps://www.nytimes.com/2011/08/10/technology/hacker-to-demonstrate-weak-mobile-internet-security.htmlover
GPRS easily, owing to weak protection provided by mobile network
carriers for data information. Nohl, in collaboration with his colleague
Luca Melette, tapped the information within a radius of five
kilometershttp://www.itproportal.com/2011/08/11/gprs-can-be-hacked-easily-claims-german-researcher/#ixzz1UkPeNdiEusing
a seven-year-old inexpensive mobile phone from Motorola.

http://mobile.slashdot.org/story/11/08/11/1928215/GPRS-Can-Be-Hacked-Easily-Claims-German-Researcher

*
http://www.nytimes.com/2011/08/10/technology/hacker-to-demonstrate-weak-mobile-internet-security.html?_r=1

On Fri, Aug 12, 2011 at 12:44 AM, Basan ba...@gmx.us wrote:

  - Original Message -
  From: -= Glowing Sex =-
  Sent: 08/10/11 10:56 AM
  To: coderman
  Subject: Re: [Full-disclosure] DEF CON 19 - hackers get hacked!
  times are a changing... but, i see now what tyou mean... still, i just
 dont
  know why people even INSTALL or, accept anything at a defcon meeting, ofc
  someone will try to make some name, mining for data, is stealing an id
  nowdays, so there would be GREat potential for one device, to connect to
  some network, and rescan for other weak/known exploits... then you have
 an
  army :)

 To my knowledge, I was watching people's devices getting popped with little
 to no interaction by their part. If memory serves me correctly maybe someone
 did an apt-get update on their machine, but outside of that just the usual
 browsing and remote work.

  but, intersting about 4G... i have not yet to see that haxd so, 1 point
 for
  that but, thats prolly coz ui aint really been looking at that side of it

 It was impressive. Essentially if you had a device on and near the Rio
 during (and for some time after) DEF CON, you had a high chance of being
 compromised.

 --
 Basan - Your friendly fire-breathing chicken monster

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Samsung Galaxy Tab 10.1 blocked from sale in Australia

2011-08-02 Thread Ivan c

An Apple spokesperson told iTnews that it would continue to protect
its design patents.
This kind of blatant copying is wrong, and we need to protect Apple's
intellectual property when companies steal our ideas.
http://www.itnews.com.au/News/265483,samsung-galaxy-tab-101-blocked-from-sale-in-australia.aspx

And then watch Steve Jobs in an interview saying; Picasso had a
saying, good artists copy, great artists stealand we have always
been shameless in stealing great ideas.
https://www.youtube.com/watch?v=CW0DUg63lqUfeature=related

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] A pound of flesh: how Cisco's unmitigated gall derailed one man's life

2011-07-21 Thread Ivan .

Buy Juniper!

http://arstechnica.com/tech-policy/news/2011/07/a-pound-of-flesh-how-ciscos-unmitigated-gall-derailed-one-mans-life.ars
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-10 Thread Ivan .

doesn't it also mandate the encryption of CC info? requirement 4 Encrypting
and Storing Credit Card Data

plenty of reports that the data was not encrypted, and also plenty that say
it was.

On Tue, May 10, 2011 at 4:40 PM, Tracy Reed tr...@ultraviolet.org wrote:

 On Tue, May 10, 2011 at 05:07:39AM +, Dobbins, Roland spake thusly:
  Stateful firewalls have no place in front of servers, where every
 incoming
  request is unsolicited, and therefore there is no state to inspect in the
  first place.

 The PCI SSC requires a stateful firewall in front of servers processing
 credit
 card data. Not only to block inbound access to any ports or services
 accidentally exposed but the outbound policy must also be default deny to
 make
 it more difficult to exfiltrate stolen data. If you have traffic going out
 to a
 high numbered port and you are not keeping state how do you know if that is
 a
 reply packet to an existing inbound connection or if it is an unauthorized
 outbound connection?

 Of course, the network should be properly segmented so that only the
 servers
 processing payment data are in-scope. You may be right about not putting a
 stateful firewall in front of the gaming servers (in Sony's case).

  Where stateful firewalls in front of Web servers are incorrectly mandated
 by
  various regulatory frameworks, making use of mod_security or its
 equivalent
  on the Web servers themselves ensures compliance without creating a DDoS
  chokepoint.

 If you don't have a stateful firewall blocking outbound connections why
 would
 the traffic even have to go through mod_security?

 --
 Tracy Reed

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-10 Thread Ivan .

Ill throw this into the mixer while on topic of FWs

The TCP Split Handshake: Practical Effects on Modern Network Equipment
http://nmap.org/misc/split-handshake.pdf


On Wed, May 11, 2011 at 10:18 AM, Thor (Hammer of God)
t...@hammerofgod.com wrote:

  I would be extremely interested to learn details of how a stateful firewall 
  in
  front of a server saved a company, when stateless ACLs in hardware-based
  network infrastructure devices would've led to failure.  Seriously, if you 
  don't
  mind outlining the scenario, I think it would be very instructive.

 I'd be happy to - I too would like to dive a bit deeper into what your points 
 are as I find them interesting as well.  Let's take it offline - you can 
 share back with the group if you feel it valuable.

 t

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Facebook

2011-05-03 Thread Ivan .

it's the law, specifically CALEA
http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

On Wed, May 4, 2011 at 9:19 AM, Javier Bassi javierba...@gmail.com wrote:
 On Tue, May 3, 2011 at 7:51 PM, Daniel Clemens
 daniel.clem...@packetninjas.net wrote:
 Prove it!
 You clearly know nothing about our legal system.

 You might find this links interesting
 http://www.youtube.com/watch?v=t0aQojDGSD4
 http://www.google.com/transparencyreport/governmentrequests/

 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] iPhone Geolocation storage

2011-04-28 Thread Ivan .

and now tom tom as well

http://crave.cnet.co.uk/cartech/tomtom-admits-to-sending-your-routes-and-speed-information-to-the-police-50003618/

On Thu, Apr 28, 2011 at 9:35 AM, Ivan . ivan...@gmail.com wrote:
stevie says it just a bug, a patented bug

http://gawker.com/?_escaped_fragment_=5795442/apple-patent-reveals-extensive-stalking-plans#!5795442/apple-patent-reveals-extensive-stalking-plans

On Wed, Apr 27, 2011 at 8:46 PM, n...@myproxylists.com wrote:
M$ are in the love in

http://news.cnet.com/8301-31921_3-20057329-281.html

On Tue, Apr 26, 2011 at 8:12 PM, Ivan . ivan...@gmail.com wrote:

Interesting write up, and apparently old news

If you have jailbroken your phone, just use cydia and search for tool
'Untrackerd' to fix this issue. This background process reset the file
periodically.

I have always said this, after you have JB'd your iPhone, then it becomes
a phone :) I hated that apple's bullshit where your phone is completely
tied to itunes unless you jailbroke.

https://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with-the-latest-iphone-tracking-discovery/

On Fri, Apr 22, 2011 at 1:59 PM, mark seiden m...@seiden.com wrote:

yes, that's right. on one of the forensics lists someone pointed out
that
he started google maps for 6 seconds
and ended up with 1253 locations in the cache, all with the same time
stamp. those would be potential known
locations in your neighborhood.

much fuller disclosure in

http://markey.house.gov/docs/applemarkeybarton7-12-10.pdf

including that the some of the location data comes from google.

it looks like everything gets anonymized, aggregated to 5 digit
zipcodes,
and max retention of 6 months, but don't
talk much about what the device does except when it uploads data.

the congressional disclosure, while it makes me feel better about
location
data, contains a few choice items like

it's unclear how apple can keep app developers from retaining location
data. which doesn't seem forbidden by apple, only by law.

it's also unclear why they keep really old data in the cache on the
phone.
cache bloat results for little benefit.

the android doesn't do time-based pruning either and has a similar
location cache with the same data it.

it appears to me that since the keying is by mac address or the tower
id
that there will only be one timestamped item for
each of those. so if you go around the same neighborhood repeatedly,
the
same data will be in the cache. so not exactly
tracking, just recency.

but it would seem prudent to both specify and implement the briefest
retention of the location data that was possible to perform
the function expected by the user.

On Apr 20, 2011, at 12:34 PM, Brandon Matthews wrote:

I've been poring over my phone's data, and I'm not sure if the
resolution is
just very low, or if it's logging the locations of towers and not my
phone.

Ex: http://imgur.com/2m5tO

I'm going to xref with FCC databases soon to try and find out.

(Not speaking for Cisco, only for myself and with nobody's approval)

On 4/20/11 12:11 PM, Michele Orru antisnatc...@gmail.com did
declare:

Already twitted today.
Pretty scary btw. I hope there's not the equivalent for Android.

antisnatchor

Thor (Hammer of God) mailto:t...@hammerofgod.com
April 20, 2011 9:05 PM

For those of you who have not seen this yet:

http://radar.oreilly.com/2011/04/apple-location-tracking.html

Description: Description: Description:
cid:image001.png@01CBA43F.5B83F2A0

/There's no reason to think outside the box /

/if you don't think yourself into it. /

*My newest book: Thor's Microsoft Security Bible

http://www.amazon.com/Thors-Microsoft-Security-Bible-Infrastructures/dp/1597
495727C:/Users/thor/Documents/Cakewalk
*

*Timothy Thor Mullen
t...@hammerofgod.com mailto:t...@hammerofgod.com*

*http://www.hammerofgod.com http://www.hammerofgod.com/*

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe

Re: [Full-disclosure] iPhone Geolocation storage

2011-04-27 Thread Ivan .

stevie says it just a bug, a patented bug

http://gawker.com/?_escaped_fragment_=5795442/apple-patent-reveals-extensive-stalking-plans#!5795442/apple-patent-reveals-extensive-stalking-plans

On Wed, Apr 27, 2011 at 8:46 PM, n...@myproxylists.com wrote:
M$ are in the love in

http://news.cnet.com/8301-31921_3-20057329-281.html

On Tue, Apr 26, 2011 at 8:12 PM, Ivan . ivan...@gmail.com wrote:

Interesting write up, and apparently old news

If you have jailbroken your phone, just use cydia and search for tool
'Untrackerd' to fix this issue. This background process reset the file
periodically.

I have always said this, after you have JB'd your iPhone, then it becomes
a phone :) I hated that apple's bullshit where your phone is completely
tied to itunes unless you jailbroke.

https://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with-the-latest-iphone-tracking-discovery/

On Fri, Apr 22, 2011 at 1:59 PM, mark seiden m...@seiden.com wrote:

much fuller disclosure in

http://markey.house.gov/docs/applemarkeybarton7-12-10.pdf

including that the some of the location data comes from google.

it looks like everything gets anonymized, aggregated to 5 digit
zipcodes,
and max retention of 6 months, but don't
talk much about what the device does except when it uploads data.

the congressional disclosure, while it makes me feel better about
location
data, contains a few choice items like

it's unclear how apple can keep app developers from retaining location
data. which doesn't seem forbidden by apple, only by law.

it's also unclear why they keep really old data in the cache on the
phone.
cache bloat results for little benefit.

the android doesn't do time-based pruning either and has a similar
location cache with the same data it.

but it would seem prudent to both specify and implement the briefest
retention of the location data that was possible to perform
the function expected by the user.

On Apr 20, 2011, at 12:34 PM, Brandon Matthews wrote:

I've been poring over my phone's data, and I'm not sure if the
resolution is
just very low, or if it's logging the locations of towers and not my
phone.

Ex: http://imgur.com/2m5tO

I'm going to xref with FCC databases soon to try and find out.

(Not speaking for Cisco, only for myself and with nobody's approval)

On 4/20/11 12:11 PM, Michele Orru antisnatc...@gmail.com did
declare:

Already twitted today.
Pretty scary btw. I hope there's not the equivalent for Android.

antisnatchor

Thor (Hammer of God) mailto:t...@hammerofgod.com
April 20, 2011 9:05 PM

For those of you who have not seen this yet:

http://radar.oreilly.com/2011/04/apple-location-tracking.html

Description: Description: Description:
cid:image001.png@01CBA43F.5B83F2A0

/There's no reason to think outside the box /

/if you don't think yourself into it. /

*My newest book: Thor's Microsoft Security Bible

http://www.amazon.com/Thors-Microsoft-Security-Bible-Infrastructures/dp/1597
495727C:/Users/thor/Documents/Cakewalk
*

*Timothy Thor Mullen
t...@hammerofgod.com mailto:t...@hammerofgod.com*

*http://www.hammerofgod.com http://www.hammerofgod.com/*

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe

Re: [Full-disclosure] iPhone Geolocation storage

2011-04-26 Thread Ivan .

Interesting write up, and apparently old news

https://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with-the-latest-iphone-tracking-discovery/

On Fri, Apr 22, 2011 at 1:59 PM, mark seiden m...@seiden.com wrote:

yes, that's right. on one of the forensics lists someone pointed out that
he started google maps for 6 seconds
and ended up with 1253 locations in the cache, all with the same time
stamp. those would be potential known
locations in your neighborhood.

much fuller disclosure in

http://markey.house.gov/docs/applemarkeybarton7-12-10.pdf

including that the some of the location data comes from google.

it looks like everything gets anonymized, aggregated to 5 digit zipcodes,
and max retention of 6 months, but don't
talk much about what the device does except when it uploads data.

the congressional disclosure, while it makes me feel better about location
data, contains a few choice items like

it's unclear how apple can keep app developers from retaining location
data. which doesn't seem forbidden by apple, only by law.

it's also unclear why they keep really old data in the cache on the phone.
cache bloat results for little benefit.

the android doesn't do time-based pruning either and has a similar location
cache with the same data it.

it appears to me that since the keying is by mac address or the tower id
that there will only be one timestamped item for
each of those. so if you go around the same neighborhood repeatedly, the
same data will be in the cache. so not exactly
tracking, just recency.

but it would seem prudent to both specify and implement the briefest
retention of the location data that was possible to perform
the function expected by the user.

On Apr 20, 2011, at 12:34 PM, Brandon Matthews wrote:

I've been poring over my phone's data, and I'm not sure if the resolution
is
just very low, or if it's logging the locations of towers and not my
phone.

Ex: http://imgur.com/2m5tO

I'm going to xref with FCC databases soon to try and find out.

(Not speaking for Cisco, only for myself and with nobody's approval)

On 4/20/11 12:11 PM, Michele Orru antisnatc...@gmail.com did
declare:

Already twitted today.
Pretty scary btw. I hope there's not the equivalent for Android.

antisnatchor

Thor (Hammer of God) mailto:t...@hammerofgod.com
April 20, 2011 9:05 PM

For those of you who have not seen this yet:

http://radar.oreilly.com/2011/04/apple-location-tracking.html

Description: Description: Description:
cid:image001.png@01CBA43F.5B83F2A0

/There's no reason to think outside the box /

/if you don't think yourself into it. /

*My newest book: Thor's Microsoft Security Bible

http://www.amazon.com/Thors-Microsoft-Security-Bible-Infrastructures/dp/1597
495727C:/Users/thor/Documents/Cakewalk
*

*Timothy Thor Mullen
t...@hammerofgod.com mailto:t...@hammerofgod.com*

*http://www.hammerofgod.com http://www.hammerofgod.com/*

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] iPhone Geolocation storage

2011-04-26 Thread Ivan .

M$ are in the love in