Re: [Full-disclosure] Enough's enough...
Samuel Beckett wrote: On 11/14/05, Disco Jonny [EMAIL PROTECTED] wrote: I thought that this was an excellent bit of trolling and deserving of food, until google and boredom brought me across this... http://forum.crime-research.org/teech-me-how-to-hack-vt6.html?highlight= I'm I want to become a hacker. By the way, whats netbus? Posted: Sun Mar 27, 2005 7:30 pm http://www.geocities.com/n3td3v/home/about.html Extensive on hands hacker scene experience (6+ years) (Knowing your enemy) How do you know these are the same person? Could it be a decoy? A social engineering test against the forum? A clue test against the members of this list? (Who could be interesting in detailed profiling of the security community? What could it be used for in which scenarios?) I guess nobody will go far in security with in-the-box thinking and with simply taking things at face value. Peer ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Websites vulnerabilities disclosure
Raghu Chinthoju wrote: I say, ... hey listen! your house entrance door latch isn't strong enough.. there are only 4 screws instead 16, which is the practice.. you have a risk of some one easily barging into your house For some reason you don't respond.. I publish it in the local news paper that .. Mr. X's door latch is week and any one can break it easily ... Do you think it is ethical??? I seriously think not. Isn't it more like saying publicly: All those who have a lock of the type X have a lock which only has 4 screws instead of 16. So that everybody could check. But then, what could they do? Maybe not everybody is reading the paper or has the means to change one's lock. Some may try to sue the lock vendor, but did he have the means to do better? Analysing all this may complicate things even further. (And then: What could would come out of it? Attempting to change all these locks might bankrupt the vendor, create more unemployed, etc.) It's not easy to solve all this without leaving one's humanity. I guess the only lasting solution is to generally strive to aquire more (human and material) quality. I also suppose that the recommandation of the Gospel applies here: First, talk to the people (customers, vendors, crackers) directly and privately, if they won't listen, take some people with you to talk to them, if they still don't listen tell the whole community that they do the bad things they do. More over, going by my personal experience, I think 5 out of 10 websites[1] would be vulnerable to some kind of security issue, like running vulnerable versions of the web server, improper input validation etc, which are just specific them and their clients. Would would be the interest of general public on such issues? Probably that people will have more incentive to care about security and their work, and probably that systems which allow easier updates will become more widespread. I don't think any one from those sites would be part of bugtraq or FD as you mentioned that they are not vendors. Your publication will only increase the magnitude of their risk and doesn't do good to any one. I appreciate your pragmatic approach. If you have time, try to provide them with the required knowledge or fix. If you cant, just leave them at their fate and move on.. Raghu Cheers Peer [1] I dont have any data to support this.. If you dont agree, please do so. You have every right to :) On 10/6/05, offtopic [EMAIL PROTECTED] wrote: Hi List. I need your opinion. Recently I found multiply vulnerabilities in several sites. some sites behold to security-related firms but not software vendors. I'm trying to contact that companies under rfpolicy several times but don't receive any response on receive something like what injection your talking about?. I want to know - is it ethical to use standard vulnerability disclosure policies to public websites? Which fird-party can't be user as coordinator, like CERT/CC? Or in other worlds - who should care about Web-sites security? Thank you. (c)oded by [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Suggestion for IDS
[EMAIL PROTECTED] wrote: On Wed, 28 Sep 2005 15:54:41 +0700, Fajar Edisya Putera said: plan to install IDS to protect our resources An IDS doesn't *protect* your resources, any more than a concealed video surveillance camera protects anything. It may tell you who did it, and what they did, *after the fact*, but it won't *protect* you. Really? Is there no software package capable of withholding inspected packages until cleared by said IDS? If I get it right, netfilter actually IS able to reject (and log) packages. Why should an IDS sniffing on a level higher up on the OSI chain of command be unable to do the same? Dropping packets, closing ports and resetting connections (besides logging, maybe notifying users) look like natural useful reactions to the detections deliverad of an IDS to me. Or are we just talking about definitions (regarding the D in IDS), instead of talking about IDPS-ses which the OP clearly seems to imply? (P for prevention) So what are the IDPS-ses you recommend? Peer ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Re: Full-Disclosure Digest, Vol 7, Issue 25
lonely wolf wrote: Peer Janssen wrote: Aditya Deshmukh wrote: (on system you want to copy) dd if=/dev/hda | nc otherhost 5000 If you are running bash, then you do not even need netcat: dd if=/dev/hda /dev/tcp/otherhost/5000 This is interesting. Indeed :-) Which version of bash are you using ? I havent found it in my man page! My guess is that it probably has nothing to do with bash but with the devices your system provides. But where is documentation for this kind of useful information anyway? it's in bash for a long time. however not all distributions compile bash with this option activated. debian for instance does not. That's good to know, thank you. My question was somewhat more about finding information about such things, though. (Related: Will a bash compiled with that option automatically include the doc for this feature?) I never found information about the following recurrent question of mine either: If a plug in an USB storage device, it has a /dev/sg... assigned to it. But which one? I need to know this mapping in order to mount it. I always deduce this device's name from the syslog, which works but is a bit of a PITA, so I always wondered if there is no other way to get this info, namely something like lsusb. lsusb, which would be the logical place to look for it, doesn't give away this info, at least not in an easily recognizable form (e.g. I never figured it out). sg_scan and such didn't do the trick for me either, although I might have missed something here. Peer ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Re: Full-Disclosure Digest, Vol 7, Issue 25
Aditya Deshmukh wrote: (on system you want to copy) dd if=/dev/hda | nc otherhost 5000 If you are running bash, then you do not even need netcat: dd if=/dev/hda /dev/tcp/otherhost/5000 This is interesting. Indeed :-) Which version of bash are you using ? I havent found it in my man page! My guess is that it probably has nothing to do with bash but with the devices your system provides. But where is documentation for this kind of useful information anyway? Peer ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] router naming
luca developer wrote: Hi folks Is there a best practice for assign a router name ? e.g.: router type + city + room.id http://room.id and so on Wich method is usually used to assign a router name ? Full-disclosure router naming would be GPS coordinates, wouldn't it? This might proove to be a security risk, though, depending on your organization. Might be pratical to locate missing (read: walled-in or so) routers -- if they won't be moved around keeping their then-old name. Cheers Peer ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
