Re: [Full-disclosure] Backdoor in OpenBSD Explained proof of Theo's lieying

[Samuel Martín Moro]

fuck that
is stop with your is theories. is bring facts. is.
and learn actual english ffs.
is!


On Thu, Dec 16, 2010 at 11:26 PM, musnt live  wrote:

> like to warn you about Paul Sch




-- 
faust.

"Nobody wants to say how this works.
  Maybe nobody knows ..."
  Xorg.conf(5)
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Facebook name extraction based on email/wrong password + POC

[Samuel Martín Moro]

or they signed up to the list...


Samuel Martín Moro
{EPITECH.} tek5
CamTrace S.A.S

"Nobody wants to say how this works.
  Maybe nobody knows ..."
  Xorg.conf(5)


On Thu, Aug 12, 2010 at 4:00 PM, Zerial.  wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> This bug appears in a spanish security news site:
>
>
> http://blog.segu-info.com.ar/2010/08/error-en-facebook-permite-extraer.html
>
> probably it was reported by someone
>
> cheers
>
>
>
>
>
>
> On 08/11/10 23:13, werew01f wrote:
> > Don't seems to work on my system. No user name or picture was displayed.
> >
> >
> > On Wed, Aug 11, 2010 at 5:01 PM, Atul Agarwal  > <mailto:a...@secfence.com>> wrote:
> >
> > Hello all,
> >
> > Sometime back, I noticed a strange problem with Facebook, I had
> > accidentally entered wrong password in Facebook, and it showed my
> > first and last name with profile picture, along with the password
> > incorrect message. I thought that the fact that it was showing the
> > name had something to do with cookies stored, so I tried other email
> > id's, and it was the same. I wondered over the possibilities, and
> > wrote a POC tool to test it.
> >
> > This script extracts the First and Last Name (provided by the users
> > when they sign up for Facebook). Facebook is kind enough to return
> > the name even if the supplied email/password combination is wrong.
> > Further more,it also gives out the profile picture (this script does
> > not harvest it, but its easy to add that too). Facebook users have
> > no control over this, as this works even when you have set all
> > privacy settings properly. Harvesting this data is very easy, as it
> > can be easily bypassed by using a bunch of proxies.
> >
> > As Facebook is so popular, some implications -
> >
> > 1) Someone has a list of email address that he has no clue about. He
> > can feed them to Facebook one by one (or in a list, using a script
> > like this) and chances are that he'll get more than 50% hits. Useful
> > for phishing attacks (People will get more convinced when they see
> > their *real* names).
> >
> > 2) One can generate random email addresses, and *verify* their
> > existence . Hint: You can generate emails using (common names + a
> > corporate domain), and check them against Facebook. Might come handy
> > in a Pentest.
> >
> > Rest is only left up to one's imagination.
> >
> > Find the POC script attached.
> >
> > PS: I did not report this, as I am unsure on what to call it, a
> > "bug", "vuln" or a "feature".
> >
> > Thanks,
> > Atul Agarwal
> > Secfence Technologies
> > www.secfence.com <http://www.secfence.com>
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
> >
> >
> >
> > ___
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
>
> - --
> Zerial
> Seguridad Informatica
> Blog: http://blog.zerial.org
> Skype: erzerial
> Jabber: zer...@jabberes.org
> GTalk: ferna...@zerial.org
>
> -BEGIN PGP SIGNATURE-
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxj/oYACgkQIP17Kywx9JQRwgCfZCloGsZGESiYer3KXJ256Ahv
> v+gAnjAgODKzFw5/inB+Q4JwULaX1p5P
> =Rbq1
> -END PGP SIGNATURE-
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] targetted SSH bruteforce attacks

[Samuel Martín Moro]

I also don't want to change my ssh port, nor restrict incoming IPs, ... and
I use keys only to log in without entering password.
So you're not alone.
I had my IP changed several times, my servers are only hosting personal
data.
But I'm still seeing bruteforce attemps in my logs.

Here's something I use on my servers.
In cron, every 5-10 minutes, that should do it.
Of course, if you're running *BSD, pf is way more interesting to do that.


---

#!/bin/sh

AUTH=/var/log/auth.log
BKLST=/var/log/blacklist.log
HOSTS=/etc/hosts
DHOSTS=/etc/hosts.deny
LOCAL_IP=_your_ip_

cat $AUTH | egrep -i "(failed|illegal|invalid)" | awk -F "from" '{ print $2
}' | awk '{ print $1 }' | sort -u >$BKLST

for i in `cat $BKLST`
do
test `cat $AUTH | egrep -i "(failed|illegal|invalid)" | grep $i | wc
-l` -ge 3 || continue
test "`echo $i | grep $LOCAL_IP`" && continue
test "`cat $HOSTS | grep $i`" && continue
    test "`cat $DHOSTS | grep $i`" && continue
echo "ALL : $i  # matched on `date`" >>$DHOSTS
done

---

Samuel Martín Moro
{EPITECH.} tek4
CamTrace S.A.S

"Nobody wants to say how this works.
 Maybe nobody knows ..."
 Xorg.conf(5)


On Thu, Jun 17, 2010 at 1:48 PM, Gary Baribault  wrote:

> Hello list,
>
>I have a strange situation and would like information from the
> list members. I have three Linux boxes exposed to the Internet. Two of
> them are on cable modems, and both have two services that are publicly
> available. In both cases, I have SSH and named running and available
> to the public. Before you folks say it, yes I run SSH on TCP/22 and no
> I don't want to move it to another port, and no I don't want to
> restrict it to certain source IPs.
>
>Both of these systems are within one /21 and get attacked
> regularly. I run Denyhosts on them, and update the central server once
> an hour with attacking IPs, and obviously also download the public
> hosts.deny list.
>
>These machines get hit regularly, so often that I don't really
> care, it's fun to make the script kiddies waste their time! But in
> this instance, only my home box is being attacked... someone is
> burning a lot of cycles and hosts to do a distributed dictionary
> attack on my one box! The named daemon is non recursive, properly
> configured, up to date and not being attacked.
>
>Is anyone else seeing this type of attack? Or is someone really
> targeting MY box?
>
> Thanks
>
>
> Gary Baribault
> Courriel: g...@baribault.net
> GPG Key: 0x685430d1
> Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/