Re: [Full-disclosure] Arbitrary DDoS PoC
I will not answer this anymore, sorry for feeding trolls. On 15-02-2012 17:34, Sanguinarious Rose wrote: On Wed, Feb 15, 2012 at 7:53 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: I do not know what you expect of public repos at Github, really do not understand, you think that I would deliver the gold as well? Well, I think you're a guy too uninformed to find that the maximum is 200 threads with pthread. Have you tried ulimit -a? I even described in the readme. Missing the point that async would have drastic improvements on anything network base, even if you increase it to say 500 threads a async model still pawns anything using threads for simple connect/disconnect handling. Feel free to implement. ;) As the algorithm recaptcha, you really thought it would have all code in the main file? Why would I do that? I distributed in classes. No, there wasn't. It was 12 lines of code which just called another OCR library. (could be why you deleted the public repo this morning) I did hear google cache does a good job of uncovering OMG RAGE DELETE http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Flfamorim%2Frebreakerie=utf-8oe=utf-8aq=trls=org.mozilla:en-US:officialclient=firefox-a I do have to declare myself the defaulted winner of this engagement now because if you have to delete stuff in order to claim facts about it... Winner of what? Thats a priv8 repos now. Did you looked at utils directory? There was an algorithm to find the ellipses of the captcha, that he was developing to walk the edge, correcting the distortion. And why do you think IntensiveDoS accepts arguments and opens and closes a socket? Why is a snippet of code to not only HTTP DoS. I read the code could be why. I'm making another question. Why you think IntesiveDoS accepts arguments? As for the trojan, you really think I would do something better and leave the public? What planet do you live? Totally because a bindshell trojan that connects to a port is something highly special that the world will end if someone got a hold of such a dangerous piece of code. In fact, why isn't the world ended yet when you can just google and get a few dozen of them? Should I tell you how dangerous and what planet do you live on to release your so so very dangerous innovative python code? (hypocrisy for the win!) There's nothing special, but is the only code of this on GitHub. Fell free to fork and share. And thats dangerous? I think not, but run nowadays. And Curl is a great project to parallel HTTP connections, python is not so much, and that is why only the fork stays with him. Curl is indeed great I agree. The rest I don't see as even a point going anywhere? If curl is a good project and written in C, why reason I will implement the same thing in Python? On 14-02-2012 02:48, Lucas Fernando Amorim wrote: On Feb 13, 2012 4:37 AM, Lucas Fernando Amorimlf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
How do I subscribe only to the short list have to keep answering this bizarre way, so I apologize. If someone has an alternative way, please tell me. I do not know what you expect of public repos at Github, really do not understand, you think that I would deliver the gold as well? Well, I think you're a guy too uninformed to find that the maximum is 200 threads with pthread. Have you tried ulimit -a? I even described in the readme. As the algorithm recaptcha, you really thought it would have all code in the main file? Why would I do that? I distributed in classes. And why do you think IntensiveDoS accepts arguments and opens and closes a socket? Why is a snippet of code to not only HTTP DoS. As for the trojan, you really think I would do something better and leave the public? What planet do you live? And Curl is a great project to parallel HTTP connections, python is not so much, and that is why only the fork stays with him. On 14-02-2012 02:48, Lucas Fernando Amorim wrote: On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br mailto:lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
On Wed, Feb 15, 2012 at 7:53 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: How do I subscribe only to the short list have to keep answering this bizarre way, so I apologize. If someone has an alternative way, please tell me. Change your settings where you subscribed. I do not know what you expect of public repos at Github, really do not understand, you think that I would deliver the gold as well? Well, I think you're a guy too uninformed to find that the maximum is 200 threads with pthread. Have you tried ulimit -a? I even described in the readme. Missing the point that async would have drastic improvements on anything network base, even if you increase it to say 500 threads a async model still pawns anything using threads for simple connect/disconnect handling. As the algorithm recaptcha, you really thought it would have all code in the main file? Why would I do that? I distributed in classes. No, there wasn't. It was 12 lines of code which just called another OCR library. (could be why you deleted the public repo this morning) I did hear google cache does a good job of uncovering OMG RAGE DELETE http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Flfamorim%2Frebreakerie=utf-8oe=utf-8aq=trls=org.mozilla:en-US:officialclient=firefox-a I do have to declare myself the defaulted winner of this engagement now because if you have to delete stuff in order to claim facts about it... And why do you think IntensiveDoS accepts arguments and opens and closes a socket? Why is a snippet of code to not only HTTP DoS. I read the code could be why. As for the trojan, you really think I would do something better and leave the public? What planet do you live? Totally because a bindshell trojan that connects to a port is something highly special that the world will end if someone got a hold of such a dangerous piece of code. In fact, why isn't the world ended yet when you can just google and get a few dozen of them? Should I tell you how dangerous and what planet do you live on to release your so so very dangerous innovative python code? (hypocrisy for the win!) And Curl is a great project to parallel HTTP connections, python is not so much, and that is why only the fork stays with him. Curl is indeed great I agree. The rest I don't see as even a point going anywhere? On 14-02-2012 02:48, Lucas Fernando Amorim wrote: On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
Forgive me as I have not tested this, but the lone python interpreter handles the multistack, right? If so, this wouldn't actually span cores due to GIL restrictions, thus not really allowing parallell processing. *Have not looked at curl's bindings for Python, so honestly wondering if this is easier to handle than the multiprocessing library. If so, I might test around with this. **This on top of the blocking socket issues makes this mad slow. On Wed, Feb 15, 2012 at 1:34 PM, Sanguinarious Rose sanguiner...@occultusterra.com wrote: On Wed, Feb 15, 2012 at 7:53 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: How do I subscribe only to the short list have to keep answering this bizarre way, so I apologize. If someone has an alternative way, please tell me. Change your settings where you subscribed. I do not know what you expect of public repos at Github, really do not understand, you think that I would deliver the gold as well? Well, I think you're a guy too uninformed to find that the maximum is 200 threads with pthread. Have you tried ulimit -a? I even described in the readme. Missing the point that async would have drastic improvements on anything network base, even if you increase it to say 500 threads a async model still pawns anything using threads for simple connect/disconnect handling. As the algorithm recaptcha, you really thought it would have all code in the main file? Why would I do that? I distributed in classes. No, there wasn't. It was 12 lines of code which just called another OCR library. (could be why you deleted the public repo this morning) I did hear google cache does a good job of uncovering OMG RAGE DELETE http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Flfamorim%2Frebreakerie=utf-8oe=utf-8aq=trls=org.mozilla:en-US:officialclient=firefox-a I do have to declare myself the defaulted winner of this engagement now because if you have to delete stuff in order to claim facts about it... And why do you think IntensiveDoS accepts arguments and opens and closes a socket? Why is a snippet of code to not only HTTP DoS. I read the code could be why. As for the trojan, you really think I would do something better and leave the public? What planet do you live? Totally because a bindshell trojan that connects to a port is something highly special that the world will end if someone got a hold of such a dangerous piece of code. In fact, why isn't the world ended yet when you can just google and get a few dozen of them? Should I tell you how dangerous and what planet do you live on to release your so so very dangerous innovative python code? (hypocrisy for the win!) And Curl is a great project to parallel HTTP connections, python is not so much, and that is why only the fork stays with him. Curl is indeed great I agree. The rest I don't see as even a point going anywhere? On 14-02-2012 02:48, Lucas Fernando Amorim wrote: On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
If the design is broken than the implementation is broken. Have you READ your own source code? Do you understand what its actually doing? Rhetorical questions of course but still. Your poc calls curl multiple times via a list of proxies. No more, no less. If you are going to claim that such a thing is an effective general technique YOU have to back up that claim, not me or anyone else on this list. I never bothered running it because anyone who read that simple python code(which was a good thing its simple), can understand what it is doing, and do a mental comparison to what they previously knew about the subject of dos. Your poc does not demonstrate anything new, it demonstrates existing knowledge that is generally known to not be an effective method for dosing for all the reasons I explained in my previous mails. I think its quite pedantic of you to only criticize me for calling out the ineffectiveness of your poc. You did not address anything I or anyone else said about your claim. If you think I am wrong or mistaken in my personal assessment of your claim than you are the one who must show how and why to defend your claim. Belittling someone who criticizes you is not professional, not productive, does not give strength to your claim, and does not make you right. The end of the line is I don't care what you claim your code does, I care about what the code does, and your code is not an effective general technique for denial of service attacks. On Feb 13, 2012 8:48 PM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: ** I could argue that an attack targeted at a service, especially HTTP, is not measured by the band, but the requests, especially the heavier, could argue that a technique is the most inherent characteristic of multiple sources of traffic and still relying on trust. I could still say that is an implementation that relates only to say - Look, it exists!, I could still prolong explaining about overheads, and using about the same time many sites that make the requests, thus reducing the wake of a failure, even if you say easily diagnosable. But I'd rather say that it is actually very pedantic of you label something as inefficient, especially when not done a single test, only the pedantic observation of someone whose interests it is reprehensible. I will not say you're one of those, but this is really an attitude typical of this kind, which is certainly not a hacker. Thanks to people like that, do not know if you like, there are many flaws yet to be explored. If anyone wants more information, obviously I will ask to send an email or call me to give a presentation, I will not think about anything. My goal in was invited researchers to study DDoS on this model, because anytime someone can direct thousands to generate a network congestion. On 13-02-2012 11:17, Gage Bystrom wrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the
Re: [Full-disclosure] Arbitrary DDoS PoC
I do not understand why you are wasting time on an obvious troll to downright, and I don't normally call people names but he well deserves it, a retard. I think I ironically illustrated the fundamental flaw in that you can't possibly generate more bandwidth by using proxies for the python code provided due to it violates the laws of physics (literally). In fact, if we want to be technical, we could say it is less effective due to the handshake required to initiate the proxy connection in fact decreasing efficiency of input compared to input. If there was something besides making lots of proxy request there might be something there but it, in fact, has nothing. Taking into account THN retweeted his FD post and his obvious inability to understand why everyone is not taking him seriously I have concluded he is just trying to seek fame and fortune passing off as some kind of sec expert. Maybe get some brownie points with the skiddie crowd who wouldn't know better. Throwing fancy terms and pretending to know what they are talking about doesn't work up against real researchers who understand what they are doing. Poorly written scripts also do not impress anyone here considering that I could just put into google HTTP Proxy Flooder and a find superior equivalent (Even with Point and Click!). To this effect, I propose we look into Unicorns as a possible unconventional medium of DDoS due to their mythical properties in a network environment over-ruled by Pink Lepricons. Conclusion: Christian Magick. On Tue, Feb 14, 2012 at 10:19 AM, Gage Bystrom themadichi...@gmail.com wrote: If the design is broken than the implementation is broken. Have you READ your own source code? Do you understand what its actually doing? Rhetorical questions of course but still. Your poc calls curl multiple times via a list of proxies. No more, no less. If you are going to claim that such a thing is an effective general technique YOU have to back up that claim, not me or anyone else on this list. I never bothered running it because anyone who read that simple python code(which was a good thing its simple), can understand what it is doing, and do a mental comparison to what they previously knew about the subject of dos. Your poc does not demonstrate anything new, it demonstrates existing knowledge that is generally known to not be an effective method for dosing for all the reasons I explained in my previous mails. I think its quite pedantic of you to only criticize me for calling out the ineffectiveness of your poc. You did not address anything I or anyone else said about your claim. If you think I am wrong or mistaken in my personal assessment of your claim than you are the one who must show how and why to defend your claim. Belittling someone who criticizes you is not professional, not productive, does not give strength to your claim, and does not make you right. The end of the line is I don't care what you claim your code does, I care about what the code does, and your code is not an effective general technique for denial of service attacks. On Feb 13, 2012 8:48 PM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: I could argue that an attack targeted at a service, especially HTTP, is not measured by the band, but the requests, especially the heavier, could argue that a technique is the most inherent characteristic of multiple sources of traffic and still relying on trust. I could still say that is an implementation that relates only to say - Look, it exists!, I could still prolong explaining about overheads, and using about the same time many sites that make the requests, thus reducing the wake of a failure, even if you say easily diagnosable. But I'd rather say that it is actually very pedantic of you label something as inefficient, especially when not done a single test, only the pedantic observation of someone whose interests it is reprehensible. I will not say you're one of those, but this is really an attitude typical of this kind, which is certainly not a hacker. Thanks to people like that, do not know if you like, there are many flaws yet to be explored. If anyone wants more information, obviously I will ask to send an email or call me to give a presentation, I will not think about anything. My goal in was invited researchers to study DDoS on this model, because anytime someone can direct thousands to generate a network congestion. On 13-02-2012 11:17, Gage Bystrom wrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover
Re: [Full-disclosure] Arbitrary DDoS PoC
Just by glancing at the tool I would bet that this tool has the http headers misordered too. Its all good this tool would not be a very effective dos tool but keep up the good work and nice choice of the starfox quote. -- tuna 65617420646120706f6f20706f6f On Mon, Feb 13, 2012 at 08:48, adam a...@papsy.net wrote: I have to admit that I've only read the posts here, haven't actually followed the link, but in response to Gage: It entirely depends on how it's being done, specifically: what services/applications are being targeted and in what way. If he's proxying through big servers such as those owned by Facebook, Google, Wikipedia, etc: then it definitely does make a difference. You're assuming that his network speed would be the bottleneck, but to make that assumption, you first have to assume that he's actually waiting around for response data. Maybe it's too early to convey this in an understandable way, I don't know. An example scenario that would be effective though: imagine that you run a web server, also imagine that there's a resource (CPU/bandwidth) intensive script/page on that server. For the sake of discussion, let's assume that my home internet speed is 1/10 of your server. We can also probably assume that your server's network speed is 1/10 of Google's. If I can force Google's server to request that page, that automatically puts me at an advantage (especially if I close the connection before Google can send the response back to me). Even if you're correct about his particular script, the logic behind your response is flawed. In the above example, one could use multithreading to cycle requests to your server through Google, Facebook, Wikipedia, whoever. As soon as the request has been sent, the connection could be terminated. If that for some reason wouldn't work, the script could wait until one byte is received (e.g. the 2 in 200 OK) and close the connection then. At that point, the bandwidth/resources would have already been used. The bottom line is that you could easily use the above concepts (and likely what the OP has designed) to overpower a server/service while using very little resources of your own. It's all circumstantial anyway though. My overall point, specifics aside, is that being able to use Google or Facebook's resources against a target is definitely beneficial and has all kinds of advantages. On Mon, Feb 13, 2012 at 7:17 AM, Gage Bystrom themadichi...@gmail.com wrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___
Re: [Full-disclosure] Arbitrary DDoS PoC
Haha lets all ddos through tor.and proxies...thats how we speed shit up. -- tuna 65617420646120706f6f20706f6f On Mon, Feb 13, 2012 at 14:14, Sanguinarious Rose sanguiner...@occultusterra.com wrote: Ah what a wonderful gem of pure and real research into todays upcoming threats. Today is the day we learn to phear sites like xroxy.com because God forbid some of those silly kids using their 9001 proxies from their 56k dial-ups will over-run google, youtube, facebook, and the world! Dear God what will we do?!?!? When will it end! Think of the cute kittens you deprive us of evil proxy hackers! Today is the day I learned hackers can cast magick upon outgoing packets through proxies to somehow make them more bigger. I propose these are some kind of Christian hackers with God on their side to manipulate the very foundational laws of physics and electricity! Excuse me Mr. Amorim but what God alas do you pray to for this? Is it some kind of Christian Magick? On Sun, Feb 12, 2012 at 9:09 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
I could argue that an attack targeted at a service, especially HTTP, is not measured by the band, but the requests, especially the heavier, could argue that a technique is the most inherent characteristic of multiple sources of traffic and still relying on trust. I could still say that is an implementation that relates only to say - Look, it exists!, I could still prolong explaining about overheads, and using about the same time many sites that make the requests, thus reducing the wake of a failure, even if you say easily diagnosable. But I'd rather say that it is actually very pedantic of you label something as inefficient, especially when not done a single test, only the pedantic observation of someone whose interests it is reprehensible. I will not say you're one of those, but this is really an attitude typical of this kind, which is certainly not a hacker. Thanks to people like that, do not know if you like, there are many flaws yet to be explored. If anyone wants more information, obviously I will ask to send an email or call me to give a presentation, I will not think about anything. My goal in was invited researchers to study DDoS on this model, because anytime someone can direct thousands to generate a network congestion. On 13-02-2012 11:17, Gage Bystrom wrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br mailto:lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
On 2/14/2012 2:58 PM, Sanguinarious Rose wrote: I do not understand why you are wasting time on an obvious troll to downright, and I don't normally call people names but he well deserves it, a retard. I think I ironically illustrated the fundamental flaw in that you can't possibly generate more bandwidth by using proxies for the python code provided due to it violates the laws of physics (literally). In fact, if we want to be technical, we could say it is less effective due to the handshake required to initiate the proxy connection in fact decreasing efficiency of input compared to input. If there was something besides making lots of proxy request there might be something there but it, in fact, has nothing. Taking into account THN retweeted his FD post and his obvious inability to understand why everyone is not taking him seriously I have concluded he is just trying to seek fame and fortune passing off as some kind of sec expert. Maybe get some brownie points with the skiddie crowd who wouldn't know better. Throwing fancy terms and pretending to know what they are talking about doesn't work up against real researchers who understand what they are doing. Poorly written scripts also do not impress anyone here considering that I could just put into google HTTP Proxy Flooder and a find superior equivalent (Even with Point and Click!). To this effect, I propose we look into Unicorns as a possible unconventional medium of DDoS due to their mythical properties in a network environment over-ruled by Pink Lepricons. Conclusion: Christian Magick. On Tue, Feb 14, 2012 at 10:19 AM, Gage Bystrom themadichi...@gmail.com wrote: If the design is broken than the implementation is broken. Have you READ your own source code? Do you understand what its actually doing? Rhetorical questions of course but still. Your poc calls curl multiple times via a list of proxies. No more, no less. If you are going to claim that such a thing is an effective general technique YOU have to back up that claim, not me or anyone else on this list. I never bothered running it because anyone who read that simple python code(which was a good thing its simple), can understand what it is doing, and do a mental comparison to what they previously knew about the subject of dos. Your poc does not demonstrate anything new, it demonstrates existing knowledge that is generally known to not be an effective method for dosing for all the reasons I explained in my previous mails. I think its quite pedantic of you to only criticize me for calling out the ineffectiveness of your poc. You did not address anything I or anyone else said about your claim. If you think I am wrong or mistaken in my personal assessment of your claim than you are the one who must show how and why to defend your claim. Belittling someone who criticizes you is not professional, not productive, does not give strength to your claim, and does not make you right. The end of the line is I don't care what you claim your code does, I care about what the code does, and your code is not an effective general technique for denial of service attacks. On Feb 13, 2012 8:48 PM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: I could argue that an attack targeted at a service, especially HTTP, is not measured by the band, but the requests, especially the heavier, could argue that a technique is the most inherent characteristic of multiple sources of traffic and still relying on trust. I could still say that is an implementation that relates only to say - Look, it exists!, I could still prolong explaining about overheads, and using about the same time many sites that make the requests, thus reducing the wake of a failure, even if you say easily diagnosable. But I'd rather say that it is actually very pedantic of you label something as inefficient, especially when not done a single test, only the pedantic observation of someone whose interests it is reprehensible. I will not say you're one of those, but this is really an attitude typical of this kind, which is certainly not a hacker. Thanks to people like that, do not know if you like, there are many flaws yet to be explored. If anyone wants more information, obviously I will ask to send an email or call me to give a presentation, I will not think about anything. My goal in was invited researchers to study DDoS on this model, because anytime someone can direct thousands to generate a network congestion. On 13-02-2012 11:17, Gage Bystrom wrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the
Re: [Full-disclosure] Arbitrary DDoS PoC
Now, I had to do it. I took a look at his other projects (I know, I
know..., it has begun)
https://github.com/lfamorim/IntensiveDoS
If you thought the python code was bad... It doesn't even do anything
remotely effective. Now, pthreads has a cap of around 200 max threads
(depends on compile options, platform, etc.) a single process can do.
If this was even remotely Intensive it would be using async sockets
which you can at least get a few K of connections. Should I even
mention it just disconnects after connecting kinda rendering well, I
can't think of a polite way to say it, utterly useless. Any properly
setup http, apache even, can reflect this like throwing cotton balls
but in his case he is claiming the cotton balls are somehow really
bowling balls.
*http_header = GET / HTTP/1.1\r\n\r\n;
This HTTP request doesn't include a Host field hence breaking the
HTTP 1.1 standard before we even begin.
I also noticed he doesn't believe in functions with variables instead
relying on globals.
Sections of the code sometimes use { } for a single
if/while/else/for/etc. statement and some don't which makes me wonder
if it's copy/paste. In my experience and in my own programming they
usually don't dash their code with such style irregularities.
Now inside his Makefile:
rm -rf IntensiveDoS IntensiveDoS.o
Do you seriously need to recursively deleted two files forcefully?
Now on this: https://github.com/lfamorim/Connect-Back-Win32-Trojan
All I can really say is it's not a very good trojan if it leaves a big
black console screen and if you click the 'X' it goes away /
terminates the reverse shell. The standard reverse shell code can be
found on google with many more improvements and there is nothing
really innovative or interesting here.
Now This: https://github.com/lfamorim/rebreaker
All I can say is 12 lines of code being called Extremely advanced
algorithm to remove distortions from recaptcha images, allowing OCR.
using http://projects.scipy.org/scipy/milestone/0.10.0 is rather well.
Just take a look (the main 2 lines of the program that do anything).
for i in WordSlice(imread(argv[1], True)).get_words():
Hough(i).find_ellipses(lambda img: imresize(img, 0.4, 'bilinear'))
I don't think I have to say anything else for those two lines of
Extremely advanced algorithm besides this single line.
lfamorim pushed to master at lfamorim/rebreaker February 14, 2012 =
40369be making things more efficient.
Combine the above with his proxy botnet using curl I have to ask
why would anyone respond to this guy in a logical fashion when it is
obvious he does not know what he is doing. He is as bad as Steve
Gibson ranting about raw socket support in WindowsXP and how it's
going to end the entire internet, only in this case he is referring to
open proxies.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Arbitrary DDoS PoC
With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
I have to admit that I've only read the posts here, haven't actually followed the link, but in response to Gage: It entirely depends on how it's being done, specifically: what services/applications are being targeted and in what way. If he's proxying through big servers such as those owned by Facebook, Google, Wikipedia, etc: then it definitely does make a difference. You're assuming that his network speed would be the bottleneck, but to make that assumption, you first have to assume that he's actually waiting around for response data. Maybe it's too early to convey this in an understandable way, I don't know. An example scenario that would be effective though: imagine that you run a web server, also imagine that there's a resource (CPU/bandwidth) intensive script/page on that server. For the sake of discussion, let's assume that my home internet speed is 1/10 of your server. We can also probably assume that your server's network speed is 1/10 of Google's. If I can force Google's server to request that page, that automatically puts me at an advantage (especially if I close the connection before Google can send the response back to me). Even if you're correct about his particular script, the logic behind your response is flawed. In the above example, one could use multithreading to cycle requests to your server through Google, Facebook, Wikipedia, whoever. As soon as the request has been sent, the connection could be terminated. If that for some reason wouldn't work, the script could wait until one byte is received (e.g. the 2 in 200 OK) and close the connection then. At that point, the bandwidth/resources would have already been used. The bottom line is that you could easily use the above concepts (and likely what the OP has designed) to overpower a server/service while using very little resources of your own. It's all circumstantial anyway though. My overall point, specifics aside, is that being able to use Google or Facebook's resources against a target is definitely beneficial and has all kinds of advantages. On Mon, Feb 13, 2012 at 7:17 AM, Gage Bystrom themadichi...@gmail.comwrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Arbitrary DDoS PoC
Absolutely and that's partly my point. The methods you describe are neigh exactly how modern general ddos techniques work, which is not how this works. One problem is you can't use Facebook or Google as an open proxy like you're saying because 1.) It assumes you can force Google or Facebook to make multiple requests for just one of your requests, else you are still being stuck to how much you can output vs how much they can take. Just because you can tweak how much you can send does not change the basic principal behind this and 2.) It no longer becomes a general method because you must abuse a particular flaw in a particular service to get it to use its resources to flood the targets resources. Not trying to really argue your examples, I'm just saying his script and his bug report or whatever you call it is terribly ineffective as a general method compared to pretty standard techniques like you described, and does not abuse any implementation or protocol to be a specific flaw a la the Apache dos bug a few months ago. It's like he's claiming he found the new smurf attack when all the attack is a script calling curl through a proxy, torrenting the latest distro install disk is a bigger DoS technique than this. On Feb 13, 2012 5:48 AM, adam a...@papsy.net wrote: I have to admit that I've only read the posts here, haven't actually followed the link, but in response to Gage: It entirely depends on how it's being done, specifically: what services/applications are being targeted and in what way. If he's proxying through big servers such as those owned by Facebook, Google, Wikipedia, etc: then it definitely does make a difference. You're assuming that his network speed would be the bottleneck, but to make that assumption, you first have to assume that he's actually waiting around for response data. Maybe it's too early to convey this in an understandable way, I don't know. An example scenario that would be effective though: imagine that you run a web server, also imagine that there's a resource (CPU/bandwidth) intensive script/page on that server. For the sake of discussion, let's assume that my home internet speed is 1/10 of your server. We can also probably assume that your server's network speed is 1/10 of Google's. If I can force Google's server to request that page, that automatically puts me at an advantage (especially if I close the connection before Google can send the response back to me). Even if you're correct about his particular script, the logic behind your response is flawed. In the above example, one could use multithreading to cycle requests to your server through Google, Facebook, Wikipedia, whoever. As soon as the request has been sent, the connection could be terminated. If that for some reason wouldn't work, the script could wait until one byte is received (e.g. the 2 in 200 OK) and close the connection then. At that point, the bandwidth/resources would have already been used. The bottom line is that you could easily use the above concepts (and likely what the OP has designed) to overpower a server/service while using very little resources of your own. It's all circumstantial anyway though. My overall point, specifics aside, is that being able to use Google or Facebook's resources against a target is definitely beneficial and has all kinds of advantages. On Mon, Feb 13, 2012 at 7:17 AM, Gage Bystrom themadichi...@gmail.comwrote: Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request. Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawnsand rely on shear numbers and/or superior resource exhaustion methods On Feb 13, 2012 4:37 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P
Re: [Full-disclosure] Arbitrary DDoS PoC
Ah what a wonderful gem of pure and real research into todays upcoming threats. Today is the day we learn to phear sites like xroxy.com because God forbid some of those silly kids using their 9001 proxies from their 56k dial-ups will over-run google, youtube, facebook, and the world! Dear God what will we do?!?!? When will it end! Think of the cute kittens you deprive us of evil proxy hackers! Today is the day I learned hackers can cast magick upon outgoing packets through proxies to somehow make them more bigger. I propose these are some kind of Christian hackers with God on their side to manipulate the very foundational laws of physics and electricity! Excuse me Mr. Amorim but what God alas do you pray to for this? Is it some kind of Christian Magick? On Sun, Feb 12, 2012 at 9:09 AM, Lucas Fernando Amorim lf.amo...@yahoo.com.br wrote: With the recent wave of DDoS, a concern that was not taken is the model where the zombies were not compromised by a Trojan. In the standard modeling of DDoS attack, the machines are purchased, usually in a VPS, or are obtained through Trojans, thus forming a botnet. But the arbitrary shape doesn't need acquire a collection of computers. Programs, servers and protocols are used to arbitrarily make requests on the target. P2P programs are especially vulnerable, DNS, internet proxies, and many sites that make requests of user like Facebook or W3C, also are. Precisely I made a proof-of-concept script of 60 lines hitting most of HTTP servers on the Internet, even if they have protections likely mod_security, mod_evasive. This can be found on this link [1] at GitHub. The solution of the problem depends only on the reformulation of protocols and limitations on the number of concurrent requests and totals by proxies and programs for a given site, when exceeded returning a cached copy of the last request. [1] https://github.com/lfamorim/barrelroll Cheers, Lucas Fernando Amorim http://twitter.com/lfamorim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
