Re: [Full-disclosure] Re: Google and Yahoo search engine zero-day code
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear N3tN00dle, The more you post, the more convinced I become that you are complete moron. The one saving grace is that you provide so many free laughs!! Talk about delusions of grandeur. LOL. Given enough rope, you'll eventually hang yourself. Ninja [chop majority of cruft] > >1. insert exploit code into server > >2. wait for google and yahoo > >3. access key set once bot reaches your page, this lets n3td3v >research branch access our exploied data via search.yahoo.com (a >key >is assigned, so noone else can query our data by accident, this >acts >as a password for the search data. > >4. Our bot goes to search.yahoo.com with matching access key, and >grabs data... is served back to our database, where we then use >this >data to access corporate and consumer accounts, and do specialized >harvesting of the type of data we've grabbed from the Yahoo and >Google >servers. > >5. We define the different types of consumer and corporate data >thats >arrived on our database server, allowing us to further filter and >tag >different types of data, this then allows us to 'search our' >database >on demand for corporate and (or) corporate data. > >6. We have world domination, and Google and Yahoo cannot detect >the >malicious with their conventional aduit methods, because we asked >our >inside contacts. > >Happy coding. > >___ >Full-Disclosure - We believe in it. >Charter: http://lists.grok.org.uk/full-disclosure-charter.html >Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkSyzBoACgkQtM6vtsm2y1s0IQCbBd+7GSpKbzbJW4ScfnfRgdWBpUsA nRh/XuJNeWp51uCok5t1pYkJ4Rak =2vfn -END PGP SIGNATURE- Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Re: Google and Yahoo search engine zero-day code
I never reply to this mailing list but I feel that this blatant and unashamed plagiarism should be exposed! This 'breaking' news by the n3td3v research branch was written about by Michal Zalewski in his excellent book, 'silence on the wire'. Maybe Zalewski is part of the 'fearsome' :) netdev group but I doubt it! On 7/5/06, Dave No, not that one Korn <[EMAIL PROTECTED]> wrote: Denis Jedig wrote: > n3td3v wrote: > >> Today's disclosure involves Google and Yahoo search engines: >> >> All you need to do is put in the code to a web page, when Google and >> Yahoo visit it, then the code exploits the software they use and >> makes them start caching 'other' pages. Including 'no index' pages, >> where sites have setup a robot text file on their server to protect >> corporate and consumer interests. > > I think you missed the concept here. Whatever is on the webservers and > is available to the public is... well... available to the public. > > It does not help security matters to introduce a robots.txt - the > purpose of this directives file is not to secure something but to > reduce traffic and keep irrelevant content out of search engines. > > If you need security, you introduce some kind of authentication > *before* access is allowed to sensitive data. You will find that a > sign reading "Do not enter and do not steal any gold" will not help > much at the Fort Knox entrance if it is the only security measure. Also, Google and Yahoo *do* respect the robots.txt file and do check it for every server they fetch files from, and the whole thing is garbage. His so-called 'example' is a fraud because it shows yahoo caching a page from the site mtf.news.yahoo.com, which DOES NOT HAVE A ROBOTS.TXT FILE. cheers, DaveK -- Can't think of a witty .sigline today ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Re: Google and Yahoo search engine zero-day code
Denis Jedig wrote: > n3td3v wrote: > >> Today's disclosure involves Google and Yahoo search engines: >> >> All you need to do is put in the code to a web page, when Google and >> Yahoo visit it, then the code exploits the software they use and >> makes them start caching 'other' pages. Including 'no index' pages, >> where sites have setup a robot text file on their server to protect >> corporate and consumer interests. > > I think you missed the concept here. Whatever is on the webservers and > is available to the public is... well... available to the public. > > It does not help security matters to introduce a robots.txt - the > purpose of this directives file is not to secure something but to > reduce traffic and keep irrelevant content out of search engines. > > If you need security, you introduce some kind of authentication > *before* access is allowed to sensitive data. You will find that a > sign reading "Do not enter and do not steal any gold" will not help > much at the Fort Knox entrance if it is the only security measure. Also, Google and Yahoo *do* respect the robots.txt file and do check it for every server they fetch files from, and the whole thing is garbage. His so-called 'example' is a fraud because it shows yahoo caching a page from the site mtf.news.yahoo.com, which DOES NOT HAVE A ROBOTS.TXT FILE. cheers, DaveK -- Can't think of a witty .sigline today ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Re: Google and Yahoo search engine zero-day code
On 7/4/06, n3td3v <[EMAIL PROTECTED]> wrote: Exploit: Zero-day Status: High Type: Hi-Jack corporate crawler machines which have vulnerable robot cahcing software installed We've issued two zero-day warnings so far, OneCare and Cisco Systems Today's disclosure involves Google and Yahoo search engines: All you need to do is put in the code to a web page, when Google and Yahoo visit it, then the code exploits the software they use and makes them start caching 'other' pages. Including 'no index' pages, where sites have setup a robot text file on their server to protect corporate and consumer interests. We already gave an example of this earlier http://groups.google.com/group/n3td3v/browse_thread/thread/542b78eaabea015a/5b1c58ab92b11c4f The exploit allows you to insert 'arbitrary' code, which also means denial of service or 'crash' for short. This means the profit of GOOG and YHOO are compromised, but MOREOVER (Hi robert lemos) this means you can get Google and Yahoo to cache sensitive data. The cached data isn't avaiable to the public per say, because in the 'arbitrary' code, you assign a special encryption to the cache, that only the hacker knows. This means specific users use the search engine, with a robot to automatically harvest the exploited data. this part of the attack is possible because Google and Yahoo don't have 'word verfication' on all search queries. MOREOVER (Hi robert lemos), the compromised data, to which we exploit is used to break into Google and Yahoo, ebcause we have a list of all the corporate users logged in. However, all web servers are vulnerable, but our focus is Google and Yahoo employees you can use the exploit to get credit cards and other evils. Take care n3td3v research branch Google and Yahoo did not take our original seriously, so we re-allocate their memory today. This is ciritcal, but Henri and Mark don't talk to me anymore on Yahoo Messenger, so we can't pass info across to the vendor... and the [EMAIL PROTECTED] address you get no reply, so, its upto the international security community now for Google and Yahoo to get this patched once and for all. http us today at n3td3v.googlepages.com We work our wicked ways.. 1. insert exploit code into server 2. wait for google and yahoo 3. access key set once bot reaches your page, this lets n3td3v research branch access our exploied data via search.yahoo.com (a key is assigned, so noone else can query our data by accident, this acts as a password for the search data. 4. Our bot goes to search.yahoo.com with matching access key, and grabs data... is served back to our database, where we then use this data to access corporate and consumer accounts, and do specialized harvesting of the type of data we've grabbed from the Yahoo and Google servers. 5. We define the different types of consumer and corporate data thats arrived on our database server, allowing us to further filter and tag different types of data, this then allows us to 'search our' database on demand for corporate and (or) corporate data. 6. We have world domination, and Google and Yahoo cannot detect the malicious with their conventional aduit methods, because we asked our inside contacts. Happy coding. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
