Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
There is no evidence of 0day in the wild for the upcoming patches and Microsoft have released no information to suggest so. On Fri, Nov 7, 2008 at 4:18 PM, [EMAIL PROTECTED] wrote: 2) There's a very high chance that at least some percent of the black-hat community is sitting on a 0-day exploit for these, that they've been using for directed attacks under the radar (and in fact, a good chance that the bulletin was issued because somebody's attack *didn't* go under the radar, and that's how the white hats got a copy of the exploit). This bulletin is a heads-up to those black hats that their 0-day is going to be dropping in value a lot starting Tuesday - so it's smoke em if you got em time. For bonus points - compute what percent of advisories released next week that *claim* to be reverse-engineering of the binary diff are actually drops of 0-days that just became useless... ;) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
I love waking up in the morning to read this! Ahh On Fri, Nov 7, 2008 at 10:39 AM, Anders Klixbull [EMAIL PROTECTED] wrote: The hardcore cockgobbler scene of scotland -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Elazar Broad Sent: 7. november 2008 07:34 To: full-disclosure@lists.grok.org.uk; [EMAIL PROTECTED] Subject: Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What scene... On Thu, 06 Nov 2008 20:06:47 -0500 n3td3v [EMAIL PROTECTED] wrote: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQECAAYFAkkT4VIACgkQi04xwClgpZjqkQP/TCHzaFO3ngEhyXoJPlowTfzidJzg KyzTUAiLg4AKvqxXg+TSHiIkSDQWqCmzDr0qQ5OqywMgXmbWFNZzAdZuQtf5kW4KDBLx eclRU3VoqfSCcEMb6puLNQdnHudcVxxZk1dQQdBLlfddHRuX6sGllNkVVvtiaYPnK1U1 QxmDKXU= =bW8c -END PGP SIGNATURE- -- Click here to find old friends, lovers or family. http://tagline.hushmail.com/fc/Ioyw6h4fH5T0ZWneBo4QKHZMbrYp7sz9W8sLWHvUL RkY7oBbDmctTq/http://tagline.hushmail.com/fc/Ioyw6h4fH5T0ZWneBo4QKHZMbrYp7sz9W8sLWHvULRkY7oBbDmctTq/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- http://www.goldwatches.com/ http://www.jewelerslounge.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
On Fri, 07 Nov 2008 07:18:18 GMT, Col said: I don't think any hacker is going to bother spending 5 days looking for a needle in a haystack when he can reverse engineer specific files once the patch is released. I know very little of looking for pointers in DLLs but from what I've seen it looks like a bit of a nightmare. The best way is to diff two files - the un-patched and the patched then you see where the changes are. You're closer than most, but nobody's nailed the *actual* trade-off involved: 1) Large sites need a heads-up so they can form at least a rough estimate of how much time/effort they will need to put in to deploying patches before the guys who are doing diffs of binaries get their exploits. If it's a low rating, they can afford to do a lot of regression testing and deploy on a relaxed timetable (Oh, the guys over in XYZ have their weekly consolidation run tonight, we'll upgrade them *tomorrow* night versus Screw the XYZ run, we're pushing this in 2 hours whether they like it or not). 2) There's a very high chance that at least some percent of the black-hat community is sitting on a 0-day exploit for these, that they've been using for directed attacks under the radar (and in fact, a good chance that the bulletin was issued because somebody's attack *didn't* go under the radar, and that's how the white hats got a copy of the exploit). This bulletin is a heads-up to those black hats that their 0-day is going to be dropping in value a lot starting Tuesday - so it's smoke em if you got em time. For bonus points - compute what percent of advisories released next week that *claim* to be reverse-engineering of the binary diff are actually drops of 0-days that just became useless... ;) pgpBhBTk1Tgwm.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Shut the fuck up We're tired to hear your shit dude. Why don't you just keep on squatting your fucking mailing list with your friends ? You have no friends here, and you're not welcome, get the fuck out of here. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. Do you understand that or are you much of an ignorant person to even realise that you are a joke to us. I will say that again just incase you missed it YOU ARE A JOKE. And people dont think I just make up that hes a drugfuck, he even admitted his use of illegal substances way back in 2005. So, Mr n3td3v, my question to you is how can you be in such support of the governments security posture on one hand, but ignore their views on drugs on the other? Do you think you are above the governments laws and as such only need to follow what you dictate to be applicable to you? On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
n3td3v wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. Whitehats hate you equally because you just create spam and don't post anything of actual value. You have your mailing list. Why can't you just stay there until you have anything of value to disclose? -- // hdw ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Dear n3td3v, I sincerely regret to inform you that if all you have done for the past 10 years is monitor the scene (i.e. trolling/spamming mailing lists and chatrooms with elementary ramblings) then you have no leg to stand on when somebody questions your experience. In fact, it is quite pitiful. Get a job or something. Sincerely, offbitz On Thu, Nov 6, 2008 at 7:06 PM, n3td3v [EMAIL PROTECTED] wrote: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
thats 9 years u fucking moron. that could NOT have been funnier. most of us on this list have been WORKING in this industry for longer than that. u just sit and rant. take everyones advice, including mine. fucking leave. we dont care about u. microsoft is smarter than u, we are all smarter than u. microsoft does it for a reason, and u obviously dont understand what that reason is. On Thu, Nov 6, 2008 at 8:06 PM, n3td3v [EMAIL PROTECTED] wrote: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
I have watched movies for 10 years, does this make me an experienced director? No, because watching isn't doing and as such it is not experience. Now please address the issue of your illegal drug use, which demonstrates complete disregard for your governments laws. On Fri, Nov 7, 2008 at 12:06 PM, n3td3v [EMAIL PROTECTED] wrote: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Acting like the child that he is, n3td3v continues to ignore questions posed to him. How can he be such an avid debater over the legality of things like metasploit, 0day auctions and similarly themed bullshit threads when he completely disregards drug laws? How do you intend to lobby people to listen to you when you are not a law abiding citizen yourself? You have no credibility in the eyes of the law, so don't psuedo threaten people trying to appear like you have some government backing. You have proven beyond doubt that you dont, because the government doesnt listen to drug taking internet heroes, such as yourself. So enough with the bullshit.. FUCK OFF AND DIE. On Fri, Nov 7, 2008 at 1:02 PM, n3td3v [EMAIL PROTECTED] wrote: i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
you seem like an hd moore/metasploit fan boy pissed off that i don't respect him or like his metasploit software. n3td3v doesn't respect people like the sheep do, i think for myself, have opinions about other white hats that may not be in support of them. get used to it bozo. On Fri, Nov 7, 2008 at 4:34 AM, Biz Marqee [EMAIL PROTECTED] wrote: Acting like the child that he is, n3td3v continues to ignore questions posed to him. How can he be such an avid debater over the legality of things like metasploit, 0day auctions and similarly themed bullshit threads when he completely disregards drug laws? How do you intend to lobby people to listen to you when you are not a law abiding citizen yourself? You have no credibility in the eyes of the law, so don't psuedo threaten people trying to appear like you have some government backing. You have proven beyond doubt that you dont, because the government doesnt listen to drug taking internet heroes, such as yourself. So enough with the bullshit.. FUCK OFF AND DIE. On Fri, Nov 7, 2008 at 1:02 PM, n3td3v [EMAIL PROTECTED] wrote: i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
I could care less about metasploit, all it does is help the kiddies.. but that doesnt mean it should be illegal. Software is knowledge and knowledge should be free, but that is not the issue here. The issue is that you are a bullshitting drug abuser who's child like demeanor wont allow him to even acknowledge bad things written about him. You are performing the internet equivalent of sticking your fingers in your ears and yelling nana i cant hear you in an attempt to make the situation go away. So you unknowledgable, untalented, unemployed junkie.. do you have anything relevant to what I asked to contribute or are you going to just ignore it like the pussy that you are? Also, dont try and portray yourself like a free thinking martyr... your opinions are just rehashed idea sparked off cnet news comments and various other sources of security information. Anyone who knows even the slightest thing about information security knows you and your idealist views are a joke. On Fri, Nov 7, 2008 at 3:46 PM, n3td3v [EMAIL PROTECTED] wrote: you seem like an hd moore/metasploit fan boy pissed off that i don't respect him or like his metasploit software. n3td3v doesn't respect people like the sheep do, i think for myself, have opinions about other white hats that may not be in support of them. get used to it bozo. On Fri, Nov 7, 2008 at 4:34 AM, Biz Marqee [EMAIL PROTECTED] wrote: Acting like the child that he is, n3td3v continues to ignore questions posed to him. How can he be such an avid debater over the legality of things like metasploit, 0day auctions and similarly themed bullshit threads when he completely disregards drug laws? How do you intend to lobby people to listen to you when you are not a law abiding citizen yourself? You have no credibility in the eyes of the law, so don't psuedo threaten people trying to appear like you have some government backing. You have proven beyond doubt that you dont, because the government doesnt listen to drug taking internet heroes, such as yourself. So enough with the bullshit.. FUCK OFF AND DIE. On Fri, Nov 7, 2008 at 1:02 PM, n3td3v [EMAIL PROTECTED] wrote: i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6, n3td3v [EMAIL PROTECTED]: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM,
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
why should i respond to your off-topic personal jabs? all it would do is start a flame war and im not into that. im performing self control and restraint by not responding to your personal jabs, nobody on the list wants a flame war based on personal jabs, so im not going to feed it. im reading everything you say, im not ignoring it. if you choose to be against me and not with me is your choice that you make, there is nothing else for me to add on the topic. On Fri, Nov 7, 2008 at 5:09 AM, Biz Marqee [EMAIL PROTECTED] wrote: I could care less about metasploit, all it does is help the kiddies.. but that doesnt mean it should be illegal. Software is knowledge and knowledge should be free, but that is not the issue here. The issue is that you are a bullshitting drug abuser who's child like demeanor wont allow him to even acknowledge bad things written about him. You are performing the internet equivalent of sticking your fingers in your ears and yelling nana i cant hear you in an attempt to make the situation go away. So you unknowledgable, untalented, unemployed junkie.. do you have anything relevant to what I asked to contribute or are you going to just ignore it like the pussy that you are? Also, dont try and portray yourself like a free thinking martyr... your opinions are just rehashed idea sparked off cnet news comments and various other sources of security information. Anyone who knows even the slightest thing about information security knows you and your idealist views are a joke. On Fri, Nov 7, 2008 at 3:46 PM, n3td3v [EMAIL PROTECTED] wrote: you seem like an hd moore/metasploit fan boy pissed off that i don't respect him or like his metasploit software. n3td3v doesn't respect people like the sheep do, i think for myself, have opinions about other white hats that may not be in support of them. get used to it bozo. On Fri, Nov 7, 2008 at 4:34 AM, Biz Marqee [EMAIL PROTECTED] wrote: Acting like the child that he is, n3td3v continues to ignore questions posed to him. How can he be such an avid debater over the legality of things like metasploit, 0day auctions and similarly themed bullshit threads when he completely disregards drug laws? How do you intend to lobby people to listen to you when you are not a law abiding citizen yourself? You have no credibility in the eyes of the law, so don't psuedo threaten people trying to appear like you have some government backing. You have proven beyond doubt that you dont, because the government doesnt listen to drug taking internet heroes, such as yourself. So enough with the bullshit.. FUCK OFF AND DIE. On Fri, Nov 7, 2008 at 1:02 PM, n3td3v [EMAIL PROTECTED] wrote: i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri, Nov 7, 2008 at 1:20 AM, waveroad waveroad [EMAIL PROTECTED] wrote: You can be monitoring the scene since 20 years if you want to, it's not for that your point will be valuable. And actually it is not, also this is about logic. See you're wrong again. Get the fuck out of here. 2008/11/6,
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Nobody on the list wants YOU so I don't see how you can justify what people want to see as your argument for not retaliating. Ill fuck you 'til you love me, faggot. On Fri, Nov 7, 2008 at 4:31 PM, n3td3v [EMAIL PROTECTED] wrote: why should i respond to your off-topic personal jabs? all it would do is start a flame war and im not into that. im performing self control and restraint by not responding to your personal jabs, nobody on the list wants a flame war based on personal jabs, so im not going to feed it. im reading everything you say, im not ignoring it. if you choose to be against me and not with me is your choice that you make, there is nothing else for me to add on the topic. On Fri, Nov 7, 2008 at 5:09 AM, Biz Marqee [EMAIL PROTECTED] wrote: I could care less about metasploit, all it does is help the kiddies.. but that doesnt mean it should be illegal. Software is knowledge and knowledge should be free, but that is not the issue here. The issue is that you are a bullshitting drug abuser who's child like demeanor wont allow him to even acknowledge bad things written about him. You are performing the internet equivalent of sticking your fingers in your ears and yelling nana i cant hear you in an attempt to make the situation go away. So you unknowledgable, untalented, unemployed junkie.. do you have anything relevant to what I asked to contribute or are you going to just ignore it like the pussy that you are? Also, dont try and portray yourself like a free thinking martyr... your opinions are just rehashed idea sparked off cnet news comments and various other sources of security information. Anyone who knows even the slightest thing about information security knows you and your idealist views are a joke. On Fri, Nov 7, 2008 at 3:46 PM, n3td3v [EMAIL PROTECTED] wrote: you seem like an hd moore/metasploit fan boy pissed off that i don't respect him or like his metasploit software. n3td3v doesn't respect people like the sheep do, i think for myself, have opinions about other white hats that may not be in support of them. get used to it bozo. On Fri, Nov 7, 2008 at 4:34 AM, Biz Marqee [EMAIL PROTECTED] wrote: Acting like the child that he is, n3td3v continues to ignore questions posed to him. How can he be such an avid debater over the legality of things like metasploit, 0day auctions and similarly themed bullshit threads when he completely disregards drug laws? How do you intend to lobby people to listen to you when you are not a law abiding citizen yourself? You have no credibility in the eyes of the law, so don't psuedo threaten people trying to appear like you have some government backing. You have proven beyond doubt that you dont, because the government doesnt listen to drug taking internet heroes, such as yourself. So enough with the bullshit.. FUCK OFF AND DIE. On Fri, Nov 7, 2008 at 1:02 PM, n3td3v [EMAIL PROTECTED] wrote: i'm sorry that you don't agree with my heads up theory, i stand by what i said however. i'm sure microsoft don't read full-disclosure anyway, so you're right i'm not going to change anything. by the way, i've noticed you haven't stopped stalking me yet, im a bit concerned about your health. cheers. On Fri, Nov 7, 2008 at 1:44 AM, Ureleet [EMAIL PROTECTED] wrote: first off, u arent going to get any1 2 change anything. so, lets get that out of the way right there. second of all, in order for u 2 prove ur point, id like 4 u to go to some research of how many exploits have come out during the 5 day period between vague-ass disclosure and patch publish. then compare and contrast that against how many exploits have come out in the 24 hours following the patch publish after people have had a chance to do bindiffs (u know what that means right white-hat?) against the patches. then, take all that data, draw some charts and graphs, write a whitepaper, and present it somewhere. u know what thats called? research. real ppl do it. u dont. and that is why, u suck. ta ta. On Thu, Nov 6, 2008 at 8:34 PM, n3td3v [EMAIL PROTECTED] wrote: so you don't think its logical that these 5 day heads up could be helping the bad guys out? right. i think the world's biggest hackers could do a lot of research in 5 days. but then again n3td3v isn't logical so i must be wrong. damn those drugs eh? i just asked what the realistic possibility was for a 5 day turn around from the day of the heads up until a patch is released. i just thought it was bad that we were giving the bad guys a 5 day head start, but never mind n3td3v isn't logical so i must be wrong. scraping the 5 day head start isn't a good idea because n3td3v isn't logical? right, i threw away 10 years of my life to not be logical... On Fri,
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
haha, you agree with n3td3v on something! you're making a start at least young padawan. keep up the good work. On Fri, Nov 7, 2008 at 5:09 AM, Biz Marqee [EMAIL PROTECTED] wrote: I could care less about metasploit, all it does is help the kiddies. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
Probably because there's noone on his mailing list despite his claim of 5000 subscribers. Seriously n3td3v, I'd love to hear you answer as to why you continue to troll the FD list with blatant nonsense while you have this amazing list of 5000 some odd subscribers who all want to hear what you have to say. On Thu, Nov 6, 2008 at 7:40 PM, Anders B Jansson [EMAIL PROTECTED] wrote: n3td3v wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. Whitehats hate you equally because you just create spam and don't post anything of actual value. You have your mailing list. Why can't you just stay there until you have anything of value to disclose? -- // hdw ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
2008/11/6 n3td3v [EMAIL PROTECTED]: snip i'm not sure this is a good idea as it gives a heads up to hackers. you may think its not long but its actually 5 days for a hacker to figure out potentially a vulnerability in said area. maybe we should have a discussion about the pros and cons of these microsoft heads up and what the reality of it is for the bad guys to be able to pin point and start exploiting a flaw in said area in a 5 day time frame. yours n3td3v. I don't think any hacker is going to bother spending 5 days looking for a needle in a haystack when he can reverse engineer specific files once the patch is released. I know very little of looking for pointers in DLLs but from what I've seen it looks like a bit of a nightmare. The best way is to diff two files - the un-patched and the patched then you see where the changes are. Of course if you had thought about it or done *any* research before you posted you would already have made that point. I am not a white/grey/black/pink hat I'm just an NT Admin type person who monitors this list for Full Disclosure of bugs in software. Instead I have trawl through your incessant ramblings on most days. Yes I have filters set up in Gmail of course, but I still have to deal with the replies, which before you go on about it are justifiably offensive because you've polluted this list for years with your crap - most have had enough of it. Now please go and get a job in something completely different so you can sleep through the night like the rest of us. Regards, Colin. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What scene... On Thu, 06 Nov 2008 20:06:47 -0500 n3td3v [EMAIL PROTECTED] wrote: i've been monitoring the scene since 1999 so what do you mean no experience? i make that about 10 years experience if my math is correct. On Fri, Nov 7, 2008 at 12:48 AM, Biz Marqee [EMAIL PROTECTED] wrote: Do you even understand why people dont like you? It is because you have all these crackpot ideas but no experience to back it up. All your ideas only make sense from a theoretical standpoint, but in practicality most will fail. On Fri, Nov 7, 2008 at 11:31 AM, n3td3v [EMAIL PROTECTED] wrote: blackhats like you will always hate on me, so i just ignore the negative responses i get. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQECAAYFAkkT4VIACgkQi04xwClgpZjqkQP/TCHzaFO3ngEhyXoJPlowTfzidJzg KyzTUAiLg4AKvqxXg+TSHiIkSDQWqCmzDr0qQ5OqywMgXmbWFNZzAdZuQtf5kW4KDBLx eclRU3VoqfSCcEMb6puLNQdnHudcVxxZk1dQQdBLlfddHRuX6sGllNkVVvtiaYPnK1U1 QxmDKXU= =bW8c -END PGP SIGNATURE- -- Click here to find old friends, lovers or family. http://tagline.hushmail.com/fc/Ioyw6h4fH5T0ZWneBo4QKHZMbrYp7sz9W8sLWHvULRkY7oBbDmctTq/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
