I'll keep my response short simple...
This is an old debate, and one which never truly resolves because the contrary
opinions tend to be so deeply rooted. I have no objection to anyone wanting to
earn an _honest_ living finding and reporting vulnerabilities, but somewhere
along the line,
??
I'm unclear - exactly how does an ICMP echo cycle have anything to do with the
apparent disparity between the host portion of the CONNECT URI and the contents
of the host header?
I can see the logic in :
1. comparing the HOST header to the host portion of the CONNECT URI
2. resolving either
To be clear, the CONNECT request is a single request/response cycle between
the client and the proxy. Any request body is nonsensical and should be
ignored by the proxy (or the request can be rejected if the proxy wants to be
pedantic). There is nothing that explicitly disallows inclusion of
Gee, Tim - someone might think you had an axe to grind ducks swinging
keyboard...
I know; Thor has a hammer, but it still works (barely).
One thing worth mentioning is that there is no mitigation for those who are
still stuck using WS03, since NLA doesn't exist prior to Vista.
Those deployments
Michal,
First; while I agree with your statement regarding the overuse of car
analogies, the comparison is accurate and fair in this case. The vendor's
customers are now potentially at greater risk because of this announcement that
includes no mitigation.
Second; I fundamentally disagree
...@autistici.org]
Sent: Wednesday, March 23, 2011 09:54
To: Jim Harrison
Cc: Michal Zalewski; J. Oquendo; bugtraq@securityfocus.com
Subject: Re: Vulnerabilities in some SCADA server softwares
I fundamentally disagree with the idea that public disclosure as a
means of vendor notification serves any purpose
Not if you use smartcard authentication.
-Original Message-
From: sam.vaug...@gmail.com [mailto:sam.vaug...@gmail.com]
Sent: Tuesday, February 08, 2011 6:16 AM
To: bugtraq@securityfocus.com
Subject: Re: Microsoft Terminal Services vulnerable to MITM-attacks.
Does this issue still exist
Your Italian ISP example is far from unique.
I've received plenty of you're a spammer bounce-back NDR mails from (of all
places) mail.ru.
In fact, more than a few folks using that ISP must think I'm ignoring them
because isatools.org is considered a spam-source by this ISP. Actually, I
often
I've used Tim's block sets for awhile in my own FOAD rule, but I ended up
having to adjust the policy because of the toolsets I provide to the folks that
are trying to do a good day's work in those same locations.
Yes; there are plenty of good folks, computers and networks in China and other
The difference here is that renaming the admin also offers a some mitigation
against local (e.g., non-networked) attacks for when the same person that can't
be bothered to lock their session is rewarded with the latest d1psh1t virus
when they download their porn-mule update. Installing the OS
The concept is at least 5 years old: http://support.microsoft.com/kb/816456/.
Jim
-Original Message-
From: Adrian P [mailto:[EMAIL PROTECTED]
Sent: Thursday, October 30, 2008 7:31 PM
To: bugtraq@securityfocus.com; [EMAIL PROTECTED]
Subject: Universal Website Hijacking by Exploiting
You can't waste your time chasing things that might lead to cats dogs living
together in sin. Specifically, there's no privilege escalation beyond that
which began with if I install... It's pretty well understood that once you
have the ability to place your own code on a machine, it's game
Abe,
Other than a denial-of-service from the console (is the power switch now a
security vuln, too?), what can you do with this bug? It's absolutely,
unquestionably a bug; the user should see behavior as dictated by logic and
described in the documentation, but a security vulnerability?
I
Interesting (and serendipitous, at that g).
ISA Server 2004+ allows you to configure allowed / denied methods in any rule
for which the web proxy is involved; effectively nullifying this attack.
..of course, this requires the web devs to communicate the minimum required
methods for their site
sarcasm tagfor=oblivoious
Yeh, but what if I want you to justify your decisions in the context of my
perceptions?
You don't find it reasonable that because you wish to share your efforts for
free that they should serve my needs as well?
/sarcasm
For the record, I tried Tim's blocklists and
If you insist on sending these, can you at least save them for the first
calendar day in April or perhaps include a smiley or two? These claims rely
solely on loosely-associated data (not facts) and present little more than a
basic unicorn argument; the basis for any good conspiracy theory.
Heh-heh; he said Steve Gibson; heh-heh-heh
Seriously; Tim is right.
While Apple-oriented threats may not get either the validation or the publicity
(on hardly equals the other) that Windows attacks do, it's hardly accurate
(much less fair) to make those comparisons.
For all those comparative
..I am not planning to support my argument in any way..
That's a shame.
If you can prove your hypothesis, it lends credibility to your claims.
A refusal to do so only weakens your position.
As others have pointed out, your attack only works if security in depth has
been blatantly, intentionally
(copied here without permission)
Step by Step Demo:
- Download POC from http://tracingbug.com/downloads/citihook.zip and
unzip to some directory
- Launch citihook.exe, this will watch only
https://www.online.citibank.co.in/ URL
Effectively, Let me install my malware on your machine to
, May 09, 2007 11:14 AM
To: Jim Harrison
Cc: bugtraq@securityfocus.com
Subject: Re: Defeating Citibank Virtual Keyboard protection using
screenshot method
This is not malware, it will only help people to experiment and see the
result without writing one for themself.
Regards,
Yash K.S
On 5/9/07
.
-Original Message-
From: Gadi Evron [mailto:[EMAIL PROTECTED]
Sent: Wednesday, May 09, 2007 1:42 PM
To: Jim Harrison
Cc: Int3; bugtraq@securityfocus.com
Subject: RE: Defeating Citibank Virtual Keyboard protection using
screenshot method
On Wed, 9 May 2007, Jim Harrison wrote:
Granted, it's
Tried and failed.
Exactly how have you configured your test SP site?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Friday, May 04, 2007 3:01 PM
To: bugtraq@securityfocus.com
Subject: XSS in Microsoft SharePoint
Hi!
I think this is a XSS in MS SharePoint, you
sarcasm with=dripping
Yep - Windows Media Player put Real Media out of business while it
single-handedly eliminated any media format other than WM, all right...
..and oh, yeh - IE completely squashed the remaining Mozilla-based
development efforts.
Wait - does anyone remember Unix-based OS's?
: Monday, March 19, 2007 11:50 AM
To: [EMAIL PROTECTED]; Jim Harrison; [EMAIL PROTECTED];
bugtraq@securityfocus.com; [EMAIL PROTECTED];
full-disclosure@lists.netsys.com
Subject: RE: Your Opinion
I would add this angle as well Specialization.
Its the reason that Microsoft is not Spectacular
Thanx, Mark
One phrase; consider the source.
The expert participant in this interview is (catch me before I faint) -
Symantec CEO John Thompson. Symantec and other security vendors have
had more than ample opportunity to get in this game and it wasn't until
Vista hit the Beta track that
: Tuesday, January 02, 2007 10:37 AM
To: Jim Harrison
Cc: bugtraq@securityfocus.com
Subject: Re: PHP as a secure language? PHP worms? [was: Re: new linux
malware]
In some mail from Jim Harrison, sie said:
No; this wasn't flame-bait, although I'd be silly not to expect some.
Let me make my position
to
point out is the literal impossibility of actually achieving genuine
security in either our code or the languages it's written in.
-Original Message-
From: Darren Reed [mailto:[EMAIL PROTECTED]
Sent: Tuesday, January 02, 2007 2:58 AM
To: Jim Harrison
Cc: Dana Hudes; bugtraq
: Tuesday, January 02, 2007 4:02 AM
To: Jim Harrison
Cc: bugtraq@securityfocus.com
Subject: Re: PHP as a secure language? PHP worms?
Nobody has seen fit to point this out but there *are* secure languages.
In general these languages have limited feature sets or, at least in the
case of java, explicit
Peeve type=pet
They (developers) and it (the secure language) are both moving
targets.
There is no genetic memory with the human race; any more than there is
an inherently secure language. For every developer that learns how to
write secure code, at least one more starts cutting his/her teeth in
in it lacks the broad developer community
(there is one, its just small compared to the more popular languages).
Jim Harrison wrote:
Peeve type=pet
They (developers) and it (the secure language) are both moving
targets.
There is no genetic memory with the human race; any more than
30 matches
Mail list logo
