[Full-disclosure] Virus writers exchanging information

2005-03-17 Thread Raoul Nakhmanson-Kulish
Hello all! An interesting article from Kaspersky Lab site. blockquote cite=http://www.kaspersky.com/news?id=160377972; Virus analysts at Kaspersky Lab have been investigating the recent Bagle outbreak, and come to the conclusion that the authors of Bagle, Zafi and Netsky are working hand in hand

Re: [Full-disclosure] Wi-fi. Approaching customers

2005-03-17 Thread D B
Date: Wed, 16 Mar 2005 17:29:53 + From: Konstantin V. Gavrilenko [EMAIL PROTECTED] Subject: Re: [Full-disclosure] Wi-fi. Approaching customers To: Ryan Sumida [EMAIL PROTECTED], full-disclosure@lists.grok.org.uk Message-ID: [EMAIL PROTECTED] Content-Type: text/plain;

Re: [Full-disclosure] Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning

2005-03-17 Thread Tomasz Papszun
On Tue, 15 Mar 2005 at 22:07:06 -0300, Rodrigo Barbosa wrote: On Tue, Mar 15, 2005 at 09:06:05PM +, Nigel Horne wrote: # unzip -l mixed-eicar.zip Archive: mixed-eicar.zip Length Date TimeName 308 03-10-05 12:00

[Full-disclosure] Windows rootkit author interview - with title in poor taste

2005-03-17 Thread Feher Tamas
http://www.infoworld.com/article/05/03/16/HNholyfather_1.html Holy Father on rootkit writing for fun, profit by Paul Roberts, IDG News Service, 16 Mar 2005 Rootkit author discusses efforts to highlight weaknesses in software security The software developer behind a leading rootkit program says

[Full-disclosure] A phpBB hacker tool called nigga.

2005-03-17 Thread Feher Tamas
Hello, Have you heard of a tool named nigga which hacks phpBB forums? What effects does it have on the compromised system? is it a serious break-in or just an automated something? http://url.was.here/forum/viewtopic.php?t=number_was_here phpBB : Critical Error Could not open

[Full-disclosure] Hacker attack at Sumitomo UK bank fails to fetch 423mio USD

2005-03-17 Thread Feher Tamas
http://news.bbc.co.uk/1/hi/uk/4356661.stm London police foil huge on-line bank raid by BBC News, 17 Mar 2005 Police in London say they have foiled one of the biggest attempted bank thefts in Britain. The plan was to steal #163;220m ($423m) from the London offices of the Japanese bank Sumitomo

Re: [Full-disclosure] A phpBB hacker tool called nigga.

2005-03-17 Thread ElviS .de
http://www.k-otik.com/exploits/20050314.phpbbexp.cpp.phpFeher Tamas [EMAIL PROTECTED] wrote: Hello,Have you heard of a tool named "nigga" which hacks phpBBforums? What effects does it have on the compromised system?is it a serious break-in or just an automated

[Full-disclosure] [USN-98-1] OpenSLP vulnerabilities

2005-03-17 Thread Martin Pitt
=== Ubuntu Security Notice USN-98-1 March 17, 2005 openslp vulnerabilities http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032534.html === A security issue

[Full-disclosure] Microsoft GhostBuster Opionions

2005-03-17 Thread Dave King
Several months ago I came upon a research project some people at Microsoft had been working on called Strider GhostBuster to help find rootkits. The original paper can be found here http://research.microsoft.com/research/pubs/view.aspx?type=Technical%20Reportid=775 . Basically what it

[Full-disclosure] LDAP username special char Problem

2005-03-17 Thread Jellbauer Jakob
Hi, today i followed this scenario: a user tried to connect to Windows 2000 ActiveDirectory trough LDAP, and misspelled the loginname like : usérname or usêrname (with special char like ` or ^ or ´ ) and is succesfully connected ! is this a known feature or problem ? i reproduced it

Re: [Full-disclosure] Microsoft GhostBuster Opionions

2005-03-17 Thread Valdis . Kletnieks
On Thu, 17 Mar 2005 11:28:55 MST, Dave King said: Also, this is not just like tripwire. If the kernel is compromised and reporting false data to tripwire then tripwire can run along merrily thinking every thing's great. This is why booting to a trusted kernel is important for the

Re: [Full-disclosure] Microsoft GhostBuster Opionions

2005-03-17 Thread bkfsec
[EMAIL PROTECTED] wrote: On Thu, 17 Mar 2005 11:28:55 MST, Dave King said: Also, this is not just like tripwire. If the kernel is compromised and reporting false data to tripwire then tripwire can run along merrily thinking every thing's great. This is why booting to a trusted kernel is

[Full-disclosure] LLSSRV Redux Excitement

2005-03-17 Thread Dave Aitel
With regards to the LLSSRV advisory Immunity published yesterday, we would like to issue a clarification. There are two ways to get SP4 onto a Windows 2000 Advanced Server machine, as follows: 1. Download SP4 from microsoft.com via networked or express install 2. Obtain and install a Windows

Re: [Full-disclosure] Microsoft GhostBuster Opinions

2005-03-17 Thread Dave King
[EMAIL PROTECTED] wrote: On Thu, 17 Mar 2005 11:28:55 MST, Dave King said: Also, this is not just like tripwire. If the kernel is compromised and reporting false data to tripwire then tripwire can run along merrily thinking every thing's great. This is why booting to a trusted kernel is

Re: [Full-disclosure] Microsoft GhostBuster Opionions

2005-03-17 Thread Dave King
bkfsec wrote: [EMAIL PROTECTED] wrote: On Thu, 17 Mar 2005 11:28:55 MST, Dave King said: Also, this is not just like tripwire. If the kernel is compromised and reporting false data to tripwire then tripwire can run along merrily thinking every thing's great. This is why booting to a

Re: [Full-disclosure] new BIG vulnerability in libc found!!!!!

2005-03-17 Thread cyberpixl
is this a joke? =P On Wed, 09 Mar 2005 15:09:36 -0500, Lennart Hansen [EMAIL PROTECTED] wrote: ** *strcpy is vulnerable* *by * *MEAT-EATER SECURITY * * a subdivision of UNIFIX security * *

Re: [Full-disclosure] new BIG vulnerability in libc found!!!!!

2005-03-17 Thread VeNoMouS
well DUH - Original Message - From: cyberpixl [EMAIL PROTECTED] To: Lennart Hansen [EMAIL PROTECTED] Cc: full-disclosure@lists.grok.org.uk Sent: Friday, March 18, 2005 12:27 PM Subject: Re: [Full-disclosure] new BIG vulnerability in libc found! is this a joke? =P On Wed, 09 Mar 2005

Re: [Full-disclosure] Microsoft GhostBuster Opinions

2005-03-17 Thread Ron DuFresne
On Thu, 17 Mar 2005, Dave King wrote: [EMAIL PROTECTED] wrote: On Thu, 17 Mar 2005 11:28:55 MST, Dave King said: Also, this is not just like tripwire. If the kernel is compromised and reporting false data to tripwire then tripwire can run along merrily thinking every thing's

[Full-disclosure] Social Engineering: You Have Been A Victim

2005-03-17 Thread Paul Laudanski
by Darren W. Miller, aka defendingthenet, CastleCops Staff Writer March 14, 2005 Monday morning, 6am; the electric rooster is telling you it's time to start a new work week. A shower, some coffee, and you're in the car and off. On the way to work you're thinking of all you need to

Re: [Full-disclosure] Microsoft GhostBuster Opinions

2005-03-17 Thread Jeremy Bishop
On Thursday 17 March 2005 17:58, Ron DuFresne wrote: If the kernel is modified, on a windows or *nix system, you are going to have a clear clue upfront; the system will have rebooted. From way back in '98, a paper on patching a (running) kernel on a linux system.