Re: [Full-disclosure] Honeypots

2006-09-16 Thread Blue Boar
[EMAIL PROTECTED] wrote: > Thanks for the responses. I'm more interested in capturing, > analyzing, and collecting as many types as malware as I can, so that > I may create a database for my friends and others to use. If there's > one that I should use speficially for that, please let me know. Che

Re: [Full-disclosure] Honeypots

2006-09-16 Thread Toby McKay
nepenthes or mwpcollect would work. Also, there is wormradar. ./mcktobyOn 9/17/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: Thanks for the responses. I'm more interested in capturing, analyzing, and collecting as many types as malware as I can, so that I may create a database for my friends an

Re: [Full-disclosure] Honeypots

2006-09-16 Thread Jason Miller
Thanks, I think I may try out nepenthes, it seems to have caught my attention. :POn 9/16/06, Blue Boar <[EMAIL PROTECTED] > wrote:[EMAIL PROTECTED] wrote: > Thanks for the responses. I'm more interested in capturing,> analyzing, and collecting as many types as malware as I can, so that> I may creat

Re: [Full-disclosure] Honeypots

2006-09-16 Thread jammer128
Thanks for the responses. I'm more interested in capturing, analyzing, and collecting as many types as malware as I can, so that I may create a database for my friends and others to use. If there's one that I should use speficially for that, please let me know. Sent from my BlackBerry® wireless

Re: [Full-disclosure] 0day IE6? ActiveX COM

2006-09-16 Thread Dude VanWinkle
If history truely repeats itself, I expect we will see these after every patch tuesday for sometime to come. -JP On 9/15/06, Juha-Matti Laurio <[EMAIL PROTECTED]> wrote: > SANS ISC: > http://isc.sans.org/diary.php?storyid=1701 > > MS Security Advisory #925444: > http://www.microsoft.com/technet/s

Re: [Full-disclosure] AFS - The Ultimate Sulution? -- What is the point?

2006-09-16 Thread Dude VanWinkle
why not just use a dumb terminal if you are going to go to all that trouble? -JP On 9/15/06, Dean Pierce <[EMAIL PROTECTED]> wrote: > There is the convenience issue of the speed that the image transfers > across the network. > > There is also the issue that infected workstations may be collecting

Re: [Full-disclosure] Honeypots

2006-09-16 Thread Renaud Leroy
Hi, I tried nepenthes to catch malware. cf: http://nepenthes.mwcollect.org/ Nepenthes - finest collection - Welcome to the official nepenthes website! Nepenthes is a versatile tool to collect malware. It acts passively by emulating known vulnerabilities and downloading malware trying to exploi

Re: [Full-disclosure] Backdooring PDF Files

2006-09-16 Thread Bipin Gautam
Looks to me like its a flaw in the PLUG-IN not the Acrobat Reader itself. Here plugin should be disabled for the "URI" action. Go to your folder .ProgramFileDir\Adobe\Acrobat ver\Reader\plug_ins\ & only leave the PLUGINS that are ONLY FREQUENTLY USED BY U (or requests a program action within

Re: [Full-disclosure] Honeypots

2006-09-16 Thread Joshua D. Abraham
I setup this up on a ubuntu server. Here are my docs: http://www.ccs.neu.edu/home/jabra/howto/honeyd.html It includes building from source or installing with apt-get. Regards, Josh On 16.Sep.2006 11:03PM +, [EMAIL PROTECTED] wrote: > Getting more interested in honeypots latey, any info a

[Full-disclosure] Honeypots

2006-09-16 Thread jammer128
Getting more interested in honeypots latey, any info and a honeypot of choice, preferrably linux & feature packed, would appreciated. :D Sent from my BlackBerry® wireless handheld ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.u

[Full-disclosure] [SECURITY] [DSA 1178-1] New freetype packages fix execution of arbitrary code

2006-09-16 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1178-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff September 16th, 2006

[Full-disclosure] [FON (fon.com)] serious security problem: sniff anyone's login

2006-09-16 Thread F. Kriewitz
http://fon.freddy.eu.org/pcap-decoder/howto/Please distribute, seems like it's the only way to make FON work on that. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia