[Full-disclosure] [SECURITY] [DSA 1424-1] New iceweasel packages fix several vulnerabilities

2007-12-08 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1424-1 [EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff December 08, 2007

[Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread gmaggro
So I guess CIA - CSIS, FBI - RCMP, and NSA - CSE/GCHQ/DSD/GCSB. The last bit being the standard bunch of Echelon sons-of-bitches. Those lads must have some fat pipes. Now are they hidden, or hidden in plain sight? In any case, it is a certainty than that some law enforcement agencies are running

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread Peter Besenbruch
On Saturday 08 December 2007 05:58:51 gmaggro wrote: So I guess CIA - CSIS, FBI - RCMP, and NSA - CSE/GCHQ/DSD/GCSB. The last bit being the standard bunch of Echelon sons-of-bitches. Those lads must have some fat pipes. Now are they hidden, or hidden in plain sight? Not that fat, as Tor is

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread Fetch, Brandon
However, the key point is to understand and maintain that anonymous does not imply or beget security nor vice versa. You can use Tor to make yourself anonymous to your destinations on the Internet. However, those requests are still submitted from the exit node in their standard format (HTTP for

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread coderman
On Dec 8, 2007 9:39 AM, Peter Besenbruch [EMAIL PROTECTED] wrote: ... In fact, future designs should incorporate this infiltration into their development; there has got to be a way to use this against them. Which is what TOR has done. the decentralized design of Tor insulates one against

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread coderman
On Dec 8, 2007 2:32 PM, Fetch, Brandon [EMAIL PROTECTED] wrote: ... It's this lack of last mile security that some will suggest using an encrypted proxy but that still may not resolve the issue of the requested destination not supporting a secure connection. Public wireless anyone? None of

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread gmaggro
So I guess CIA - CSIS, FBI - RCMP, and NSA - CSE/GCHQ/DSD/GCSB. The last bit being the standard bunch of Echelon sons-of-bitches. Those lads must have some fat pipes. Now are they hidden, or hidden in plain sight? Not that fat, as Tor is usually quite slow. Well, I would assume the setup

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread coderman
On Dec 8, 2007 3:32 PM, gmaggro [EMAIL PROTECTED] wrote: ... Yes, I suppose that assertion would be better served by backing it up with some information.. http://www.freehaven.net/anonbib/ http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ Having seen good crypto ruined by lousy

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread gmaggro
Yes, I suppose that assertion would be better served by backing it up with some information.. http://www.freehaven.net/anonbib/ http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ Thank you for the information. Having seen good crypto ruined by lousy implementations, I thought it

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread jf
In any case, it is a certainty than that some law enforcement agencies are running tor nodes; it has been spotted in actual use at many such locales. Tor might a great idea but it is sadly lacking in many aspects of its implementation. It would help if you were more specific here.

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread coderman
On Dec 9, 2007 12:02 AM, jf [EMAIL PROTECTED] wrote: ... It's really quite simple. If you or I can setup a tor node and use it to mitm/pop people/etc, or use it and the various tracking methods previously shown (wasnt it hd who did the js/flash callhome stuff?) there is no if, anyone can join

Re: [Full-disclosure] Google / GMail bug, all accounts vulnerable It's just stopped working for me.

2007-12-08 Thread Ashly A K
hi! Looks like Google fixed this. It was login me off till yesterday. Brilliant idea!!! Ashly A K http://geocities.com/helponhpopenview/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread jf
there is no if, anyone can join the network and contribute, including exit traffic. a proper _implementation_ and _use_ of Tor will protect against the leakage you describe. improved scanning of the Tor network and rapid flagging of bad exits at the directories is a work in progress and

Re: [Full-disclosure] Compromise of Tor, anonymizing networks/utilities

2007-12-08 Thread coderman
On Dec 9, 2007 1:29 AM, jf [EMAIL PROTECTED] wrote: ... scanning of the Tor network and rapid flagging of bad exit... lemme know if you need ointment with that band-aid. Tor, like wireless, is susceptible to denial of service with little effort. the goal of exit scanning is not to protect

[Full-disclosure] Vista's been hacked

2007-12-08 Thread Aaron Gray
Some irritating person has changed the screen scaling on my Vista machine. Aaron ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread dripping
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 thanks for the useless mail in my inbox! Aaron Gray wrote: Some irritating person has changed the screen scaling on my Vista machine. Aaron

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread dripping
Oh, you were serious. I thought you were playing a 'joke'. Any idea of the site in question? Tell us sites you may have visited since the change. Aaron Gray wrote: I was hoping that someone would know how the hack was done. It was via IE7, I was not using any odd sites, only ps2pdf.com

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread Aaron Gray
I was hoping that someone would know how the hack was done. It was via IE7, I was not using any odd sites, only ps2pdf.com google and academic sites. It must have altered the registery, permanently altering the screen scaling. Anyone who can give me a tip on readjusting the screen scaling

Re: [Full-disclosure] pcap flow extraction

2007-12-08 Thread Richard Bejtlich
Ivan wrote: Does anyone have any ideas for flow information extraction from a rather large pcap file, 6 gigs? I am after the standard stuff, source, destination, service. Ethereal/wireshark is a no go, as it won't process the file due to size, tcpflow is OK, but a little untidy. any

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread dripping
http://msdn2.microsoft.com/en-us/library/aa965260.aspx Screen scaling/Accessibility. odd...I'll go to my vista machine and check out ps2pdf.com. Did this happen upon a reboot, or did it just do this today? Aaron Gray wrote: I was hoping that someone would know how the hack was done. It was

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread dripping
Oh wow. I didn't even read that page.. Sorry, I'll do a bit more searching :) dripping wrote: http://msdn2.microsoft.com/en-us/library/aa965260.aspx Screen scaling/Accessibility. odd...I'll go to my vista machine and check out ps2pdf.com. Did this happen upon a reboot, or did it just do

Re: [Full-disclosure] pcap flow extraction

2007-12-08 Thread reepex
lol I R cant code computer programs to parse simple formats so i beg on mailing lists to make old cissps feel elite lolololol On Dec 6, 2007 1:35 AM, Ivan . [EMAIL PROTECTED] wrote: Ethereal/wireshark is a no go, as it won't process the file due to size, tcpflow is OK, but a little untidy.

Re: [Full-disclosure] TCP Port randomization paper

2007-12-08 Thread reepex
holy shit batman! ~$ grep -i grsec draft-ietf-tsvwg-port-randomization-00.txt ~$ as stated by the last person its very strange you do not mention grsecurity in your Survey of the algorithms in use by some popular implementations Are you a developer of selinux or a close friend/relative/lover?

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread Aaron Gray
http://msdn2.microsoft.com/en-us/library/aa965260.aspx Screen scaling/Accessibility. odd...I'll go to my vista machine and check out ps2pdf.com. Did this happen upon a reboot, or did it just do this today? After some odd window behaviour just before downloading the pdf file which failed. So

Re: [Full-disclosure] (no subject)

2007-12-08 Thread reepex
I tried responding to your mail but it seems you did not get it so maybe you will on the list yes I would LOVE to your join your crew - could you please email me your silc server and bbs board details? On Dec 3, 2007 8:00 AM, Gobbles is back [EMAIL PROTECTED] wrote: Would you wish to join our

Re: [Full-disclosure] (no subject)

2007-12-08 Thread dripping
And would you like to join my new CYBERSECURITY FIRM? We post to mailing lists and advertise like we're not actually advertising for ourselves. reepex wrote: I tried responding to your mail but it seems you did not get it so maybe you will on the list yes I would LOVE to your join your crew

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread Aaron Gray
Oh wow. I didn't even read that page.. Sorry, I'll do a bit more searching :) dripping wrote: http://msdn2.microsoft.com/en-us/library/aa965260.aspx Screen scaling/Accessibility. That may well be it as it was not universal and did not effect Zeus Editors text size but does effect all

Re: [Full-disclosure] Vista's been hacked

2007-12-08 Thread Aaron Gray
I can't seem to replicate this issue at all. :| Oh well, its a good thing really ps2pdf.com okay and not good to have the same issue too. dripping wrote: http://msdn2.microsoft.com/en-us/library/aa965260.aspx Screen scaling/Accessibility. Yeah, that was no good. That may well be it as

Re: [Full-disclosure] (no subject)

2007-12-08 Thread reepex
only simon from snosoft and people from netragard try to hire people from FD ;) apparently they are not too satisfied with their current employees' skills On Dec 9, 2007 12:04 AM, dripping [EMAIL PROTECTED] wrote: And would you like to join my new CYBERSECURITY FIRM? We post to mailing lists