Re: [Full-disclosure] sans handler gives out n3td3v e-mail to public

2008-03-29 Thread Ureleet
if it's an internal investigation, why would he tell you? from what i read sfirefinch did apologize -- not that they needed to. stop trolling ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted

Re: [Full-disclosure] What's going on about Pangolin

2008-03-29 Thread poo
its funny how all the people refuting the backdoor claim write the same horrible english On Fri, Mar 28, 2008 at 9:50 AM, xor_ <[EMAIL PROTECTED]> wrote: > I've used this software for serveral months. Impersonality, i don't think > there is any maliceous code in it. > > btw, do you think there is

Re: [Full-disclosure] the hysteria on pangolin.exe

2008-03-29 Thread poo
eeerhm both says its a trojan.. On Thu, Mar 27, 2008 at 4:06 PM, LIUDIEYU dot COM <[EMAIL PROTECTED]> wrote: > unpack it with upx and all the false positives are gone, exactly as > zwell noted. antivirus is never accurate. > > > 6326120a66269f8f42aa91b76c8c237c pangolin.exe > dea13ad95c43c04165ac

[Full-disclosure] [SECURITY] [DSA 1531-2] New policyd-weight packages fix insecure temporary files

2008-03-29 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1531-2 [EMAIL PROTECTED] http://www.debian.org/security/ Thijs Kinkhorst March 29, 2008

[Full-disclosure] Immunity Debugger v1.5

2008-03-29 Thread Nicolas Waisman
Immunity team is proud to present: Immunity Debugger 1.5 This new Immunity Debugger release provides a lot of new scripts and important fixes. New scripts to improve your debugging experience include: gflags, hookssl, and hookndr. The API has been reinforced with new functionality which allows yo

Re: [Full-disclosure] sans handler gives out n3td3v e-mail to public

2008-03-29 Thread n3td3v
On Sun, Mar 23, 2008 at 10:44 AM, <[EMAIL PROTECTED]> wrote: > I think this the most worst and alarming situation ..where SANS like > organization is doing the way.. from onwards no body will report > info to SANS... E+1 t+1 b+1 j+1 it OFF!!! SANS hasn't admitted a breach occured

Re: [Full-disclosure] Fwd: What's going on about Pangolin

2008-03-29 Thread josh
Its pretty obvious if you unpack it and it comes off clean. UPX always sets off alerts with the majority of AVs. Sent from my BlackBerry® smartphone with SprintSpeed -Original Message- From: Tim Kunschke <[EMAIL PROTECTED]> Date: Sat, 29 Mar 2008 14:27:17 To:"zwell.nosec" <[EMAIL PROTEC

Re: [Full-disclosure] Fwd: What's going on about Pangolin

2008-03-29 Thread Tremaine Lea
It's more of an academic point than anything. Large companies and widely recognizable names that have established reputations are more likely to be taken at their word when they indicate an app they've put out is a false positive. Individuals don't get the same level of social credit, and are m

Re: [Full-disclosure] Fwd: What's going on about Pangolin

2008-03-29 Thread Tim Kunschke
I have also tested, and with the UPX packer unpacked. Nothing. Nothing dangerous. ;) --- C:\>C:\upx302w\upx.exe -d C:\pangolin_bin\out\pangolin.exe Ultimate Packer for eXecutables Copy

Re: [Full-disclosure] Fwd: What's going on about Pangolin

2008-03-29 Thread zwell.nosec
Hi, everyone: A friend told me that modify offset at 0x000D6BDF from 0x00 to 0xff, then the world will be quiet. ; ) _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nemes Sent: Saturday, March 29, 2008 1:18 AM To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosu