Re: [Full-disclosure] 0day offer

2008-07-30 Thread Jeffrey Starck
Well, this is not because you are not skilled for coding exploit that peoples who do that are lame. Big majority of posts here are useless, so I take advantage of it to post a personnal message, that's all. You are not interested ? OK. Good bye. 2008/7/29, Charles Majola [EMAIL PROTECTED]:

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread lsi
Thank you all for your comments. However, I cannot disagree more fully. It doesn't matter that the blacklist is not complete, if a scammer tries to phish a bank that's not on the list, eg. is not popular, he won't make much money, because it's a small bank and the probability of him hitting

Re: [Full-disclosure] ladies

2008-07-30 Thread Charles Majola
You have to be the major of dorkville. While you ware writing that, I was playing soccer against a team from another town This reply is late becouse we went down to the lakehouse for a few days... Yeah, I'm... a... dork... Who is more retarted? On Thu, Jul 24, 2008 at 12:51 PM, Professor

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Nick FitzGerald
lsi wrote: Thank you all for your comments. However, I cannot disagree more fully. Ignorance does that for people... It doesn't matter that the blacklist is not complete, if a scammer tries to phish a bank that's not on the list, eg. is not popular, he won't make much money, because

[Full-disclosure] Cisco IOS shellcode explanation

2008-07-30 Thread Andy Davis
Hi, Lots of people have been asking for details about the slightly unorthodox shellcode I used within the IOS FTP exploit, so here goes: .equ vty_info, 0x8182da60 //contains a pointer to the VTY info structure .equ terminate, 0x80e4086c lis 4,[EMAIL PROTECTED] la 4,[EMAIL

[Full-disclosure] Advisories

2008-07-30 Thread advisories
Hello Please find attached advisories to be published. Kind Regards Advisories Portcullis Computer Security Ltd ### This email originates from the systems of Portcullis Computer Security Limited, a Private limited company,

[Full-disclosure] Fwd: 'World's most dangerous hacker' to be extradited to US

2008-07-30 Thread n3td3v
-- Forwarded message -- From: newsgroup [EMAIL PROTECTED] Date: Wed, Jul 30, 2008 at 12:43 PM Subject: 'World's most dangerous hacker' to be extradited to US To: [EMAIL PROTECTED] A British man who hacked into computers at the Pentagon will face trial in the US after the law

[Full-disclosure] Fwd: Are Bug Disclosures Helping or Hurting?

2008-07-30 Thread n3td3v
-- Forwarded message -- From: n3td3v [EMAIL PROTECTED] Date: Wed, Jul 30, 2008 at 2:40 PM Subject: Are Bug Disclosures Helping or Hurting? To: n3td3v [EMAIL PROTECTED] IBM report shows that as soon as a vulnerability is disclosed, an exploit is made for it. Some think it's time

[Full-disclosure] Tool: PorkBind Nameserver Security Scanner

2008-07-30 Thread super
In light of the new DNS cache poisoning issue and now that everyone has had plenty of time to apply patches, I've decided to release a new version of my nameserver security scanner called porkbind. It is a multi-threaded nameserver scanner that can recursively query nameservers of subdomains

[Full-disclosure] Recall: simple phishing fix

2008-07-30 Thread Glenn.Everhart
The sender would like to recall the message, [Full-disclosure] simple phishing fix. - This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Robert Holgstad
I think you are the new greatest troll of FD On Wed, Jul 30, 2008 at 3:14 AM, lsi [EMAIL PROTECTED] wrote: Thank you all for your comments. However, I cannot disagree more fully. It doesn't matter that the blacklist is not complete, if a scammer tries to phish a bank that's not on the

Re: [Full-disclosure] DNS spoofing issue. Thoughts on

2008-07-30 Thread Valdis . Kletnieks
On Sun, 27 Jul 2008 14:07:03 EDT, [EMAIL PROTECTED] said: The need for something more like ssl certs in there remains It's called DNSSEC, which has been out for a decade and more. (Also needed for bgp I suspect). RFC2385 (TCP MD5 protection for BGP) addresses most of the issues, at least on a

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread blah
On Wed, Jul 30, 2008 at 1:14 AM, lsi [EMAIL PROTECTED] wrote: Thank you all for your comments. However, I cannot disagree more fully. The simple fact that you said, put all banks on the list except the one you actually use, really demonstrates how poorly some of this has been thought out.

Re: [Full-disclosure] Recall: simple phishing fix

2008-07-30 Thread Aaron Turner
On Wed, Jul 30, 2008 at 7:29 AM, [EMAIL PROTECTED] wrote: The sender would like to recall the message, [Full-disclosure] simple phishing fix. You mean this email? Seriously, people need to learn that the that the recall feature in Exchange doesn't work. I don't read every email in my inbox,

[Full-disclosure] Cisco IOS shellcode explanation - additional

2008-07-30 Thread Andy Davis
Anyone spot the typo? It's also in a comment in the exploit source, but doesn't affect how the code works: addi7,7,233 should read addi7,7,2330 The first offset (requirement to authenticate) is at 0x174 and the second (privilege level) is at 0xde4 Its worth noting that at some stage

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Peter Besenbruch
On Tuesday 29 July 2008 23:27:45 Nick FitzGerald wrote: You really have no f*ing clue how ordinary users' tiny little brains work, have you??? I got an inkling when a phishing spam asked me for the usual information, and also requested my future password. -- Hawaiian Astronomical Society:

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Exibar
No time to comment on most, but just to throw this in there: Here in the states we have a few hundred thousand different banks at least. 500 is WAY too small of a number. Credit Unions are banks, small banks, and almost every city has at least one credit union. The city I grew up in has

Re: [Full-disclosure] Advisories

2008-07-30 Thread Robert Holgstad
sweet 12 advisories in software no one uses On Wed, Jul 30, 2008 at 1:58 AM, advisories [EMAIL PROTECTED] wrote: Hello Please find attached advisories to be published. Kind Regards Advisories Portcullis Computer Security Ltd -- This email originates

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Dragos Ruiu
On 30-Jul-08, at 9:19 AM, Exibar wrote: No time to comment on most, but just to throw this in there: Here in the states we have a few hundred thousand different banks at least. 500 is WAY too small of a number. Credit Unions are banks, small banks, and almost every city has at least

[Full-disclosure] [ MDVSA-2008:158 ] silc-toolkit

2008-07-30 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:158 http://www.mandriva.com/security/

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Exibar
There are quite a few credit unions and smaller savings institutions that are not FDIC insured. Not to mention all the FDIC insured savings institutions that are worth less than $100 million Exibar - Original Message - From: Dragos Ruiu To: Exibar Cc: [EMAIL

Re: [Full-disclosure] Tool: PorkBind Nameserver Security Scanner

2008-07-30 Thread Arturo 'Buanzo' Busleiman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 [EMAIL PROTECTED] wrote: | http://innu.org/~super/porkbind-1.2.tar.gz It's http://innu.org/~super/tools/porkbind-1.2.tar.gz - -- Arturo Buanzo Busleiman Independent Linux and Security Consultant - SANS - OISSG - OWASP

Re: [Full-disclosure] Fwd: Are Bug Disclosures Helping or Hurting?

2008-07-30 Thread n3td3v
On Thu, Jul 31, 2008 at 5:05 AM, jf [EMAIL PROTECTED] wrote: holly is not a researcher, iss puts everything under the x-force name, they have a threat intelligence section which is mostly chicks spewing crap about such things, i worked there and i have no idea where their metrics came from.

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Dragos Ruiu
nowhere near a few hundred thousand On 30-Jul-08, at 12:29 PM, Exibar wrote: There are quite a few credit unions and smaller savings institutions that are not FDIC insured. Not to mention all the FDIC insured savings institutions that are worth less than $100 million Exibar -

[Full-disclosure] [ MDVSA-2008:159 ] licq

2008-07-30 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:159 http://www.mandriva.com/security/

Re: [Full-disclosure] [inbox] Re: simple phishing fix

2008-07-30 Thread Exibar
does it really matter? It's certainly not 500. BTW, just credit unions in the states amount to 8,130 We'll let the original poster worry about keeping his black list or whitelist up to date, while the rest of us go on with our lives Exibar _ From: Dragos Ruiu [mailto:[EMAIL

Re: [Full-disclosure] simple phishing fix

2008-07-30 Thread Raj Mathur
On Sunday 27 Jul 2008, lsi wrote: Soo y'all know not to click on those emails from your bank, or from any other bank, in your inbox and now you just delete them ... why not automate this process? It's easy, just filter a whole bunch of banking names straight to your deleted items. All you