Re: [Full-disclosure] Comments on: Browser patches yearn to be free

2008-10-02 Thread Robert Brockway
On Sat, 27 Sep 2008, n3td3v wrote: > Also, third party patches are the most danergous patches, so its > better to know when the genuine patch is coming out. Using the release date of a patch to verify the legitimacy of a patch is a bad idea. It is too easily exploitable. How about: #1) Decide

[Full-disclosure] [USN-650-1] cpio vulnerability

2008-10-02 Thread Jamie Strandboge
=== Ubuntu Security Notice USN-650-1 October 02, 2008 cpio vulnerability CVE-2007-4476 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04

[Full-disclosure] Vulnerability: Web Coat K9 Web Protection 3.0.27

2008-10-02 Thread jose achada
Blue Coat K9 Web Protection Vulnerability Set 26, 2008 -- Affected Vendors: Blue Coat -- Affected Products: K9 Web Protection -- Vulnerability Details: This vulnerability allow a local users to modify the program to react diferently. Several actions can be done such as integrating a keylogger to

Re: [Full-disclosure] Comments on: Senate bill sets guidelines for cybersecurity center

2008-10-02 Thread n3td3v
Marcus Sachs has the same mentally that took us on a false pretence into Iraq with the 45 minute WMD claim, only this time its cyber security, but there is little difference in what he's doing and what was happening on the lead up to Iraq war part 2. Maybe Marcus Sachs is going to write a "dodgy

Re: [Full-disclosure] low bandwidth DoS attack against TCP/IP stack

2008-10-02 Thread Jorrit Kronjee
[EMAIL PROTECTED] wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > >> There's been some buzz about a new bug within the TCP/IP-protocol. >> According to the people who discovered it, it affects some if not >> all >> OSes. They explain it a little bit in an interview (URL below) >> wit

Re: [Full-disclosure] Comments on: Senate bill sets guidelines for cybersecurity center

2008-10-02 Thread James Matthews
I like the way you link to the wikipedia version of false. On Thu, Oct 2, 2008 at 7:56 AM, n3td3v <[EMAIL PROTECTED]> wrote: > $30 million to protect themselves against a script kid who enters > their systems with blank passwords!!! ha ha ha. Gary Mckinnon is the > nearest they've got to an *alle

Re: [Full-disclosure] Hotel Network Security: A Study of Computer Networks in U.S. Hotels

2008-10-02 Thread James Matthews
Every time i go stay at a hotel i test the security. Most of the time it sucks! I like what the hotel in Dallas is doing but how many times am i in Dallas? I just use a mobile 3g card. On Thu, Oct 2, 2008 at 9:29 AM, Josh Ogle <[EMAIL PROTECTED]> wrote: > I agree with you that if employees (of no

Re: [Full-disclosure] Hotel Network Security: A Study of Computer Networks in U.S. Hotels

2008-10-02 Thread Josh Ogle
I agree with you that if employees (of non-hotels, I believe you mean) were instructed as to the best, safest ways to take care of their own privacy while on the road traveling, this would be a non-issue. However, it's far more difficult to get every single company in the world with a traveling

Re: [Full-disclosure] Hotel Network Security: A Study of Computer Networks in U.S. Hotels

2008-10-02 Thread J. Oquendo
On Thu, 02 Oct 2008, Josh Ogle wrote: > the technology exists to increase a hotel network?s security, a hotel > could potentially be considered at fault for not taking the necessary > precautions to protect their guests from hackers. FYI, just because the technology exists does not mean hotelie

[Full-disclosure] Hotel Network Security: A Study of Computer Networks in U.S. Hotels

2008-10-02 Thread Josh Ogle
Hey guys, I recently completed a research paper through Cornell concerning the security of hotel computer networks across the US. I cite this mailing list in it. If you all have any criticism or input (or an open position at your workplace? I'm a jobless new graduate!), I'd love to be in co

Re: [Full-disclosure] low bandwidth DoS attack against TCP/IP stack

2008-10-02 Thread redb0ne
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 >There's been some buzz about a new bug within the TCP/IP-protocol. >According to the people who discovered it, it affects some if not >all >OSes. They explain it a little bit in an interview (URL below) >without >telling any details. Fyodor released

Re: [Full-disclosure] Comments on: Senate bill sets guidelines for cybersecurity center

2008-10-02 Thread n3td3v
$30 million to protect themselves against a script kid who enters their systems with blank passwords!!! ha ha ha. Gary Mckinnon is the nearest they've got to an *alleged* cyber terrorist. Marcus Sachs and his satellite communications outage claim and bgp disruption , bull shit propaganda, scare-mon

[Full-disclosure] Layered Defense Research Advisory: Juniper Netscreen Firewall Cross-Site-Scripting (XSS) event log injection

2008-10-02 Thread Deral Heiland
== Layered Defense Research Advisory 1 October 2008 == 1) Affected Product Juniper Netscreen Firewall ScreenOS version 5.4.0r9.0 == 2) Severity Rating: Low

[Full-disclosure] low bandwidth DoS attack against TCP/IP stack

2008-10-02 Thread Jorrit Kronjee
Hey all, There's been some buzz about a new bug within the TCP/IP-protocol. According to the people who discovered it, it affects some if not all OSes. They explain it a little bit in an interview (URL below) without telling any details. http://debeveiligingsupdate.nl/2008/09/30/de-beveiligingsup

Re: [Full-disclosure] Paul Asadoorian of PaulDotCom Enterprises / Podcast is ridiculous

2008-10-02 Thread Michael Boman
On Wed, Oct 1, 2008 at 10:29 PM, <[EMAIL PROTECTED]> wrote: > The third thing to keep in mind is that "bleeding edge" doesn't always (and > in fact rarely, if ever) correspond to what's out in the real world. OK, so > you're peeved because the guy talked about WRT54G and didn't cover Kamikazi. So