[Full-disclosure] [SECURITY] [DSA 2313-1] iceweasel security update

2011-09-29 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2313-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff September 29, 2011

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Valdis . Kletnieks
On Thu, 29 Sep 2011 14:25:42 BST, Darren Martyn said: > Even Russian "bulletproof" hosts can screw you over. Yes, but there's a limit to how many times the guys running those hosts can sell you out to LEO's before the news gets around and they find themselves out of the "bulletproof" business.

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Georgi Guninski
On Thu, Sep 29, 2011 at 02:09:29PM +0100, Benji wrote: > > Honestly, by now you would think people would know: do everything yourself, > trust no-one. i second that. there is an old meme about it. -- joro ___ Full-Disclosure - We believe in it. Char

[Full-disclosure] [SECURITY] [DSA 2312-1] iceape security update

2011-09-29 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2312-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff September 29, 2011

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Benji
No, you are wrong. Either; the vpn provider complied with court order, or they face the legal ramifications of not doing so. User location is irrelevant. On Thu, Sep 29, 2011 at 2:04 PM, xD 0x41 wrote: > indeed :) > but, it is how a proper anon person would operate, well, tht is how i once > di

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Darren Martyn
Even Russian "bulletproof" hosts can screw you over. Heihachi were committing massive fraud, and another hosting provider (offering hosting for botnets) was simply stealing your bots all the time, according to what I am told. If one is dealing with criminals/crooks to further ones own criminal ent

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Laurelai
On 9/29/2011 3:51 AM, Darren Martyn wrote: > Again, I hope this does not fail to send. > The reasoning behind the "Pure Elite" recruitment channel was A: to > recruit some talented people (and, by all accounts, there were some > talented programmers there) and B: development and idle talk. Now more

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread James Condron
On 29 Sep 2011, at 14:04, valdis.kletni...@vt.edu wrote: > On Thu, 29 Sep 2011 13:53:03 BST, Benji said: > >> Just because something is advertised as 'anonymous' doesnt mean it's 'so >> anonymous you can break the law' and anyone using a EU/US-related country to >> do this is either stupid or na

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Benji
And in that case, if you're trusting someone else to keep you anonymous, again, you are stupid and naive. Honestly, by now you would think people would know: do everything yourself, trust no-one. On Thu, Sep 29, 2011 at 2:04 PM, wrote: > On Thu, 29 Sep 2011 13:53:03 BST, Benji said: > > > Just

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Valdis . Kletnieks
On Thu, 29 Sep 2011 13:53:03 BST, Benji said: > Just because something is advertised as 'anonymous' doesnt mean it's 'so > anonymous you can break the law' and anyone using a EU/US-related country to > do this is either stupid or naive. There's also those servers that advertise "anonymous and lik

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Benji
'Abuse' emails and court orders are very different. On Thu, Sep 29, 2011 at 1:59 PM, xD 0x41 wrote: > err, you are limited in those countries dude... id really checkup on that > ... maybe some but, yea i agree, i dont think any hosting is anon, but, i > sure know i have kept an anon dedis in pas

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Benji
Yes they do. If you buy a server in America for example, even if you are located in Russia, they are required by federal law to hand over your details wherever you may reside. I dont know where you've obtained this idea that they can't. Just because something is advertised as 'anonymous' doesnt me

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Benji
Im sorry, why is it 'worrying' that a vpn provider that was a UK business and was located in the UK, is subject to UK law? On Thu, Sep 29, 2011 at 9:51 AM, Darren Martyn < d.martyn.fulldisclos...@gmail.com> wrote: > Again, I hope this does not fail to send. > The reasoning behind the "Pure Elit

[Full-disclosure] GSC Voice Server Denial of Service Vulnerability

2011-09-29 Thread Michael J. Gray
Product: GSC (Game Servers Client) Version: 2.00 Build 3017 Website: http://getgsc.com By inspecting the network traffic of messages to voice servers one can see that ASCII strings are prefixed with their length as a 32-bit signed integer. Simply modifying this to any length in excess of the

[Full-disclosure] GSC Chat Server Authentication Bypass

2011-09-29 Thread Michael J. Gray
Product: GSC (Game Servers Client) Version: 2.00 Build 3017 Website: http://getgsc.com By sniffing the traffic of the chat client one can easily discern that it uses IRC to back its private messaging system. From there, you can simply issue commands such as NICK and switch your nickname to an

Re: [Full-disclosure] Facebook North Scottsdale Inventory - Remote SQL Injection Vulnerability

2011-09-29 Thread resea...@vulnerability-lab.com
Am 29.09.2011 11:50, schrieb Ferenc Kovacs: > "2011-00-00: Vendor Fix/Patch" It is a third party application of facebook. Facebook security has no influence & can just report the bug to the developers of the applications. The vulnerability has been reported about 2 weeks ago to the develope

Re: [Full-disclosure] Facebook North Scottsdale Inventory - Remote SQL Injection Vulnerability

2011-09-29 Thread Ferenc Kovacs
"2011-00-00: Vendor Fix/Patch" On Thu, Sep 29, 2011 at 11:34 AM, resea...@vulnerability-lab.com wrote: > Title: > == > Facebook North Scottsdale Inventory - Remote SQL Injection Vulnerability > > > Date: > = > 2011-09-29 > > > References: > === > http://www.vulnerability-lab.c

[Full-disclosure] Facebook North Scottsdale Inventory - Remote SQL Injection Vulnerability

2011-09-29 Thread resea...@vulnerability-lab.com
Title: == Facebook North Scottsdale Inventory - Remote SQL Injection Vulnerability Date: = 2011-09-29 References: === http://www.vulnerability-lab.com/get_content.php?id=272 VL-ID: = 272 Introduction: = The application is currently included and viewable by al

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

2011-09-29 Thread Darren Martyn
Again, I hope this does not fail to send. The reasoning behind the "Pure Elite" recruitment channel was A: to recruit some talented people (and, by all accounts, there were some talented programmers there) and B: development and idle talk. Now more interesting was the reasoning behind the name - by