Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

2013-06-17 Thread Jeffrey Walton
On Mon, Jun 17, 2013 at 9:32 AM, Patrick Dunstan wrote: > Completely agree with your sentiments here, Valdis. > > The error messages given to everyday users are completely ridiculous in most > cases. I feel though with the padlocks and green bars in browsers nowadays, > there has at least been som

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

2013-06-17 Thread Patrick Dunstan
Completely agree with your sentiments here, Valdis. The error messages given to everyday users are completely ridiculous in most cases. I feel though with the padlocks and green bars in browsers nowadays, there has at least been some effort made to make security understandable for the average user

Re: [Full-disclosure] Apple and Wifi Hotspot Credentials Management Vulnerability

2013-06-17 Thread Jeffrey Walton
On Mon, Jun 17, 2013 at 3:35 PM, Jeffrey Walton wrote: > > ... > It appears Apple Wifi hotspot passwords are generated using a wordlist > consisting of 1842 words. The authors built a customer cracker to aide > in recovery of the Wifi hotspot passwords. My bad. The application estimates the time t

[Full-disclosure] Apple and Wifi Hotspot Credentials Management Vulnerability

2013-06-17 Thread Jeffrey Walton
This vulnerability was published to the OWASP Mobile Security list as a research paper by Andreas Kurtz, Daniel Metz and Felix Freiling. See "Cracking iOS personal hotspots using a Scrabble crossword game word list," http://lists.owasp.org/pipermail/owasp-mobile-security-project/2013-June/000640.h

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIMELossof Integrity

2013-06-17 Thread Jeffrey Walton
On Mon, Jun 17, 2013 at 2:49 PM, Daniël W. Crompton < daniel.cromp...@gmail.com> wrote: > > how would that work? AKAIK S/MIME is public key cryptography, how would > you decrypt a message which is not encrypted with your public key? > Exactly. How does one decrypt when they don't hold the private

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIMELossof Integrity

2013-06-17 Thread Daniël W . Crompton
Jeff, how would that work? AKAIK S/MIME is public key cryptography, how would you decrypt a message which is not encrypted with your public key? D. On 17 June 2013 20:17, Jeffrey Walton wrote: > On Mon, Jun 17, 2013 at 11:19 AM, ACROS Security Lists > wrote: > > Valdis, > > > >> No, that's

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIMELossof Integrity

2013-06-17 Thread Jeffrey Walton
On Mon, Jun 17, 2013 at 11:19 AM, ACROS Security Lists wrote: > Valdis, > >> No, that's how to do it *hardline*. There's many in the >> security industry that will explain to you that it's also >> doing it *wrong*. Hint - the first time that HR sends out a >> posting about a 3-day window next we

[Full-disclosure] [SECURITY] [DSA 2709-1] wireshark security update

2013-06-17 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2709-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff June 17, 2013

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIMELossof Integrity

2013-06-17 Thread ACROS Security Lists
Valdis, > No, that's how to do it *hardline*. There's many in the > security industry that will explain to you that it's also > doing it *wrong*. Hint - the first time that HR sends out a > posting about a 3-day window next week to change your > insurance plan without penalty, signs it with

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Lossof Integrity

2013-06-17 Thread Valdis . Kletnieks
On Mon, 17 Jun 2013 15:51:56 +0200, "ACROS Security Lists" said: > > Good points, Valdis, but I think we know how to do this right: an > invalid/untrusted/unmatching certificate is not a cause for user-waivable > warning but > for a fatal you-shall-not-pass error. By allowing users to even go past

[Full-disclosure] [ MDVSA-2013:175 ] owncloud

2013-06-17 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2013:175 http://www.mandriva.com/en/support/security/ __

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Lossof Integrity

2013-06-17 Thread ACROS Security Lists
Good points, Valdis, but I think we know how to do this right: an invalid/untrusted/unmatching certificate is not a cause for user-waivable warning but for a fatal you-shall-not-pass error. By allowing users to even go past the warning we're nurturing the automation of okaying such warning as we

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

2013-06-17 Thread Valdis . Kletnieks
On Sun, 16 Jun 2013 00:51:10 +0930, Defence in Depth said: > Microsoft Outlook (all versions) suffers from an S/MIME loss of integrity > issue. > Outlook does not warn against a digitally signed MIME message whose X509 > EmailAddress attribute does not match the mail's "From" address. Congrats on

[Full-disclosure] Facebook Open URL Redirection Vulnerability 2013

2013-06-17 Thread Arul Kumar
Description: [#] Title : Facebook Open URL Redirection Vulnerability 2013 [#] Status: Unfixed [#] Severity : High [#] Works on : Any browser with any version [#] Homepage : www.facebook.com [#] Author : Arul Kumar.V [#] Email : arul.xtro...@gmail.com I

[Full-disclosure] GreHack 2013 - CFP ends on June, 30 - Conf: Nov. 15, Grenoble, France

2013-06-17 Thread F. Duchene
--- *GreHack 2013* — Call For Papers ends on June, 30 November 15, Grenoble, France http://grehack.org — Twitter: @grehack --- *Topics* The 2nd International Symposium on Grey-Hat Hacking — aka GreHack 2013 — will gather researchers and practitioners

[Full-disclosure] Defense in depth -- the Microsoft way (part 3)

2013-06-17 Thread Stefan Kanthak
Hi @ll, many (if not most of the) Windows system utilities and system routines (including the kernel and its subsystems) as well as many user programs (including the "shell" Windows Explorer, Windows Media Player, Internet Explorer, Microsoft Office, etc.) load libraries/satellites at runtime via