Re: [Full-disclosure] Rutkowska faces ‘100% unde tectable malware’ challenge, teasing?

2007-06-30 Thread Trey Keifer
Joanna has stated her technical requirements for the challenge and Thom and group has accepted them, so why not turn this into what it really is... a bet. The losing team agrees to pay the other $350,000 - if both groups are really so confident there shouldn't be any issue. On 6/30/07, Bipin G

Re: [Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

2006-09-12 Thread Trey Keifer
How is this a vulnerability? this is a common design trade-off of SSO tokens. In order to support the user opening and closing multiple applications and not requiring them to login again to individual applications (which is the point of SSO) they must invalidate the token in specific instances whil

Re: [Full-disclosure] Tempest today

2006-08-18 Thread Trey Keifer
I had not seen a realistic, working public example until I picked up on this just the other day. Granted, it's sketchy on details, but assuming it is a honest example it is impressive. http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/Everything else seemed to ref