RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

2004-03-07 Thread Larry Seltzer
TCPA, the Telecommunications Communications Privacy Act. You must have this name wrong. Apart from the redundancy, I Googled it and got nothing. Do you mean the Telemarketing and the Telephone Consumer Protection Act (TCPA)? ___ Full-Disclosure - We

[Full-Disclosure] gather windows shares with an cmd-script

2004-03-07 Thread Frank Dietrich
Hi, i got an intersting cmd-script to gather shares in a windows network without the need to install something. Sorry for quoting long lines. @echo off : : : -=[ (c) 2003-10-31 MrB ]=- : : collect the name of accessible Windows(R) shares : : syntax: openshare 192.168.0 : - scans all ip

[Full-Disclosure] unsubscribe me my email is murk00@comcast.net

2004-03-07 Thread murk

RE: [inbox] Re: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Aditya, ALD [Aditya Lalit Deshmukh]
I think the kind of approach Kurt has suggested can only realistically work in corporate and institutional environments (and with the occasional well-disciplned individual), where it would also be realtively easy to further restrict the odds of sustaining damage via this entry route by

RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

2004-03-07 Thread Larry Seltzer
TCPA, the Telecommunications Communications Privacy Act. http://www.nyfairuse.org/action/palladium That's Trusted Computing Platform Alliance and totally off the point. LJS ___ Full-Disclosure - We believe in it. Charter:

[Full-Disclosure] mydoom.c information

2004-03-07 Thread morning_wood
bascially looking for sync-src-1.00.tbz. That message was posted to this avail on infected hosts This is how I came to be in possession of it: nc -l -p 3127 doomjuice.dump You will probably want to write a loop to restart netcat because it exits after a successful transfer.

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread Gregory A. Gilliss
Now THIS is an example of why I subscribe to this list. Good work! G On or about 2004.03.06 19:40:24 +, [EMAIL PROTECTED] ([EMAIL PROTECTED]) said: I recently read somewhere that mydoom.c included the source code for the a variant. Being the curious type, I wanted to see it. During my

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread John Sage
Now I'm confused... On Sun, Mar 07, 2004 at 09:43:03AM -0800, morning_wood wrote: From: morning_wood [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Full-Disclosure] mydoom.c information Date: Sun, 7 Mar 2004 09:43:03 -0800 bascially looking for sync-src-1.00.tbz. That message was

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread morning_wood
Now I'm confused... [EMAIL PROTECTED] /storage/virii] $ nc -h GNU netcat 0.7.1, a rewrite of the famous networking tool. Basic usages: connect to somewhere: nc [options] hostname port [port] ... listen for inbound:nc -l -p port [options] [hostname] [port] ... tunnel to somewhere:

RE: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Brad Griffin
, so you obviously didn't read Curt's solution for *his* network in context as well. Slip away and think up some more witty comments ... Better yet, go back and read what was written and maybe show a little mutual respect. We don't want to know how big your penis is... -Original

[Full-Disclosure] Re: [VulnWatch] Sun passwd(1) Command Vulnerability

2004-03-07 Thread Steven M. Christey
Jay D. Dyson [EMAIL PROTECTED] said: I often find the grammar used in security advisories and briefs to be confusing, and I'm forced to wonder if the wording is deliberate. Historically, when security companies have made claims that they could not verify, they have been dealt with in a very

RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

2004-03-07 Thread Mike Barushok
Sorry, shouldn't write this stuff when I am not looking at primary sources. ECPA, the Electronic Communications Privacy Act. Title 18 USC 2701 On Sun, 7 Mar 2004, Larry Seltzer wrote: TCPA, the Telecommunications Communications Privacy Act. You must have this name wrong. Apart from the

Re: [inbox] Re: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Jorge Daza
Hello, ... Limiting ourselves to three-character-only, non-case sensitive ASCII alphanumerics, that is a one in 3^36 chance. Sorry :) but it is 26^3 that is shomehow smaller 8) Best regards, Jorge -- Jorge Daza - [EMAIL PROTECTED] - GPG key available -- -

Re: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Jorge Daza
Hello, why not solve the problem the way it is handled in other environments ? We have two people that do not necessarily trust each other, and they want to share a file. We can create trusted third parties to verify origin, store and maybe even analyze the file. A the receiver B the sender C

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread Gyrniff
As I recall the -L option (persistent listener) only works on the windows port. On Sunday 07 March 2004 20:44, John Sage wrote: Now I'm confused... On Sun, Mar 07, 2004 at 09:43:03AM -0800, morning_wood wrote: From: morning_wood [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject:

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread John Sage
heh.. On Sun, Mar 07, 2004 at 02:01:01PM -0800, [EMAIL PROTECTED] wrote: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] mydoom.c information Date: Sun, 7 Mar 2004 14:01:01 -0800 (PST) See comments inserted in reply: On Sun, 7 Mar 2004, morning_wood wrote:

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread John Sage
ah.. On Sun, Mar 07, 2004 at 01:20:56PM -0800, morning_wood wrote: From: morning_wood [EMAIL PROTECTED] To: John Sage [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] mydoom.c information Date: Sun, 7 Mar 2004 13:20:56 -0800 Now I'm confused... [EMAIL

RE: [Full-Disclosure] mydoom.c information

2004-03-07 Thread Chris Eagle
Gyrniff wrote: As I recall the -L option (persistent listener) only works on the windows port. If you want it for Unix: --- nc110/netcat.c 1996-03-20 16:38:04.0 -0800 +++ netcat.c2004-03-07 18:17:55.0 -0800 @@ -73,6 +73,7 @@ #include errno.h #include signal.h

Re: [Full-Disclosure] mydoom.c information

2004-03-07 Thread m . mohr
Heh heh heh. How could I be using the Windows version if I am running Bash on Linux? :) On Sun, 7 Mar 2004, John Sage wrote: heh.. On Sun, Mar 07, 2004 at 02:01:01PM -0800, [EMAIL PROTECTED] wrote: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] mydoom.c

RE: [Full-Disclosure] mydoom.c information

2004-03-07 Thread Frank Knobbe
On Sun, 2004-03-07 at 19:47, Chris Eagle wrote: As I recall the -L option (persistent listener) only works on the windows port. If you want it for Unix: How about? while true;do nc -l -p 1234;done Forrest? Trees? -Frank signature.asc Description: This is a digitally signed message

[Full-Disclosure] An interesting email

2004-03-07 Thread Byron Copeland
No body, No subject. No From:, No To: Hmmm. Ya think comcast has a misconfigured SMTP host someplace? Date: Mon, 8 Mar 2004 03:45:45 + (GMT) X-Comment: Sending client does not conform to RFC822 minimum requirements X-Comment: Date has been added by Maillennium Received: from

RE: [Full-Disclosure] mydoom.c information

2004-03-07 Thread Frank Knobbe
On Mon, 2004-03-08 at 01:01, [EMAIL PROTECTED] wrote: The problem with that is that there is no incrementing counter. The output never gets written to file, since nc sends data directly to stdout. Which is why I had an 'x' variable in my loop - it conveniently increments by one each

RE: [Full-Disclosure] mydoom.c information

2004-03-07 Thread m . mohr
On Sun, 7 Mar 2004, Frank Knobbe wrote: On Sun, 2004-03-07 at 19:47, Chris Eagle wrote: As I recall the -L option (persistent listener) only works on the windows port. If you want it for Unix: How about? while true;do nc -l -p 1234;done The problem with that is that there is

Re: [inbox] Re: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Nick FitzGerald
Jorge Daza [EMAIL PROTECTED] to me: ... Limiting ourselves to three-character-only, non-case sensitive ASCII alphanumerics, that is a one in 3^36 chance. Sorry :) but it is 26^3 that is shomehow smaller 8) Whoops -- yes, though I did say alpha_numerics_ so expect you meant 36^3...