Re: [Full-Disclosure] The Source Code Club is now open for business

2004-07-12 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
not here please ! - Original Message - From: "larry hobbles" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 13, 2004 2:10 AM Subject: [Full-Disclosure] The Source Code Club is now open for business > To whom it may concern: > > The Source Code Club is now open for b

Re: [Full-Disclosure] Erasing a hard disk easily

2004-07-12 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
> An overwrite with alternating zeros and ones will defer almost anbody, and so > will a random-data overwrite, provided both are repeated at least 3-5 times. > > [ the command for dd overwrite with zeros is: dd if=/dev/zero of=/dev/hd? ] so here are the actual command that you will have to run

Re: [Full-Disclosure] Erasing a hard disk easily

2004-07-13 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
> > I'm guessing that drilling a hole in the case, pouring in some sand and firing up > the disk would probably do a good job of rendering the data non-readable too ;> since the original poster only wanted to clean up the harddisk for donations so that no one can read the disks I think the Lin

Re: [Full-Disclosure] Re: My name is g0bb13s, HOBBLE, HOBBLES LOOK AT ME, LOOK AT ME!!! LOOK AT ME!!!

2004-07-17 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
- Original Message - From: "g0bb13s" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, July 17, 2004 6:06 AM Subject: [Full-Disclosure] Re: My name is g0bb13s, HOBBLE, HOBBLES LOOK AT ME, LOOK AT ME!!! LOOK AT ME!!! hey what is this ? ate a windows cdrom for breakfast and had

Re: [Full-Disclosure] telnet URL type used in exploit

2004-07-21 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
> The JavaScript overwrites telnet.exe with a downloaded executable and > then runs it by pointing the browser at telnet://. Instead of > launching a telnet shell as expected, the attackers code is executed. > This is not only an example of the telnet URL type being involved in > an exploit, but on

Re: [Full-Disclosure] IE

2004-07-21 Thread Aditya, ALD [ Aditya Lalit Deshmukh ]
since ie had holes ? - Original Message - From: "Kliarsky, Adam D." <[EMAIL PROTECTED]> To: "Jos Osborne" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Tuesday, July 20, 2004 8:35 PM Subject: RE: [Full-Disclosure] IE > When did Full-Disclosure change to politics? > > > -Original

RE: [Full-Disclosure] Re:

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
This guy has been sending out viruses unknown to him his machine has been infected... can someone please notify the admin / user of this machine or someone with enough clue to remove this virus for him, ( i would gladly help him / her if her the user was online and was going to trust me but

RE: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Try a deltree /y c:\that usually does the trick. and maybe format c: and reboot to install freebsd / solaris / linux or whatever version of unix Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.c

RE: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I did. Regardless of what it says, CWShredder doesn't get rid of all > variants of CoolWebSearch. this i found to be true in many cases, but however could the original poster please post some more info about removing the CWS ... -aditya __

RE: [Full-Disclosure] Automated SSH login attempts?

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> seems like...' are not exactly results of an analysis. these small things definatly add up in the final analysis but we need to be through about them and it certainly needs to be included in the final analysis of the malware > This things needs to be disassembled, debugged and traced. All >

RE: Re: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> We are all computer people - fixing one computer is easy but could take 4 > hours - not very helpful on a mass scale. We pay for point and click, why > shouldn't we get it? ;) the sweet word over here is automation even if one computer takes 4 hours to clean but if can find a way to do that an

RE: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> >Absolute and utter rot! I understand YOU may not be able to do > it but it CAN > >be done. It is simple logic if you want to look at it another > way - whatever > >can be DONE can be UNdone. > > > > Did you really mean "whatever can be done can be UNdone"? > How about a format C:? (I haven't

RE: Re: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > There is a free piece of software somewhere that will grab all the BHOs > (Browser Helper Objects) out of the registry and display them all. Anyone > remember where this software can be found? Probably you want regenhancer from the same co that create ad-aware this does exactly what you wan

RE: [Full-Disclosure] Cool Web Search

2004-08-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Where there are not short-cut workarounds this means removing the > software manually is simply impossible. Currently a trip into Safe Mode > can do the trick, by stopping any of the software running, but I'm sure > that'll be worked around too eventually. (Rootkit-like spyware?) complete

RE: Re: [Full-Disclosure] Cool Web Search

2004-08-02 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I have work to do..and to tell you the true, CWS isn't a problem > for me? Why because we have real network security. Desktop security is the > last line of defense. Multi-tier security will stop most spyware at the gate > and it will never get to you. to DO THIS you still need to know the a

RE: [Full-Disclosure] Virus Problem

2004-08-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > On searching google we found one more person havin similiar problem naming > it as 'badass virus' but do not found antivirus for it. > > Please suggest that what could be done for it. how about removing the hard disk and attaching it another computer and running the scan from there of cours

RE: [Full-Disclosure] Defcon spelled half backwards is Fedcon and you dumfucks walked into a trap

2004-08-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > :Down with kiddies, down with admins, down with ppl > :trying to make security better. Down with everyone > :profiting off publicity. please do your shouting somewhere else > :Why people so inconsistent? maybe it is time to increase the minimum age of list 18 maybe -aditya ___

RE: [Full-Disclosure] Puzzled....

2004-08-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
This is a typical behavior where the resident sheild simply put the file in quarantine or deletes the file is this what is happening please see the options to see what AVG is doing     -aditya -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf O

RE: [Full-Disclosure] waa waa (was Finally the truth slips out)

2004-08-06 Thread Aditya, ALD [Aditya Lalit Deshmukh]
please keep politics out of this list, this need is not limited to usa > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of igotroot > Sent: Friday, August 06, 2004 6:23 PM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: [Full-Disclosure] waa waa (w

RE: [Full-Disclosure] Security hole in Confixx backup script

2004-08-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > (which is why 'suidperl' exists). > > Other than that, you're on the right track.. ;) > > What about a suid bash? ;-) i believe that the shell script will run but if the user is not root then the shell script will not have root privs but normal privs of the user, this has been like this ba

RE: [Full-Disclosure] fedora.org compromised - http://fedora.redhat.com not compromised

2004-08-11 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> The whitehouse website was also compromised. Look www.whitehouse.com > =) > Wasn't fedora.org home to a page of useful fedora information? I am not at > home and don't have all my links. guys can we please discuss defaced websites on some other list ? -aditya ___

RE: [Full-Disclosure] driver for display goes to a infinite loop by viewing a html!

2004-08-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> hello, > > Please note the fact, i've just tested it with IE and > firefox .9.3 on windows XP with intel VGA and the > system reboots with a fetal error. fetal error ? what that how did the computer become pregnant ? no wonder it rebooted! fun aside, can you analyse the dump file generated by

RE: [Full-Disclosure] Temporary Files and Web Sites (swp, ~, etc)

2004-08-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> HTML file is an PHP, or an .index.php.swp is found, values like DB > usernames/passwords, security mechanism or worse might be revealed to the > user requesting the file. > > What can you do? > There isn't much you can do beside: > 1) Avoid leaving these files behind > 2) Make rules in Apache/

RE: [Full-Disclosure] SP2 is killing me. Help?

2004-08-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> And sometimes the patch tries to be a smartass. In my case SP2 > intalled its temp-files not to my TEMP-folder, but to another drive this un-standard behaviour has be microsoft standard with all the service packs of ms since win2k sp1 . -aditya ___

RE: [Full-Disclosure] Unix Commands

2004-08-15 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Hi List > > Is there a possibility to bind /bin/bash on a socket with legacy unix > commands? > netcat ? Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) __

[Full-Disclosure] RE: cmd.exe bug in win2k sp4 in "for" loop

2004-08-17 Thread Aditya, ALD [Aditya Lalit Deshmukh]
sorry for replying to my own mail but i forgot to tell what the problem was the attachment that you see was in the previous mail was a snapshot of extra 1 ones that are added to the command after the in the for loop there is a case where the extra "1" always being apended to command line ( th

[Full-Disclosure] cmd.exe bug in win2k sp4 in "for" loop

2004-08-17 Thread Aditya, ALD [Aditya Lalit Deshmukh]
On windows 2000 SP4 the command processor cmd.exe has a small bug in the for loop see the attached image, this is making all the bat file go crazy with the output see the selected potions   is this a known bug, with a patch ? can it be reproduced on other NT/2k/XP/3 versions of windows

RE: [Full-Disclosure] cmd.exe bug in win2k sp4 in "for" loop

2004-08-21 Thread Aditya, ALD [Aditya Lalit Deshmukh]
NT, 2K and 2003. Have a nice day Maxime Ducharme Programmeur / Spécialiste en sécurité réseau - Original Message - From: Aditya, ALD [Aditya Lalit Deshmukh] To: [EMAIL PROTECTED] Netsys. Com Sent: Tuesday, August 17, 2004 1:31 AM Subject: [Full-Disclosure] cmd.exe bug in win2k sp4 in "

RE: [Full-Disclosure] Possible dialer on 62.4.84.150

2004-08-21 Thread Aditya, ALD [Aditya Lalit Deshmukh]
KERNEL32.DLL LoadLibraryA GetProcAddress ExitProcess advapi32.dll RegCloseKey oleaut32.dll SysFreeString shell32.dll ShellExecuteA user32.dll SetTimer all these exports show point in a direction that it creates a key in the registry for

RE: [Full-Disclosure] Possible New Malware....

2004-08-24 Thread Aditya , ALD [ Aditya Lalit Deshmukh ]
nloads.htm   In their License Agreement they state this:   *  This is a legally binding agreement between yourself "you" and Slimeware Corporation "Slimeware". < OTHER DETAILS SNIPPED>    From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] O

RE: [Full-Disclosure] Re: HelpCtr - allow open any page or run

2004-02-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
win2k sp4 does not work > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Richard > Maudsley > Sent: Friday, February 10, 2006 10:38 PM > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] Re: HelpCtr - allow open any page or run > > > Nope, me ne

RE: [Full-Disclosure] Re: HelpCtr - allow open any page or run

2004-02-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
i thought he was ref to hh.exe now i know - thanks for correction. -aditya > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of morning_wood > Sent: Friday, February 13, 2004 4:50 PM > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] Re: HelpCtr - al

RE: [Full-Disclosure] Windows 2000 Source Leak Verified. Get ready for the havoc.

2004-02-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
are they actually .asm, .c files and .h files in them ? or whatever lang was used to code windows? -aditya > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Friday, February 13, 2004 7:14 AM > To: [EMAIL PROTECTED]; [EMAIL PR

RE: [Full-Disclosure] GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

2004-02-16 Thread Aditya, ALD [Aditya Lalit Deshmukh]
looks like the ie5 is of a very old version that was distributed with default installation of windows 2000 sp0 still waiting for m. wood to say it -aditya > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of KF > Sent: Monday, February 16, 2004 2:20

RE: [Full-Disclosure] Re: http://federalpolice.com:article872@1075686747

2004-02-16 Thread Aditya, ALD [Aditya Lalit Deshmukh]
this is a keylogger that will mail out your intresting logs to some russian address! so beware of this one, but what i couldent understand is how is this file executed ? -aditya > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Se

RE: [Full-Disclosure] Re: [Full-Disclosure] http://federalpolice.com:article872@1075686747

2004-02-16 Thread Aditya, ALD [Aditya Lalit Deshmukh]
this is not a zip file - its a windows exe complete with a MZ header and calls to LoadLibraryA & GetProcAddress exported from KERNEL32.dll am debugging thu it - to see what exactly it does... (this one is real good) but how come ie and mozilla started it up as a java applet without any error

RE: [Full-Disclosure] Windows 2000 Source Leak Verified. Get ready for the havoc.

2004-02-16 Thread Aditya, ALD [Aditya Lalit Deshmukh]
off topic, just some random thoughts maybe ms will "release" the next batch of 1/3 code in some time for "peer review" so that they can remove all the bugs and security holes before the next release of windows - long horn is that it ? as per ms windows is more secure because it has closed sour

RE: [Full-Disclosure] InfoSec sleuths beware ...

2004-02-19 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Nancy Kramer > Sent: Thursday, February 19, 2004 6:17 AM > To: Gregory A. Gilliss; [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] InfoSec sleuths beware ... > > > What Gregory says makes a lot of se

RE: [Full-Disclosure] Quick Analysis of Netsky-B

2004-02-20 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Thursday, February 19, 2004 11:20 PM > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] Quick Analysis of Netsky-B > > > Helmut Hauser wrote: > -- the IP 217.5.100.1 is

RE: [work] [Full-Disclosure] Re: Would you trust these Emails (EBAY & PAYPAL)

2004-02-21 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of opticfiber > Sent: Saturday, February 21, 2004 7:52 PM > To: martin f krafft; [EMAIL PROTECTED] > Subject: Re: [work] [Full-Disclosure] Re: Would you trust these Emails > (EBAY & PAYPAL) > > > -BEGI

RE: [Full-Disclosure] Firewalls

2004-02-22 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> 1) How do you get to a site via http without having the site's > name appear in the out going http request? use a proxy server, there are plenty on the net that you can use, antifirewall is one that comes to mind - it has a free version that you can use and download right now, google for i

RE: Re[2]: [Full-Disclosure] Would you trust these Emails (EBAY & PAYPAL)

2004-02-22 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > A concept like PGP would probably be fairly safe. Mails from your > bank, for instance, should be digitally signed. That would make them > a lot harder to fake. I agree on the non-HTML part, they are an > unnecessary risk. pgp would be fairly safe if the user manages to decrypt the signatu

RE: [Full-Disclosure] Windows XP explorer.exe heap overflow

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> EXPLORER.EXE goes to 99% CPU usage during preview/rendering of malformed > images. > here the same thing Win2000 with all the service packs and patches Delivered using the Free Personal Edition of Mailtraq (www.mailtraq

RE: [Full-Disclosure] Probes on port 389

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Is anyone else seeing SYN scans on port 389? Is anyone aware of any > recent exploits for Active Directory? Perhaps using the ASN.1 overflow? that is also for ldap - maybe explits for ldap are out in the wild for other products than this one also ? -aditya _

RE: [Full-Disclosure] Empty emails?

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > With slightly different senders, yeah. A few are empty, some > come with a little red x > (well, with an image which has to be loaded from the internet), and > some with just a single random character in the body. I have no idea > what they are supposed to accomplish. *MAY BE* they are s

RE: [Full-Disclosure] Advisory 02/2004: Trillian remote overflows -> maybe this is off-topic, but...

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
can some one please stop the CC storm that seems to be taking place in this thread? Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) ___ Full-Disclosure -

RE: [Full-Disclosure] Advisory 02/2004: Trillian remote overflows-> maybe this is off-topic, but...

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> No, you're free to reverse engineer Trillian (they might sue you, > though). > Everything is "open source" if you know assembler. > sue you ? for what ? for finding bugs in their code that they should have done themselves ? they should be grateful to you and be paying you for your time and

RE: [Full-Disclosure] Need help in performing a remote vulnerability scan

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I work for a manufacturing company that has many remote sites. > > I am in the US and I have been tasked with performing vulnerability > assessments for about 30 remote sites in Europe, AsiaPac and > South America. > > Can anyone recommend a method and set of tools that I can use to do them

RE: [Full-Disclosure] Centralized server information gathering alternatives / The Bizex worm

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Most worms today that infect machines try to report back to centralized > servers specified by the creator (to upload/download data). The only > problem with this approach is that centralized servers can be shut down to > prevent the spread of the worm and cease information gathering. Now, w

RE: [Full-Disclosure] Need help in performing a remotevulnerability scan

2004-02-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Where can i find the details on how to do that? > I am not a guru at this. > > What specific agent would you recomend? be careful about this one,i dont like where this is going. a single wrong file, ( ie aka a trojan ) could infect all your computers in the net on all the sites and hand ov

RE: [Full-Disclosure] Fake Email

2004-02-28 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Because the lsass.exe trojan is running on your system. > Check this, open the task manager and try to stop that! LSASS.exe is present only on the win2k / winxp system and it cannot be closed because it is one of the system processes. > You'll see, you can't stop this trojan. > When you use wi

RE: [Full-Disclosure] OpenPGP (GnuPG) vs. S/MIME

2004-02-28 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > I'd like to open a discussion about PGP vs. S/MIME . > > I've been pondering secure (or at least verifiable) mail lately and I > see these two standards as the main options available at this point. > > It seems to me that PGP is the better of

RE: [Full-Disclosure] Need help in performing aremotevulnerability scan

2004-03-02 Thread Aditya, ALD [Aditya Lalit Deshmukh]
Need help in performing > aremotevulnerability scan > > > On Fri, 2004-02-27 at 07:02, Aditya, ALD [Aditya Lalit Deshmukh] wrote: > > > > > > Where can i find the details on how to do that? > > > I am not a guru at this. > > > > > > What specific agent wou

RE: [Full-Disclosure] Need help in performing aremotevulnerability scan

2004-03-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Sounds good > I like to do this with ssh & vnc over linux > > [rh8]$ssh -X [EMAIL PROTECTED] > [mn9]$vncserver :4 > [mn9]$vncviewr localhost:4 > > Would there be any such suggestions for setting up VPN > with out without home firewall, ,assuming windows-windows? or > windows-linux, or linux

RE: [Full-Disclosure] Looking for a tool

2004-03-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I am no windoze kernel expert, but could your culprit be a kernel thread > of some sort? windows kernel thread ? no, me thinks its a service Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) __

RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

2004-03-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> 'Password is a long yellow fruit enjoyed by monkeys.' which ones ? there are many types of them around here > Leave passworded .zips alone -- take the sensible approach and catch an > infected file once it's been extracted. that would be the best approach but it would make all the spam

RE: [Full-Disclosure] Backdoor not recognized by Kaspersky

2004-03-03 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> The zip's contents can > be seen without the password, just not unpacked...no cracking it required. now winrar has a option to encrypt file names with a password, me thinks pkzip with the 64 bit compression also has that feature... how are we going to deal with this ? by stopping all the compr

RE: [Full-Disclosure] Looking for a tool

2004-03-04 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Harlan > Carvey > Sent: Thursday, March 04, 2004 12:23 AM > To: [EMAIL PROTECTED]; Tim; Schmehl, Paul L > Cc: [EMAIL PROTECTED] > Subject: RE: [Full-Disclosure] Looking for a tool > > > Just out of curi

RE: [inbox] Re: [Full-Disclosure] Re: E-Mail viruses

2004-03-07 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I think the kind of approach Kurt has suggested can only realistically > work in corporate and institutional environments (and with the > occasional well-disciplned individual), where it would also be > realtively easy to further restrict the odds of sustaining damage via > this entry route

RE: [Full-Disclosure] Re: E-Mail viruses

2004-03-08 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> You Can't Judge a Book By Looking At The Cover > (Willie Dixon) > You Can't Judge a File By Looking At The Extension > (Common Sense) but you can use something like /etc/magic or /etc/mime_magic to look in the header and judge the file for you even if it is without an extencion. Just my two

RE: [Full-Disclosure] Where to start

2004-03-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Does a good security-officer have to know everything about every hole? I > myself don't think so, but where do people start? security officer is more of a complience officer, he makes sure that all the users, admin and other it staff stick to the policies created. > If I see lists and fo

RE: [Full-Disclosure] Comcast using IPS to protect the Internet from their home user clients?

2004-03-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
dear frank, if you are routing all your scans from a vpn and the vpn connections are encrypted as they always are then is impossible that the scan are triggering some kind of signatures. i think while they *might* have a ids installed and working, they also might be filtering based on the traf

RE: [Full-Disclosure] Has anyone seen this in their e-mail

2004-03-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Yeah, this looks like one I've got yesterday too. The message was > different and even the password was different (clever virus-writer huh). how difficult would it be to use random and differnet passwords for each infection, pretty easy for a smart programmer or the clever virus writer, may

RE: [Full-Disclosure] Comcast using IPS to protect the Internetfrom their home user clients?

2004-03-11 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > ids installed and working, they also might be filtering based on the > > traffic thresholds ... > > Dear Aditya, > > I am NOW routing the scans through a VPN so that they are not blocked by > Once I realized that something seems fishy, I started to > tunnel all attack traffic, with the repor

RE: [Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-13 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I agree with Nick. It is ironic and unfortunate that MS would force > users to turn on a potentially unsafe scripting language to read a > security bulletin. > the default secure lockdown includes stopping and blocking all the scripts from executing so i think this is a paradox

RE: [Full-Disclosure] Book of unreleased exploits?

2004-03-13 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > Coworker is telling me this is some sort of compendium of unreleased > exploits. Figuring that the average exploit would take up about 5 pages > of printed text, and the book at 650 pages, that would lead me to infer > that it has somehwere around 130 new exploits. WTF? What is the point of

RE: [Full-Disclosure] Re: Norton AntiVirus 2002 fails to scan files with ... [2'nd... UPDATED]

2004-03-13 Thread Aditya, ALD [Aditya Lalit Deshmukh]
please, i tested it : it did not work, and the program did not crash, program : nav version 2002 > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of bipin gautam > Sent: Friday, March 12, 2004 10:34 AM > To: [EMAIL PROTECTED] > Subject: [Full-Disclosure]

RE: [Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-13 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Your points are well taken and understandable. But if you are supporting > a M$ operating system enough to need to read the SB's, then wouldnt your > IE be up to date to read them? Even if you would just use IE to > read M$'s > site? To sit and scream about web design decisions in this mai

RE: [Full-Disclosure] unsubscription?

2004-03-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
http://lists.netsys.com/mailman/listinfo/full-disclosure -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of wagner oliveiraSent: Sunday, March 14, 2004 5:53 AMTo: [EMAIL PROTECTED]Subject: [Full-Disclosure] unsubscription? How I make

RE: [Full-Disclosure] Telnet Sniff Problems

2004-03-22 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I will capture telnet-passwords, but tcpdump > and dsniff only show a single empty frame > instead of a password. Has anybody a hint > what happend? Other things are captured well this seems to be a case of invalid command line options, just make sure that you are capturing the whole packet i

RE: Re[3]: [Full-Disclosure] Another false Citibank e-mail...a new phishing?

2004-03-23 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> do we really need the list to be addressed everytime one of these scams > occurs, they are common occurance now, for fucks sake > maybe we add this to the lists charter not to send any scram untill they are exploiting some new method, useing the users stupidity does not count -aditya __

RE: [Full-Disclosure] viruses being sent to this list

2004-03-23 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> not ignore the importance of such exchanges in combating the spread of > malicious software and technology hey these exchanges were intentional and viruses send to this list are "unintentional" -aditya Delivered using th

RE: [Full-Disclosure] RE: Sarca rainbow tables on-line cracking service

2004-03-24 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Ok everybody let's send our LM Hashes and email addresses to this group of > complete strangers. Sounds like a great idea. dont make assumptions before u use the service... try feeding some random hashes from non critical servers and changing the passwords right then and there > > Not that

RE: [Full-Disclosure] Telnet Sniff Problems

2004-03-24 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I saw some answers about my problem concerning snaplen, I've already ok so we can rule this out... > > The password must be transmitted on the wire (because the telnet session > otherways shows everything normal, no redirects or can you tell which os and which version is this ? maybe this

[Full-Disclosure] strange traffic ?

2004-03-26 Thread Aditya, ALD [Aditya Lalit Deshmukh]
Dear list, i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost to crash. and then i start seeing traffic to port from the same ip.   what is this traffic i am seeing ? any new kind of malware trying to open of port 444

RE: [Full-Disclosure] strange traffic ?

2004-03-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
to [EMAIL PROTECTED] : the sniffer that i has was only logging the headers and not the actual data ... so i cannot help you there, now have configured it to log all such traffic, will come back if i manage to capture any packet data also the [EMAIL PROTECTED] netcat idea is good as suggested b

RE: [Full-Disclosure] Re: text

2004-03-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> If you'd used the right eicar.com, rather than the busted one I > posted first (sorry about that quoting, copied it from the wrong > place) then that'd probably have set of a generous crop of A/V > systems. yes i know that, that is why i did not send it i know this file can be easily downloade

RE: [Full-Disclosure] strange traffic ?

2004-03-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jack > Sent: Saturday, March 27, 2004 2:35 AM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] strange traffic ? > > > More details are definitely needed, but let me ask

RE: [Full-Disclosure] Cronning Update Jobs

2004-03-27 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> off-list to tell me so. I'd hate for this to turn into another spammy > thread :p hope all people would do the same thing > My question is this - are there any security risks to adding this > command to a cron job, and having it execute say, once every 12 hours. 'emerge sync && em

RE: [Full-Disclosure] New Win32 Worm regsvc32.exe offers rootkit features

2004-03-30 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > > Looks like IRC Backdoor > check registry: > HKLM\Software\Microsoft\Windows\CurrentVersion\Run and delete > entry with regsvc32.exe > (such as Registration Service = "regsvc32.exe") > Do the same with > HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices the port 1025 is good u

RE: [Full-Disclosure] internet-explorer: bug or feature?

2004-04-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> ie shows me a page with the content 'mooh' and when i call > > about:alert('*plopp*'); > > a small alert popps up and says me '*plopp*', so it seems, that i can this is a local zone for ie if you can manage to script it then you could 0wn other people without too much effort -aditya ___

RE: [Full-Disclosure] Block notification / bounce mails (as in DDOS)

2004-04-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
point the mx to 127.0.0.1 or localhost for 3 days > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Koen > Sent: Thursday, April 01, 2004 8:29 PM > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] Block notification / bounce mails (as in > DDOS) >

RE: [Full-Disclosure] Block notification / bounce mails (as in DDOS)

2004-04-01 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> One think that crossed my mind later on was : > - change my mx-records to one mailhost 'X' that's on my netblock > (so making > sure that possibly the backup-mailexchangers don't get annoyed) here i control my mx and dns records so i can do this without doing anything to the isp so i use this

RE: [Full-Disclosure] Block notification / bounce mails (as in DDOS)

2004-04-02 Thread Aditya, ALD [Aditya Lalit Deshmukh]
first off, the From: header would not normally be the one emails get > bounced to. rather, it would be the "MAIL FROM" envelope header. in > any case, my 'solution' would be to temporarily drop all mail destined > to this deluged account to /dev/null and set up a new account for the /dev/

RE: [Full-Disclosure] FD should block attachments

2004-04-02 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I think FD should change their policy and block all attachments, except > maybe plain text file's. i second this if someone wants to send binary data / attachment use BHX or UUE or XXE encoding copied in the main message... like this text > Most people on this list are smart enough that ex

RE: [Full-Disclosure] Wiretap or Magic Lantern?

2004-04-07 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Why should ordinary people trust the governments of the West? > > Regards: Tamas Feher. we shouldent and we dont but lets discuss this at some other place ... there is no place for politics in computer security . D

RE: [Full-Disclosure] FAT32 input > output = null?

2004-04-08 Thread Aditya, ALD [Aditya Lalit Deshmukh]
executing this at the dos promt would create a zero byte m.wood file > m.wood looks like a feature equivalent to touch m.wood or touch filename -aditya Delivered using the Free Personal Edition of Mailtraq (www.mai

RE: [Full-Disclosure] Cisco LEAP exploit tool...

2004-04-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Well, that really depends, doesn't it. We're doing IPSEC using AES for > wireless on a test network. It's a good deal more secure than our wired > network, which is still plain text. this sure is plain text but when combined with switches ( yes i know they can be degraded to act like hubs

RE: [Full-Disclosure] The new Microsoft math: 1 patch for 14 vulnerabilities, MS04-011

2004-04-16 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> address book. Clearly the motivation is there, the flaws are > there, it's the > skill set that is missing. > skills can be accurired by the motivated give the time and resourses so guess the lack of the motivation is a the root cause -aditya ___

RE: [Full-Disclosure] Locking up Internet Explorer

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > \\test\test > > It's just guessing you tried the wrong direction slashies. no these slashes are alright this is the unc naming scheme where u can specify \\server\share\directory\filename regardless of the of the server is running netware or windows that is why it is called universal namin

RE: [Full-Disclosure] Registry Watcher

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Pro (the pay-for version) has a TSR called AdWatch, that will alert to TSR used to in DOS and they were good challange to program and when the TSRs worked it was time to celebrate. in windows we only have processes which can be invisible minimized or normal state! > entry is changed or crea

RE: [Full-Disclosure] iDEFENSE: Security Whitepaper on Trusted Computing Platforms

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> > speel? what do you want? Most people spell "speel" "spell" :) > regards nico could we have these sort of mails offlist ? Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) _

RE: [Full-Disclosure] Wireless ISPs

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> I do a great deal of wardriving in order to map out my coverage area. In > doing this, I happen to get a lot of data captured. And a pretty good > portion of the WEP-protected networks happen to get cracked by wepattack > in under a minute. I don't even go back to see if I can snoop more of the

RE: [Full-Disclosure] leaking?

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Hi abhilash verma and the rest... > Why do you include this in your mails? tracking full-disclosure readers which use > html > rendering muas? > > http://clients.rediff.com/signature/track_sig.asp";> SRC="http://ads.rediff.com/RealMedia/ads/adstream_nx.cgi/www.rediffmail.com/[EMAIL > PROTECTE

RE: [Full-Disclosure] leaking

2004-05-12 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> And gotta love the flavors of the BSD OS that does it for them! ms will deny that saying that hotmail runs on windows ! Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) ___

RE: [Full-Disclosure] KDE was hacked

2004-05-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> If you had been subscribed to our iAlert services, you would have known > about this specific hacker threat months in advance, and known that only > the binary releases of KDE are safe to use. iAlert any one subscribed to this ? how is the quality of the alerts and where does one subscribe to t

RE: [Full-Disclosure] Windows IPS personal use

2004-05-10 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Looking for a intrusion prevention system for personal use on my > win xp box sygate personal firewall pro www.sygate.com it has plenty of IPS features built into it others that i have used and found to be effective are norton internet security 2003 the best would be haveing a separate ope

RE: [Full-Disclosure] Support the Sasser-author fund started

2004-05-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> Nobody asked the "burglar" to do this. He broke law. He caused damages. > And he certainly didn't improve your security by doing so when the door > vendor already offered a patch for your door two weeks ago. if the burglar was a really a good guy he would have come over knocked your door, ring

RE: [Full-Disclosure] Sasser author ( off thread post about duplicate emails )

2004-05-14 Thread Aditya, ALD [Aditya Lalit Deshmukh]
i have been getting a lot of emails twice. is any one on the list experiencing the same problem? -aditya Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) __

RE: [Full-Disclosure] Psexec on *NIX

2004-05-07 Thread Aditya, ALD [Aditya Lalit Deshmukh]
> MAC address of a desktop in Ohio. In windows, it only takes a 'psexec > \\ohio ipconfig /all'. I don't need to use a remote desktop client, I yes this is the one best things that we can with windows and the utils works very nicely, i think they distribute the source along with this utils, rol

  1   2   >