Re: [Full-Disclosure] CHANNEL FREQ'S

2004-05-12 Thread Bernie, CTA
On 12 May 2004 at 7:27, Tyler, Grayling wrote: Geqqam69200, I've seen a few people refer to the lower 6 channels of wireless as operating in the Ham freq. spectrum. I am a bit confused where this is coming from as 802.11b operates in the ISM (Industrial Scientific and Medical) band. This

Re: [Full-Disclosure] Windows 2000 Source Code

2004-02-22 Thread Bernie, CTA
On 22 Feb 2004 at 15:56, [EMAIL PROTECTED] wrote: N http://tonioj.multimania.com/win2000src.htm N Here is the WHOLE windows 2000 source code, with tree, comments and N everything you will need to find some exploits. N Updated daily with all the new exploits found. Unfortunately, all

[Full-Disclosure] InfoSec sleuths beware, Microsoft's attorneys may be knocking at your door

2004-02-18 Thread Bernie, CTA
I see that in a recent article published by eWeek claim legal experts say individuals examining the leaked Windows code could face charges of trade-secret violations and infringement of software patents. http://www.eweek.com/print_article/0,3048,a=119396,00.asp Could Microsoft's attorneys go

Re: [Full-Disclosure] InfoSec sleuths beware, Microsoft's attorneys may be knocking at your door

2004-02-18 Thread Bernie, CTA
On 18 Feb 2004 at 13:06, Blue Boar wrote: Bernie, CTA wrote: Could Microsoft's attorneys go after sleuths who are, have been disclosing vulnerabilities in Microsoft's software and allege that the individual had discovered the vulnerability because they downloaded the code and examined

RE: [Full-Disclosure] Microsoft confirms source code leak

2004-02-13 Thread Bernie, CTA
On 13 Feb 2004 at 7:32, Edward W. Ray wrote: Does it not appear that the leak could have been done to ensure that M$ has a legal argument to abate liability in case they are sued? I think their EULA which you accept when installing covers their ass for just about anything. This may be true

Re: [Full-Disclosure] RE: W2K source leaked?

2004-02-13 Thread Bernie, CTA
On 13 Feb 2004 at 14:53, Georgi Guninski wrote: http://www.eweek.com/article2/0,3959,5264,00.asp Allchin: Disclosure May Endanger U.S. By Caron Carlson May 13, 2002 A senior Microsoft Corp. executive told a federal court last week that sharing information with competitors could damage

Re: [Full-Disclosure] Microsoft confirms source code leak

2004-02-13 Thread Bernie, CTA
On 12 Feb 2004 at 18:49, Thor Larholm wrote: There has been discussions on this mailing list as well as others about a possible leak of Windows 2000 and Windows NT 4 source code. Microsoft has now confirmed these rumours to be true. http://www.komotv.com/stories/29778.htm Does it not

Re: [Full-Disclosure] Re: security related contract

2004-02-05 Thread Bernie, CTA
On 5 Feb 2004 at 9:29, Eric Scher wrote: = = ~ One of our customers asked us for a machine that would ensure their local network security. Our commercial representative came and asked if I had a solution for them.

Re: [Full-Disclosure] sans.org

2003-09-02 Thread Bernie, CTA
nslookup say: NS1.HOMEPC.ORG is authoritative for sans.org and incidents.org Server: NS1.HOMEPC.ORG Address:66.129.1.102#53 Name: www.sans.org Address: 65.173.218.106 and Server: NS1.HOMEPC.ORG Address:66.129.1.102#53 www.incidents.org canonical name =

Re: [Full-Disclosure] SCADA providers say security not our problem

2003-08-21 Thread Bernie, CTA
Right on target Michael, and exactly the point most of us in this and related threads have pivoted from. The Blackout was the result of poor or nonexistent system security engineering, implementation, and auditing. We may be able to accept that the initial trigger incident that caused the

[Full-Disclosure] SCADA makes you a target for terrorists

2003-08-18 Thread Bernie, CTA
Back in the 1998 the warnings were out there but no one wanted to hear it. I tried to get people to listen and there reply was we have security guards with guns to take care of security. Now to be fair to SCADA and the Power Plants, there are other similar instrumentation monitoring solutions,

[Full-Disclosure] SCADA makes you a target for terrorists take 2

2003-08-18 Thread Bernie, CTA
Over a year ago the NIPC put out a warning about threats regarding the SCADA Systems Again, my point is regardless of what caused the Blackout, attention needs to be given on improving and integrating System Security first, and replacing the so called worn out Grid (cables and related

Re: [Full-Disclosure] east coast powergrid / SCADA [OT?]

2003-08-16 Thread Bernie, CTA
On 16 Aug 2003 at 5:36, Stephen Clowater wrote: Its highly unlikely that msblast had anything to do with the power outage. For one, the internal rpc network that is used to monitor actual power spikes, and to move current from one circut to the next in a grid is a closed network. And in the

Re: [Full-Disclosure] east coast powergrid / SCADA [OT?]

2003-08-16 Thread Bernie, CTA
/US/ap20030816_755.html http://junior.apk.net/~jnoga/F16CAUSE.html http://www.toledoblade.com/apps/pbcs.dll/article?AID=/20030816/ NEWS08/10 8160106 Richard -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bernie, CTA Sent: Saturday

Re: [Full-Disclosure] east coast powergrid / SCADA [OT?]

2003-08-16 Thread Bernie, CTA
On 16 Aug 2003 at 20:37, Stephen Clowater wrote: First of all, it is unrealistic to assume that the power plants, distribution nodes and sub stations are still equipped with 1965 technology. Have you ever visited any of these facilities? I have. Thats not what I said, What I said was

RE: [Full-Disclosure] east coast powergrid / SCADA [OT?]

2003-08-16 Thread Bernie, CTA
I did hear that there was a company that just coincidentally received a patent on a unique superconductor based arrester valve the day before the blackout. This valve is designed to suck down excess power surges and they could cost millions of dollars. snip Â…Intermagnetics to develop surge

RE: [Full-Disclosure] east coast powergrid / SCADA [OT?]

2003-08-15 Thread Bernie, CTA
On 14 Aug 2003 at 17:15, Andre Ludwig wrote: It is my general feeling that the power failure could be SCADA related. If it was an attack or an accident i do not know, nor do i think the appropriate information will ever be released to the public. Allot of SCADA systems from my research do

[Full-Disclosure] The Grid, Blaster v. Poor Security Engineering

2003-08-15 Thread Bernie, CTA
It is ridiculous to accept that a lightning strike could knock out the grid. There are many redundant fault, limit and Voltage- Surge Protection safeguards and related instrumentation and switchgear installed at the distribution centers and along the Power Grid that would have tripped to

Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Bernie, CTA
Now I don't think that was such a smart move. It wouldn't take much to setup a bunch of bogus DNS servers to answer as windowsupdate.com with a pointer to a new A record, or better yet, round-robin to an infinite number of FQDN, or IP addresses. In fact, a new variant placed on compromised

Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Bernie, CTA
On 15 Aug 2003 at 12:05, Jonathan Rickman wrote: On Friday 15 August 2003 07:03, B3r3n wrote: msblast start now on far eastern countries. We have a site in Auckland and so I'll know soon if our DNS to localhost protection is valuable. It is irrelevant now. MS has removed the DNS entries

[Full-Disclosure] Bankruptcy Court IT Security Contact

2003-07-09 Thread Bernie, CTA
Does anyone know the email address of the person responsible for the Security of the information systems of the United States Bankruptcy Court? I attempted to write them and bring attention to a simple security/privacy flaw in their system, which if exploited enables identity thieves to

Re: [Full-Disclosure] Destroying PCs remotely?

2003-06-18 Thread Bernie, CTA
This is Childs play... Why not just fry the Flash! That is, given that most if not all computers use FLASH BIOS these days. I could visualize that a well crafted puppy (Trojan) (i think 20 to 40 bytes should do the trick) can be sent to the target machine to erase/program the Flash to zip,

[Full-Disclosure] Re: California State Bill SB1386

2003-04-02 Thread Bernie, CTA
On Wed, 26 Mar 2003, Anders Reed Mohn wrote: I appreciate the various replies that I've received. However, the fundamental question of what defines encryption, so far as SB1386 is concerned, is still unanswered. I've looked through other California State Bills and supporting