Re: [Full-disclosure] How Prosecutors Wiretap Wall Street
The direction of the association doesn't matter. It doesn't matter if the terrorist is contacting me, or if I'm contacting the terrorist. In either case, the US government should get a warrant before they spy on me. Also, this executive opinion doesn't just apply to the CIA and the NSA. It applies to the entire executive branch, including law enforcement. Secondly, we seem to have a general disagreement about the intent of the laws regulating the intelligence and law enforcement apparatus of the state. My opinion is that the restrictions placed on these agencies were intentional. They were created by a Congress that was disgusted by the rampant abuse of executive power that occurred during the Nixon administration. They were strengthened when Reagan found loopholes in those restrictions. As such, I don't think its Constitutionally valid for the President to unilaterally ignore those restrictions. Yes, I'm aware of the use of force resolution that was passed shortly following the Sept. 11th attack. However, I don't think the language contained therein represented a rollback of over 30 years of legislative history. If it is really necessary for the intelligence agencies to have these unprecedented powers, then they shouldn't be hesitant in presenting their case before Congress. --Rohit Patnaik On Fri, Nov 6, 2009 at 11:42 PM, Paul Schmehl pschmehl_li...@tx.rr.comwrote: --On November 6, 2009 10:10:56 PM -0600 Rohit Patnaik quanti...@gmail.com wrote: If it is so clear that a US citizen is involved in terrorism and is communicating with terrorists beyond our borders, then why is it so hard for the NSA, CIA, FBI or Homeland Security to get a warrant? First of all, the NSA and CIA don't pursue criminal cases against US persons. That's the job of law enforcement. The NSA is a military agency. Their job is to protect the US against its enemies by providing the military with intelligence that helps in planning and the conduct of operations. The CIA is a civilian agency tasked with the job of gathering information about what other countries are doing, both friends and enemies. Homeland Security's job is, well, who the hell knows? It's a huge ponderous agency that, in my view, represents a much greater threat to us than the NSA or CIA. But your question reveals a view of the issue that doesn't align with the facts. The NSA isn't listening to US citizens' communications to detect any communications with terrorists. They're listening to terrorists' communications which sometimes are to US citizens. When that happens, of course the NSA is going to intercept to determine if it's an innocent call or something more. After all, its not like they can claim that there wasn't time to get a warrant - the pre-existing law allowed them to put in expedited requests for warrants after the actual wiretap started, in addition to allowing continued use of wiretaps while the warrant is being considered by the FISA court. Secrecy isn't a concern either - all proceedings of the FISA court are classified. By what reasoning do these security agencies wish to further expand their already considerable powers? The claim that is being made is that the existing law, written in 1978 (before the IBM pc was even born), is unable to cope with the speed and variability of internet communications today. If a terrorist whose communications are being intercepted speaks to someone (email, im, twitter, blog, forum, whatever) and tells them to contact a third party to conduct an operation, the NSA would want to intercept the third party's communications as well. Under existing law (if you believe that FISA applies) they would have 72 hours maximum to submit the necessary paperwork and obtain the necessary approvals to go before the FISA court and obtain a warrant. Otherwise they would have to cease all surveillance. Meanwhile the terrorists aren't going to sit around waiting for the warrant to be issued to continue their plans. It seems to me that it is already far too easy for our national security apparatus to spy on us without our permission or knowledge. The last thing I want is to make such spying even easier for them. They're not spying on us. Intelligence agencies don't spy on us. Law enforcement does. I was involved in (signals) intelligence years ago. I can assure you we could have cared less what US citizens were doing *unless* what they were doing involved working for a foreign power to steal secrets or undermine the US government or similar spy type activities. Sure we could see what everybody was doing. But we only cared about the enemies of our country (at that time the Russians and others). IOW, we were looking away from the US. If you came into our view it was because you were doing something suspicious in the context of foreign power surveillance. Personally I believe the President has inherent Constitutional powers that
Re: [Full-disclosure] How Prosecutors Wiretap Wall Street
On Fri, 06 Nov 2009 23:42:45 CST, Paul Schmehl said: communications as well. Under existing law (if you believe that FISA applies) they would have 72 hours maximum to submit the necessary paperwork and obtain the necessary approvals to go before the FISA court and obtain a warrant. Otherwise they would have to cease all surveillance. Meanwhile the terrorists aren't going to sit around waiting for the warrant to be issued to continue their plans. Actually Paul, you have that bass-ackwards, and it's important. They are allowed to start wiretapping immediately, and then have 72 hours *after they already started listening* to find a FISA court judge and do the paperwork. So yes, the terrorists don't wait for a warrant, and the NSA doesn't need to wait either. So let's see.. You're the NSA. You develop a person of interest. You start wiretapping the crap out of this guy. You now have 72 hours to call the FISA judge you almost certainly have on speed-dial. The request will almost certainly be granted (one source list 18,761 FISA warrants requested from 1978 up to the end of 2004, of which *4* were rejected - but then granted after modification). But even *that* is apparently too onerous. The only reasonable conclusion is that you wanted to wiretap people that even the fairly lenient FISA rules wouldn't get you a warrant. And that's important, because the entire reason the FISA court was created in 1978 in the *first* place was because Nixon got caught using government agencies to illegally spy on political enemies and activists. pgpziTvzElQus.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] How Prosecutors Wiretap Wall Street
--On November 7, 2009 11:20:31 AM -0600 Rohit Patnaik quanti...@gmail.com wrote: The direction of the association doesn't matter. It doesn't matter if the terrorist is contacting me, or if I'm contacting the terrorist. In either case, the US government should get a warrant before they spy on me. Why? If they were pursuing criminal charges against you, then, by all means, they should have to comply with all the strictures that protect our rights. But to gather intelligence about what terrorists are up to, even if a US citizen is involved, should not require a warrant. Intelligence works best in a world of secrecy. The more people that are aware of what's going on, the higher the likelihood is that the persons being monitored will find out and change their operations. The problem is that the lines have blurred because of technological advances. So you have the dichotomy of the need to know what the enemy is up to juxtaposed against the need to protect citizens from an out of control government. I believe the line should be drawn clearly between information gathering and pursuit of criminal charges. Other believe differently. Also, this executive opinion doesn't just apply to the CIA and the NSA. It applies to the entire executive branch, including law enforcement. Huh? How do you know that? Have you seen the Executive Order? I've looked for it in the Presidential Archives. It's not there. Secondly, we seem to have a general disagreement about the intent of the laws regulating the intelligence and law enforcement apparatus of the state. My opinion is that the restrictions placed on these agencies were intentional. They were created by a Congress that was disgusted by the rampant abuse of executive power that occurred during the Nixon administration. That is correct. The Nixon administration was using the excuse of national security to spy on domestic activists, claiming they were a threat to national security. FISA was created to insert the courts into the process and prevent spying on US citizens without a warrant. But even when FISA was created, Congress noted that the law was not designed to infringe on the President's Constitutional powers to conduct foreign agent surveillance without a warrant. They were strengthened when Reagan found loopholes in those restrictions. As such, I don't think its Constitutionally valid for the President to unilaterally ignore those restrictions. Yes, I'm aware of the use of force resolution that was passed shortly following the Sept. 11th attack. However, I don't think the language contained therein represented a rollback of over 30 years of legislative history. If it is really necessary for the intelligence agencies to have these unprecedented powers, then they shouldn't be hesitant in presenting their case before Congress. There are two schools of thought. One says the Executive should ask Congress to change the laws to make the job easier to do. The other says the Executive's inherent powers make that unnecessary. FISA, if interpreted to require warrants for all surveillance of US citizens, even traitors working for the enemy, may well be an unconstitutional intrusion on the Executive branch's powers. If challenged in court, it might even be struck down as overly broad. Or the courts could clarify exactly where the line is drawn. I don't think the program rolled back 30 years of legislation as some have argued. I think it chose to interpret the Executive's powers as including the ability to monitor communications of the enemy, even when those communications crossed our borders, without having to engage the ponderous legal system and all the reams of paperwork that requires. FISA was designed before the age of transcontinental computer transmissions and never envisioned a scenario where the enemy's communications would be carried on circuits within the US. In fact FISA didn't even address individual actors but only nation states. The issues are complex, and they should be discussed without emotion or political rhetoric and unfounded charges that cloud the waters. And one must always keep in mind that we're talking about a military agency trying to track what our enemies are doing, not a domestic law enforcement agency trying to convict citizens of a crime. Paul Schmehl, If it isn't already obvious, my opinions are my own and not those of my employer. ** WARNING: Check the headers before replying ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] How Prosecutors Wiretap Wall Street
--On November 7, 2009 11:24:55 AM -0600 valdis.kletni...@vt.edu wrote: On Fri, 06 Nov 2009 23:42:45 CST, Paul Schmehl said: communications as well. Under existing law (if you believe that FISA applies) they would have 72 hours maximum to submit the necessary paperwork and obtain the necessary approvals to go before the FISA court and obtain a warrant. Otherwise they would have to cease all surveillance. Meanwhile the terrorists aren't going to sit around waiting for the warrant to be issued to continue their plans. Actually Paul, you have that bass-ackwards, and it's important. No, actually I don't. I just did a lousy job of wording it. They are allowed to start wiretapping immediately, and then have 72 hours *after they already started listening* to find a FISA court judge and do the paperwork. So yes, the terrorists don't wait for a warrant, and the NSA doesn't need to wait either. That's only true if they can get the paperwork done and obtain the warrant within 72 hours. Otherwise, at the 72 hour mark all monitoring must cease. And guess who knows that? We don't exactly keep our operational strictures secret, you know. And to think that terrorists aren't aware of the rules within which we operate is to display profound ignorance. They have taken clear advantage of our restrictive Rules of Engagement in Iraq and Afghanistan to inflict more casualties on us than we might otherwise have suffered. So let's see.. You're the NSA. You develop a person of interest. You start wiretapping the crap out of this guy. You now have 72 hours to call the FISA judge you almost certainly have on speed-dial. The request will almost certainly be granted (one source list 18,761 FISA warrants requested from 1978 up to the end of 2004, of which *4* were rejected - but then granted after modification). From what I've read getting a warrant in 72 hours is almost impossible. Remember they first have to gather sufficient data to convince a judge that they have sufficient probable cause to conduct the surveillance. And they have to do that separately for every device the terrorist might use. (That's been changed now, but even that some of the privacy advocates are opposed to.) Then they have to put a legal brief together, obtain the Attorney General's approval and signature and then contact the court for the warrant. Then the court needs to read the brief, and if the judge has questions, they must obtain the answers to those before they can get the warrant. It's not quite the same as dropping by Human Resources to pick up a copy of your Benefits Handbook, as you imply. But even *that* is apparently too onerous. The only reasonable conclusion is that you wanted to wiretap people that even the fairly lenient FISA rules wouldn't get you a warrant. And that's important, because the entire reason the FISA court was created in 1978 in the *first* place was because Nixon got caught using government agencies to illegally spy on political enemies and activists. Yes - political enemies and activists - not terrorists. It seems particularly peculiar to me that people get all hot and bothered about this issue given that a plausible scenario has a terrorist in Pakistan contacting a party in the United States (sleeper cell? lone actor?) who may or may not be a US person, and that the intent of the monitoring is to find out what they're doing or planning to do so that we can prevent terrorist acts, not to convict US persons of a crime. As I've pointed out now several times, it's analogous to people that get all hot and bothered by the fact that admins have access to the data on their computers. You, of all people, know what a bogus concern that is. Admins could care less about the data on your computer, much less have the time to go rummaging around through all that data looking for something interesting. They just wish you quit getting your computer infected all the time. Paul Schmehl, If it isn't already obvious, my opinions are my own and not those of my employer. ** WARNING: Check the headers before replying ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Linux 2.6.x fs/pipe.c local root exploit (CVE-2009-3547)
For those who were not yet aware, there is at least 3 public exploits
since 11/05/2009 for CVE-2009-3547 targeting *all* linux kernels from
2.6.0 to 2.6.31 included. Since spender and fotis have already release
their own, there is not need for us to keep this on our hd.
ImpelDown.c is a poc trying to exploit null ptr dereference in fs/pipe.c
for *all* linux kernel from 2.6.0 to 2.6.31 and ImpelDown-2.6.31only.c
target only linux kernel version 2.6.31 (tested and approuved with
mmap_min_addr at 0).
If you were writing your own, you have already noticed that there is a
subtle difference in the way you can own kernels 2.6.0 up to 2.6.10 and
kernels 2.6.11 up to 2.6.31: in the first one the null ptr deref leads
to an arbitrary write to everywhere in the kernel since you have control
over the destination address of
linux2.6.9/fs/pipe.c
...
219if (pipe_iov_copy_from_user(pipebuf, iov, chars)) {
...
In such case, we try to exploit this by overwriting and old and obsolete
syscall address in the sys_call_table by our privilege escalator function
address (hehe old school trickz are always the best).
In kernels 2.6.11 up to 2.6.31, exploitation simply resume in mapping the
correct
struct pipe_inode_info at NULL and the kernel will call a fptr under our control
at inode-i_pipe-bufs[1-16].ops-something()
You can find exploits at
http://www.vxhell.org/~teach/exploits/ImpelDown.c
and
http://www.vxhell.org/~teach/exploits/ImpelDown-2.6.31only.c
The first one wasn't tested but the second would work for the given kernel
(according to your mmap_min_addr)
We highly recommand to apply grsecurity patch ([1]) since UDEREF will preserve
you from all this bug class,
or at least have a kernel which correctly implement mmap_min_addr, but
Julien and Tavis [2] have already showed you how this can be easily bypassed.
Regards
[1] http://grsecurity.net
[2] http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html
te...@blackpearl$ head -n 18 exploits/ImpelDown-2.6.31only.c
/**
*.:: Impel Down ::.
*
* Linux 2.6.x fs/pipe.c local kernel root(kit?) exploit (x86)
* by teach xipe
*Greetz goes to all our mates from #nibbles, #oldschool and
#carib0u
*(hehe guyz, we would probably be high profile and mediatised el8
if we
*lost less time on trolling all day long, but we LOVE IT :)))
*Special thanks to Ivanlef0u, j0rn pouik for being such amazing
(but i
*promise ivan, one day i'll kill u :p)
*
* (C) COPYRIGHT teach xipe, 2009
* All Rights Reserved
*
* te...@vxhell.org
* x...@vxhell.org
*
***/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SECURITY] [DSA 1930-1] New drupal6 packages fix several vulnerabilities
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1930-1 secur...@debian.org http://www.debian.org/security/ Steffen Joeris November 07, 2009 http://www.debian.org/security/faq - Package: drupal6 Vulnerability : several vulnerabilities Problem type : remote Debian-specific: no CVE IDs: CVE-2009-2372 CVE-2009-2373 CVE-2009-2374 Debian Bug : 535435 547140 Several vulnerabilities have been found in drupal6, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2372 Gerhard Killesreiter discovered a flaw in the way user signatures are handled. It is possible for a user to inject arbitrary code via a crafted user signature. (SA-CORE-2009-007) CVE-2009-2373 Mark Piper, Sven Herrmann and Brandon Knight discovered a cross-site scripting issue in the forum module, which could be exploited via the tid parameter. (SA-CORE-2009-007) CVE-2009-2374 Sumit Datta discovered that certain drupal6 pages leak sensible information such as user credentials. (SA-CORE-2009-007) Several design flaws in the OpenID module have been fixed, which could lead to cross-site request forgeries or privilege escalations. Also, the file upload function does not process all extensions properly leading to the possible execution of arbitrary code. (SA-CORE-2009-008) For the stable distribution (lenny), these problems have been fixed in version 6.6-3lenny3. The oldstable distribution (etch) does not contain drupal6. For the testing distribution (squeeze) and the unstable distribution (sid), these problems have been fixed in version 6.14-1. We recommend that you upgrade your drupal6 packages. Upgrade instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 5.0 alias lenny - Debian (stable) - --- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny3.dsc Size/MD5 checksum: 1130 489d56336053311b1ee24aaf17f41ffb http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny3.diff.gz Size/MD5 checksum:24870 d70dfad8a6f211cb9dd62e071e5ddfd9 http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6.orig.tar.gz Size/MD5 checksum: 1071507 caaa55d1990b34dee48f5047ce98e2bb Architecture independent packages: http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny3_all.deb Size/MD5 checksum: 1088258 6162b6933d636065c6a07e6f6199c7df These files will probably be moved into the stable distribution on its next update. - - For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-annou...@lists.debian.org Package info: `apt-cache show pkg' and http://packages.debian.org/pkg -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAkr0wzIACgkQ62zWxYk/rQegCACfaCVMO8lrhfH/57iPLCgFOkp5 5ykAnifSZR4vet+YNDY3Z6vOiTSgUe/0 =o5XE -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] How Prosecutors Wiretap Wall Street
But to gather intelligence about what terrorists are up to, even if a US citizen is involved, should not require a warrant. This is all well and good, until the definition of terrorist is changed and you become labeled a terrorist because your reason is suddenly counterproductive to someone else's opinion. You must apply the warrant requirement consistently. Otherwise, when interpretation of the word terrorist changes, it affects the meaning of the law. And call me crazy, but I'm just not willing to assume that someone won't abuse the power of being able to surveil US citizens and do exactly what Nixon did, spy on their competition/detractors. Surely you can admit that some people do things that they wouldn't normally do when big money and big power are involved. After all, Those who cannot learn from history are doomed to repeat it. Don't be so naive to think it can't happen again. Intelligence works best in a world of secrecy. So does deception. Significantly more so, in fact. As I've pointed out now several times, it's analogous to people that get all hot and bothered by the fact that admins have access to the data on their computers. Yes, but that computer probably doesn't belong to me but instead to my employer. If it belongs to me, you better have a policy that prevents me from using it at work, and/or a login disclaimer informing me of your right to monitor what I do if I connect to your network. If not, you better damn well have a warrant if you want to take a look at my property. And as far as I know, there's no login disclaimer on the interwebs that allows the government to monitor what I do on that network, nor on the telephone, or my mobile phone contract. From what I've read getting a warrant in 72 hours is almost impossible. Ahah! Now we're on to something. Here's an idea. Make it easier to get that warrant when you need it. Improve the process, so that when requested, a warrant can be turned around in hours, not days. Don't remove the requirement altogether. That's simply inviting trouble. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] How to receive SPAM mail
If you want to be spammed, join full-disclosure. 2009/11/7 Michael Holstein michael.holst...@csuohio.edu I have a SPAM filter and virus firewall testing. So, I want to get the real SPAM is sent to a specific email address. What better way is there anything? I had to do a similar thing when doing a spam-appliance vendor shakedown .. what I did was setup a subdomain eg: test.mycompany.com and then create email IDs within that subdomain that had valid mailboxes eg: b...@test.mycompany.com, su...@test.mycompany.com, etc. and then I used Google to search for free offers and work from home, etc. and entered those IDs on about 100 different sites. There's tons of sites out there that you can sign-up for hundreds of free offers and whatnot. Within days I was getting hundreds of messages per day for each ID. Note .. they have to be valid mailboxes because you frequently need to reply to the activation email to make them work. You could setup a little script to wget any links in emails received and do -O /dev/null with the results .. but I just had all the accounts configured on a test machine in thunderbird so I could view what came through and the resulting junk summary emails. The advantage of doing it as a subdomain (or just register another test domain) is that you can make the traffic go away entirely by deleting the DNS record. Regards, Michael Holstein Cleveland State University ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
