Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread ACROS Security Lists
Hi Paul, These two changes have been introduced earlier (sometime between April and August). We haven't noticed any mention of them in Microsoft's public documents. Cheers, Mitja -Original Message- From: paul.sz...@sydney.edu.au [mailto:paul.sz...@sydney.edu.au] Sent: Friday,

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Michael Schmidt
Someone’s just not reading the bulletins – Note the term “Remote” – including webdav, so a share that could be fully controlled by the exploiter. At least that is what I am understanding. Updates released on September 13, 2011 Microsoft Security Bulletin MS11-071, Vulnerability in Windows

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Jeffrey Walton
On Thu, Sep 15, 2011 at 7:11 PM, Michael Schmidt mschm...@drugstore.com wrote: Someone’s just not reading the bulletins – Note the term “Remote” – including webdav, so a share that could be fully controlled by the exploiter. At least that is what I am understanding. Updates released on

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Mikhail A. Utin
Mitja, You, unfortunately, did not get it. It is not about Microsoft, it is about you guys who do not make things better but put all you mind in doing things worse. Use common sense in whatever you do. Innovating hacks beyond and above black hats does not really help people being more secure.

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Pedro B
Indeed. The same way people who do not know the difference between you mind and your mind should be shot. common sense? Not very common at all. Sent from my iPhone 4 On 16/09/2011, at 16:06, Mikhail A. Utin mu...@commonwealthcare.org wrote: Mitja, You, unfortunately, did not get it. It is not

[Full-disclosure] understanding the botnet CC..

2011-09-16 Thread RandallM
hi an area that I am basically stupid on is botnets. Not what they are but how they work through IRC as the control center. Not just that but the various modern programs used. I am aware for instance LOIC can be used to connect to an IRC channel.. but, how then does the herder do the job from

Re: [Full-disclosure] understanding the botnet CC..

2011-09-16 Thread Jeffrey Walton
On Fri, Sep 16, 2011 at 11:38 AM, RandallM randa...@fidmail.com wrote: hi an area that I am basically stupid on is botnets. Not what they are but how they work through IRC as the control center. Not just that but the various modern programs used. I am aware for instance LOIC can be used to

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread ACROS Security Lists
Hi Mikhail, Innovating hacks beyond and above black hats does not really help people being more secure. Whether the first part of this statement was meant as a compliment or not, I would give black hats much more credit than that. Whatever we're able to find with our small-scale effort,

Re: [Full-disclosure] understanding the botnet CC..

2011-09-16 Thread Tillmann Werner
an area that I am basically stupid on is botnets. Not what they are but how they work through IRC as the control center. Not just that but the various modern programs used. I am aware for instance LOIC can be used to connect to an IRC channel.. but, how then does the herder do the job from

Re: [Full-disclosure] understanding the botnet CC..

2011-09-16 Thread Valdis . Kletnieks
On Fri, 16 Sep 2011 10:38:16 CDT, RandallM said: hi an area that I am basically stupid on is botnets. Not what they are but how they work through IRC as the control center. Not just that but the various modern programs used. I am aware for instance LOIC can be used to connect to an IRC

Re: [Full-disclosure] Google.com - Open Redirect

2011-09-16 Thread Piotr Duszynski
=== PunBB PHP Forum - Multiple XSS === Affected Software : PunBB PHP Forum Severity : Medium Local/Remote : Remote Author: @drk1wi

[Full-disclosure] PunBB PHP Forum - Multiple XSS

2011-09-16 Thread Piotr Duszynski
=== PunBB PHP Forum - Multiple XSS === Affected Software : PunBB PHP Forum Severity : Medium Local/Remote : Remote Author: @drk1wi

[Full-disclosure] sshtrix - a very fast multithreaded SSHv1 and SSH1v2 login cracker

2011-09-16 Thread Levent Kayan
hello, you can get it from: http://www.noptrix.net/codes.html also, you will find a small description. cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage:

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Stefan Kanthak
Thor (Hammer of God) t...@hammerofgod.com wrote: Would you mind to break the lines of your posts near column 70? From your blog: [ ... ] I would say our self-serving and marketing-oriented minds remain challenged to understand what security really is, but regardless, continue to find ways

Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission

2011-09-16 Thread Thor (Hammer of God)
The interesting part about this type of attack is that the attacker can run a webdav server to run the exploit. This is a normal looking url, not some incredibly obvious UNC path to an SMB share. Yes, like most client-side attacks, it may require some social engineering, hijacking of a domain, and