Re: [Full-disclosure] FFSpy, a firefox malware PoC

From: saphex saphex_at_gmail.com Date: Wed, 20 May 2009 01:42:16 +0100 I think this is interesting, http://myf00.net/?p=18 So, how does someone manage to edit the overlay file? Are they going to use some javascript from a malicious website to edit the overlay file of an addon? Or are they

[Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

ABSTRACT Nowadays most of the malware applications are either packed or protected. This techniques are applied especially to evade signature based detectors and also to complicate the job of reverse engineers or security analysts. The time one must spend on unpacking or decrypting malware

Re: [Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

Hi Piotr, Any information with regards to how MMMBoB performs when trying to unpack a bit more obfuscated/aggressive packers like Themida / VMprotect ? On a side note: I see often that some generic unpackers are rarely cited/referenced, although they are interesting and perform

Re: [Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

Hi Piotr, Hey, Any information with regards to how MMMBoB performs when trying to unpack a bit more obfuscated/aggressive packers like Themida / VMprotect ? As stated in section 7 (Limitations) my unpacker will not be much help when unpacking a virtual machine based protector like Themida

Re: [Full-disclosure] PAPER: Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs

Hi, - RL!unpack http://ap0x.jezgra.net/unpackers.html Second download entry on that page : RL!Unpack -- http://blog.zoller.lu Thierry Zoller ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-disclosure] FFSpy, a firefox malware PoC

On Mon, May 25, 2009 at 8:26 PM, saphex sap...@gmail.com wrote: This isn't about making the user install a malware add-on. It's about gaining access to the system trough an exploit, or physical access, modify an existing add-on with your code. And Firefox wont even notice. Instead of

[Full-disclosure] Soulseek * P2P Remote Distributed Search Code Execution

= - Release date: May 24th, 2009 - Discovered by: Laurent Gaffié - Severity: critical = I. VULNERABILITY - Soulseek 157 NS * 156.* Remote Distributed Search Code Execution II.

[Full-disclosure] [ GLSA 200905-07 ] Pidgin: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200905-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] AusCERT 2009 conference - audio recordings

For anyone who missed the AusCERT 2009 conference, the recorded conference audio is online this year! The conference audio http://risky.biz/netcasts/rb2 The AusCERT 2009 conference schedule http://conference.auscert.org.au/conf2009/program_schedule.html

[Full-disclosure] Arcade Trade Script XSS

Original advisory: http://www.davidsopas.com/2009/05/25/arcade-trade-script-xss/ Arcade Trade Script is a full arcade site CMS (Content Management System) with easy customization and advanced traffic trading system built in. With ATS you will hardly ever have to FTP anything. Almost all files,

[Full-disclosure] Web App Version detection using fingerprinting

Hi List, I just finished a new article showing some ideas to detect the version of a web application by using file fingerprinting: http://sucuri.net/?page=docstitle=webapp-version-detection Thanks, --dd ___ Full-Disclosure - We believe in it.

Re: [Full-disclosure] FFSpy, a firefox malware PoC

Are we missing DNS stuff ? Are plugins signed ? is NoScript being used by end users ? Maybe an evilgrade plugin is comming []s Fosforo On Mon, May 25, 2009 at 3:24 PM, FUDder Guy fudder...@gmail.com wrote: On Mon, May 25, 2009 at 8:26 PM, saphex sap...@gmail.com wrote: This isn't about

Re: [Full-disclosure] Soulseek * P2P Remote Distributed Search Code Execution

Oh so you have a blog ... http://g-laurent.blogspot.com/ 2009/5/25 laurent gaffie laurent.gaf...@gmail.com = - Release date: May 24th, 2009 - Discovered by: Laurent Gaffié - Severity: critical = I.