Joe Feise | 1 Oct 2006 01:12
Favicon
Gravatar

Re: end of the interent ?

Peter Dawson wrote on 09/29/06 13:10:

> I had to share this wierd err
> 
> http://www.google.com/reader/next?go=noitems

There are a bunch more of these kinds of pages. The first one I encountered, ca.
1998, was on opaldata.com (now defunct):
http://web.archive.org/web/19981202171631/http://opaldata.com/the_end/index.html

-Joe

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

マグロ原子 | 1 Oct 2006 02:33
Picon

Re: Stealing Search Engine Queries with JavaScript

Do a barrel roll.

Nyoro~n
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
マグロ原子 | 1 Oct 2006 02:26
Picon

Re: Stealing Search Engine Queries with JavaScript

Doesn't work in Opera (9.02) or maybe I'm doing something wrong.

Nyoro~n

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Tyop? | 1 Oct 2006 02:58
Eiji James Yoshida | 1 Oct 2006 06:00
Picon

Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]

+ Title:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Internet Information Services UTF-7 XSS Vulnerability
[http://www.geocities.jp/ptrs_sec/advisory09e.html]

+ Date:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 October 2006

+ Author:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Eiji James Yoshida [ptrs-ejy <at> bp.iij4u.or.jp]

+ Risk:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Medium

+ Vulnerable:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Internet Information Services

+ Overview:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using UTF-7 encoded URLs, IIS may return user specified content to the browser. 

If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it
will set the charset
encoding to UTF-7 automatically, unless a certain charset encoding is already enforced.

+ Proof of concept:
(Continue reading)

William Knowles | 1 Oct 2006 07:45

Re: Security Rss Feeds

On September 30, 2006 10:21:51 PM +0530 men in black helicopters
working for the Greys forced crazy frog crazy frog
<i.m.crazy.frog <at> gmail.com> to write:

> Hi,
>
> Please share various security related rss feeds you read daily.
>
> Thanks,
> -CF

Save the trouble of looking at a number of security news feeds, let 
InfoSec News do all heavy lifting for you! http://www.infosecnews.org/

Cheers!

William Knowles
wk <at> c4i.org

*==============================================================*
"Communications without intelligence is noise;  Intelligence
without communications is irrelevant." Gen Alfred. M. Gray, USMC
================================================================
C4I.org - Computer Security, & Intelligence - http://www.c4i.org
*==============================================================*

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
(Continue reading)

bugtraq | 1 Oct 2006 02:05

Re: Security Rss Feeds

Add http://www.cgisecurity.com/index.rss as well ;p
-z

> 
> --===============1915392881==
> Content-Type: multipart/alternative; 
> 	boundary="----=_Part_36651_2419662.1159650305531"
> 
> ------=_Part_36651_2419662.1159650305531
> Content-Type: text/plain; charset=UTF-8; format=flowed
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> Add two more to that list
> 
> http://portal.spidynamics.com/blogs/msutton/rss.aspx
> http://ha.ckers.org/blog/feed/
> 
> Paul, thanks for the new add's to me reader :)-

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

securityproof | 1 Oct 2006 18:06
Picon

"POC 2006" by Korean hackers

The first international hacking & security conference by Korean hackers will be held
in November 16 ~ 17. The conference is "POC 2006". POC means 'power of community'.
We believe that the power of community can make the world safer.
"POC 2006" hates just theoretical discussion. "POC 2006" concentrates on technical
and creative discussion and will show real hacking and security process.
 
There are two sections in "POC 2006". One is 'Open Source' section. Through this,
new hacking and security tools will be introduced.  The other is technical presentation,
in which new hacking and security techniques will be opened to the world. You won't be
disappointed at them. And you can have a chance to meet brilliant Korean hackers
who are not well-known to the world.
 
 
The keynote speaker is Richard Stallman. He will speak "Copyright vs Community in the
Age of Computer Networks".
 

Technical section speakers and their topics are as follows:
 
* Jerry, "Virtualization Techinque for the Security of Web and Application"
 
* Grugq, "VoIP Hacking: "
 
* Han Chang kyu, "The Way and Process to Analyze Polymorphic Virus"
 
* Ryan, "ActiveX Control and Web Application Security"
 
* Loafer, "The New Way to Protect from Runtime Format String Attacks through the Modifying of printf()  functions Call Code"
 
* wooyaggo, "New Kernel Exploitation Technique on Linux 2.6.x"
 
* George Neville-Neil, "Network Protocol Security Testing with the Packet Construction"
 
* Xpl017Elz, "The New Ways to Attack Applications of Operating Systems under Execshield"
 
* Lukas Grunwald, "Attacking RFID Access-, Identify- and Ticketing- Cards"
 
* Secret, "Hacking the Automobile Electronic Control Unit"
 
* SunBing, "How to Implement a Virtual Machine Based Rootkit"
 
 
 
You can check the detailed information in "http://www.powerofcommunity.net".
 
All the speakers will publish Phrack style's articles.
If you register and visit our con, you can have a book which contains the detailed articles of
the topics. The book will be given only on-site.
 
 
 
 

Kind Regards,
 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
J. Oquendo | 1 Oct 2006 19:28
Favicon

Truths in "Truth in Caller ID Act"

So the United States government wants to pass the "Truth in Caller ID" act. Humorously it will do little do
deter criminals from spoofing their caller ID and scamming innocent victims. Here is the rule/law
followed by why it will fail:

"It shall be unlawful for any person within the United States, in connection with any telecommunications
service or VOIP service, to cause any caller identification service to transmit misleading or
inaccurate caller identification information, with the intent to defraud or cause harm."

Re-read it a few times and let some common sense kick in. "unlawful for any person within the United States,
in connection with any telecommunications service or VOIP service, to cause any caller identification
service to transmit misleading or inaccurate caller identification information" What in this bill
exactly deters someone from abroad to continue their activities? Firstly they're not bound by U.S. laws,
secondly if their servers are abroad those servers are in their lawful means to do what is legally
appropriate for their location.

Now argumentatively how will the United States seek to prosecute say a telemarketer from using a service
abroad to traverse back into the U.S.? Let's re-read the letter of the law again shall we? "unlawful for any
person within the United States, etc., etc., to cause any caller identification, etc., etc." So how does
caller ID change, is it cause by the telemarketer, the server sending out the caller ID information, or the
provider of that server. Obviously the telemarketer led the server to change the information, but
ultimately the provider dished out the number, hence the provider being the true culprit.

The more I read about this law/rule/prohibition, the more I scratch my head at it.

So let's now see how the government intends on tracking someone shall we?

CallerIDBusterFoobar.com is a server located in Moscow. They're hosted there, their provider is their,
their uplink is in Russia, etc. Joe Smith is a scumbag thief interested in stealing the credit card
information of a "few good men". He lives in Boondock Arizona and spends much too much time thinking up
scams. He signs up for an account at CallerIDBusterFoobar.com, assigns 800-DISCOVER as his caller ID and
proceeds to scam countless people out of their information. With this information he sets up fradulent
drops and pickups somewhere in Moldovia.

How will U.S. authorities track him down? They won't. They don't have access to the servers in Russia for
starters, secondly how many people are reporting these crimes. Alright, let's be fair for a moment,
someone at Discover "discovers" that the call actually originated from Russia. So what? Unless the
foreign country is cooperating with U.S. authorities, there is little the United States government with
all their so called legislation would be able to do.

Now let's take it a step further, Joe Smith decided to use Privoxy with a WiFi phone from an open network. He
managed to steal a VoIP account while scanning a class A for port 5060 and leveraged someone's
information. He always has used Tor and Privoxy on his personal distro of Linux on a CD so he knows that there
will be no residue from his crimes due to him using this CD on this machine so he is scott free technologically.

How does the United States intend on stopping him again? I get it now, since the United States government in
all of their mighty wisdom is passing this bill it is only obvious that criminals are going to respect U.S.
laws, I mean after all those in government follow their own laws so why shouldn't a criminal.

Comments, criticism?

--

-- 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil infiltrated . net http://www.infiltrated.net

"How a man plays the game shows something of his
character - how he loses shows all" - Mr. Luckey 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

J. Oquendo | 1 Oct 2006 20:41
Favicon

Re: Truths in "Truth in Caller ID Act"

Valdis.Kletnieks <at> vt.edu wrote:

> You mis-read the legalese.
>

"It shall be unlawful for any person within the United States" 

Define within the United States. The person, the server, the provider or all three. I don't believe it's
misread it's to the letter of the law. So again step by step...

"It shall be unlawful for any person within the United States, in connection with any telecommunications
service or VOIP service..."

1) Teleco/VoIP service is out of bounds here. 2) The User who initiated the command is logged from an address
somewhere over the rainbow (Tor+Privoxy). 3) "within the United States" which? The person, or the
telco/VoIP provider? Does it have to be both - person and provider. Sounds broad to me.

Can't be single sided here. So I decide to offer a service to say rape victims who want to remain anonymous, a
victim decides to use "Jane Smith" <2035551212>, she is calling from say the British Virgin Islands where
she was raped by a congressman. She doesn't want her identity known, but would like counseling over the
phone. 1) She is in the British Virgin Islands so technically she is not breaking the law. 2) Me being the
provider, I didn't initiate the spoof, I provided a service. Should I be held accountable for upholding
the right to privacy? 3) Sure caller ID blocking could have been used, it still could be traced.

Let's take the case of someone blowing the whistle on government corruption. History has shown their life
will be ruined. This is a great avenue worry free to make a report yet at the same time if I decided to set my
caller ID as that of the White House, I'm sure I can con a reporter to report something bogus. Dual edged
sword. What will be next outlawing telco service unless it passes through DCS100 along with a photo and
fingerprint at Fort Meade.  

--

-- 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil infiltrated . net http://www.infiltrated.net

"How a man plays the game shows something of his
character - how he loses shows all" - Mr. Luckey 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Gmane