full-disclosure - (no subject)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: blaqhatz at webmail.co.za (l33t guy)
Subject: (no subject)

-----BEGIN PPP SIGNED MESSAGE-----
Hash: SH1T

======================================================================
==
--blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz
--
----------------------------------------------------------------------
--

blaqhatz!@#!@%!@#! ADVISORY blaqhatz!@#!@%!@#!

blaqhatz advisory #1
date: third day of march, in the year of our lord
 two thousand and three (03/03/03)
why today? coz we love 303, oh! oh! oh!
http://www.only4jewz.net/efil4zaggin/blaqhatz.advisory.20030303

blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-
blaq-b
l
    l
a      ,-.        ||||||  ||     //\\   /|||\  ||  ||  //\\ ||||||
|||||/  a
q     /`-'\       ||   )) ||    //  \\ ||   || ||  || //  \\  ||
//   q
|  .-/     \-,    ||||<<  ||    /||||\ ||   || |||||| /||||\  ||
//    |
b (  `.___.'  )   ||   )) ||    ||  || ||   || ||  || ||  ||  ||    //
    b
l  `. _____ .'    ||||||  ||||| ||  ||  \|||\\ ||  || ||  ||  ||
/|||||  l
a                                               \\
    a
q-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-blaq-bla
q-blaq



PRODUCT: PASTEL ACCOUNTING v6.0-6.12 (confirmed)
         earlier versions (suspected)


1. BACKGROUND

Pastel Accounting is an accounting package widely used by small
business entities in countries in Africa, Europe, the Middle and Far
East and Australasia. The Pastel product includes a facility for
secure access to specific modules within the product.

Further information is available @ http://www.pastel.com


2. PROBLEM DESCRIPTION

The security system and application controls used by the Pastel
product are broken.

All user and security information is stored with the file
"ACCUSER.DAT" within the chosen client folder. No data is encrypted
with any information within this file, nor is any version/validity
checking done against this file.

As such, it is possible to replace the ACCUSER.DAT file with one from
a different set of accounts, with known usernames and passwords,
access and modify the data stored within a specific set of accounts
and then restore the original file, thus providing no concrete on by
whom the files were modified.

In some contexts, it would even be possible to falsify records in an
attempt to 'frame' a particular user with changes.

Additionally, some preliminary testing on the accuser.dat file
displayed an
alarming correlation between certain sections of the file and the
passwords
chosen. For example, given a group of users with chosen passwords
"AAAAAAAA", "BBBBBBBB", "CCCCCCCC", "DDDDDDDD", and "ABCDEFGH", the
following strings
were found in the file: "ssssssss", "tttttttt", "uuuuuuuu",
"vvvvvvvv", and
"stuvwxyz".

3. IMPACT

Users may not rely on the application level controls implemented by
the Pastel Accounting package.

As no reliance may be placed on applicaton level controls, auditors
must audit around the application.


4. FIX

None as of yet. Vendor notified.

5. WHO ARE BLAQHATZ?
blaqhatz are:

                pheer - pheerless
 - skankyvontrashbag - skankette - nyama_zinto -
 rod-boi - pheered - minibyte - whoot - pofmuis


======================================================================
==
--blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz-ph33r-blaqhatz
--
----------------------------------------------------------------------
--


           !!#@...N blaqhatz t0D4y!!@#


 mailto:eye.am.leet.eye.swear@...qhatz.za.net

telling us who and what you are and with a good reason as to why you
think you're leet enough to join blaqhatz

              Why should I join?

1. Everyone else thinks blaqhatz 0wn.
2. blaqhatz have been interviewed by more international legal
authorities, seen the inside of more networks and more telco's, been
on more television shows, been asked to assist more national
intelligence agencies and skewled more people than any other group.
**blaqhatz are *the* authority on modern information security** 3.
We're nice people. 4. You can get  sekret, blaqhatz warez, for free,
just for applying. 5. You value security and 0day. You believe in
freedom of information. You believe in helping others help themselves.
blaqhatz will help you act to make your beliefs a reality.
6. We're only accepting new member applications until the 9th of the
3rd, 2000 & 3,
on a first come, first served basis. All members will need to be
approved by the
elite blaqhatz board.

Big ups, shout outs and serious ruspek go to:
~el8, BoW, #havok, phrack.org, kouriers 4 christ, #hack krew, oldskewl
efnet #phreakGER, effkay, arclight, maelstrom, ganja_man, scavenger,
mindbinder, raw liquid, tonedef, y0y0y0 and c0.

r0qin' 1t iN 2w0-d0ubl3-0h-thr33!!!@#


-----BEGIN PPP SIGNATURE-----
Version: PPP 3.0.3 d34dc0d35f4dd34dc0d35f4dd34dc0d35f4dd34dc0d35f4d
d01337c0d135d01337c0d135d01337c0d135d01337c0d135
-----END PPP SIGNATURE-----
_______________________________________________________________
 http://www.webmail.co.za the South-African free email service

  NetWiseGurus.Com Portal - Your Own Internet Business Today!