full-disclosure - My comments on comodobr.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 24 May 2011 14:58:39 -0700 (PDT)
From: Hgkdfhklj Jdhglkjfdhg <gimmemyfiles@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Cc: "support@...odobr.com" <support@...odobr.com>
Subject: My comments on comodobr.com

    I have to agree with Comodo president and CEO, Melih Abdulhayoglu.

    In fact, anyone that can use sqlmap or pangolin and knows how to google for "filetype:php inurl:prod" could have found that sqli.
    However the same way the security perimeter of the mainframe _should_ be extended to the desktops connected to it, it might be a good idea for resellers and partners to tighten own their own security. further compromise of comodobr.com systems (_if_possible_) could have been a foothold into Comodo's systems.

    Just my 50 cents

    [Edit]
    The db dump was partial because the only thing omitted from the db dump was request logs. Either way, CSR's and client info shouldn't be "readily available" as this.
    No beef with comodobr.com or Comodo, just with companies in the security business that don't take care of their own.
    That's one of the reasons we have been trying to make the internet secure for so long. Some people just don't help.

http://pastebin.com/MFSUdCnk
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/