full-disclosure - Re: Ubuntu 11.10 now unsecure by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 20 Nov 2011 08:16:08 +1100
From: xD 0x41 <secn3t@...il.com>
To: Johan Nestaas <johannestaas@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Ubuntu 11.10 now unsecure by default

Ok well how about lets put it simply...

MS have had a Guest user, i believe it is MSUSER***  since what, 1970
? I know locally, i could possibly manipulate registry keys and make
this user 'login' ready... but at this point i have local ax, so a. we
know ms guest user cannot be touched remotely , or is someone putting
up theyre own 0day wich can remotely change ms's inbuilt user... (as i
thought, no one will answer that bit... there is no way to exploit
it).

So if we compare these two os, one would be classed as crappy
(windows), one would be classed as entry-level... now the reason why
ubuntu has this look is simple, you have 3 versions of one OS, Kubuntu
Xubuntu and ubuntu , all split into server-client categorys, and these
are totally different configurations... so stop trying to say Ubuntu
is PRO, it aint, it is handed out on magazines, like many smaller os
are, and then you have places like APC mag, doing direct changeovers
from windows to ubuntu, was a 2010 issue wich actually did this, and
yea, i could prolly find exactly what mag, but i dont think that is
alone...
Ubuntu is portrayed as entry level by its owners, and then having a
thousand local xploits, and people like the e-caliber , making addons
for ubuntu, i would say the popularity of it, is growing less... so
dont worry, im sure there will b less exploitations of Ubuntu..just
not this year :)
have a nice day, m$ r00l users.
xd

On 19 November 2011 07:04, Johan Nestaas <johannestaas@...il.com> wrote:
> Sometimes it bothers me that everyone says Ubuntu is made for newbs and that
> you're expected to switch distros as soon as you know enough to do it.
> I worked as an intern with some folks who developed 802.11s, secure mesh
> networking, and they mostly used Ubuntu. I find it extremely fast to
> install, set up IDE's, and get a dev workstation up and running. I've never
> had an easier time installing a printer. Sure, that helps newbies, but it
> also makes work happen quick. If any problems come up, you can't beat their
> user base and forums.
> I love the freedom of choice, and I switch it up every few months to see how
> the other distros are doing, but generally I'm back to ubuntu in a few
> weeks.
> Also, maybe I'm wrong about this and there are other reasons, but the newest
> backtrack is ubuntu based, and they always mention that their distro is
> meant for experienced linux users (and more of a toolkit than anything).
> I don't know, I guess I feel like ubuntu should be cut some slack for being
> newb friendly. It's not such a bad thing.
>
> On Fri, Nov 18, 2011 at 11:32 AM, Olivier <feuille@...ibox.fr> wrote:
>>
>> On 11/18/2011 03:10 PM, Dan Kaminsky wrote:
>> >
>> >
>> > On Fri, Nov 18, 2011 at 5:01 AM, <Valdis.Kletnieks@...edu
>> > <mailto:Valdis.Kletnieks@...edu>> wrote:
>> >
>> >     On Thu, 17 Nov 2011 15:53:41 CST, C de-Avillez said:
>> >
>> >     > There is no guest account on an Ubuntu server, so at least there
>> >     > this is not a real/perceived risk.
>> >
>> >     And nobody's *ever* installed the desktop version on a server
>> >     because they didn't
>> >     know any better, especially from Ubuntu's target audience.  Gotcha.
>> > ;)
>> >
>> >
>> > OK, seriously.  If you're sitting in front of a machine that's
>> > presenting you a login prompt, you've got enough privileges to insert a
>> > bootable USB/CD and pull all the data / make yourself an account
>> > (FDE/Bios PW notwithstanding).
>>
>> My disk is password protected, and the whole system (except /boot) is
>> encrypted. Ubuntu guest account is definitively the best way to hack a
>> running laptop (or workstation).
>>
>> --
>> Olivier
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/