full-disclosure - 3 new MS patches next week... but none fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: tim-security at sentinelchicken.org (Tim)
Subject: 3 new MS patches next week... but none fix

> Most likely what the guy is selling (or trying to sell) is some sort of
> IDS/network system that grabs the problem packets before they get to the
> server's application layer to do damage. Companies like eEye have been doing
> this for a long time - have a predefined "these packets are within our
> tolerances" baseline and then anything that is outside of it gets squished.
> It is actually a good idea (I think) for any machine publicly exposed. You
> define the traffic you are willing to take including request lengths, etc
> for various ports/protocols and anything outside of that gets dropped and an
> error is generated. Maybe it is a new way to access a new app on the box,
> maybe it is a new attack style. Either way if say that HTTP request is
> composed of more than say x bytes, the http daemon never sees it. 

Based on the link just posted, this is probably along the lines of what
it is they were trying to sell.  I could be wrong, but it still seemed
like this vendor is getting information before the rest of the world.

I think it is a totally lame approach.  The patch distribution problem
has been pretty much solved by other vendors.  We would all sleep better
at night if M$ would just get a clue.  Oh well.

tim