full-disclosure - First case of Cyber Rolling?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4b6ee9310805102003q374edb1amee7387938f1957eb@mail.gmail.com>
Date: Sun, 11 May 2008 04:03:19 +0100
From: n3td3v <xploitable@...il.com>
To: full-disclosure@...ts.grok.org.uk, n3td3v <n3td3v@...glegroups.com>
Subject: First case of Cyber Rolling?

Scaring people with fullScreen

    * Posted by bunnyhero
    * 2008 May 10

When Flash Player 9 goes into full screen mode, it pops up a little
security message that tells the user how to exit full screen mode. It
appears as white text on a semi-transparent black background so it is
generally always visible (which is good). Still, I wondered if it
could be obscured.

The message is always on top, so it is impossible to draw over it. But
what if we tried distracting the user from the actual security
message?

Here's a silly test:

Of course, you can press Esc (or alt+tab to another window) to escape.

UPDATE: I have made the source code available, warts and all, under a
ZLib licence. Share and enjoy :)

http://www.bunnyhero.org/2008/05/10/scaring-people-with-fullscreen/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/