full-disclosure - Re: more rehashes of xss & 'evil gif'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <418a7b2c0808042312m632ce57cu9d4b58012b278262@mail.gmail.com>
Date: Tue, 5 Aug 2008 02:12:22 -0400
From: "raining lulz" <spreadlulzandwar@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: more rehashes of xss & 'evil gif'

Clearly this class of vulnerabilities is nothing short of epic, entirely
new, and truly worth our time and fear.  When combined with the stellar
research and presentation skills of said researchers it meets 3/4
requirements for widespread media cuntbaggery, observe:

1) words that sound new and cool
-->"The attack relies on a new type of hybrid file"

hybrid: hybrid, hmm sort of hydra, sort of like internet super worm of
doom??!! watchout!

2)social networking sites
-->"giving the bad guys access to the victim's Facebook account."

zomgz did someone say facebook? watch out, your teenage whore daughter is
now at risk!

3)moderately not clever acronym
-->"They call this type of file a GIFAR, a contraction of GIF and JAR"

plus it sounds like some sort of mythical beast?!  GIFAR, ROAR!  do you
think they'll have a cool animation for it on their slides? one can only
dream!

wait, what about the 4th requirement?  how about the possibility of anyone
actually being owned? wait, no.

On Tue, Aug 5, 2008 at 1:26 AM, Robert Holgstad <rholgstad@...il.com> wrote:

>
> http://www.infoworld.com/article/08/08/01/A_photo_that_can_steal_your_online_credentials_1.html
>
> seems dan isn't the only press whore around! rebouncing from his embarasing
> post about 'deputy dan' and the matasano blog - whoosh anyone? nate and his
> crew of javascript gurus have whipped up another rehash of an old class of
> bugs that has been used in the wild for a long time. we personally want to
> thank nate for his great work hes done for conferences over the years
> filling up their talking spots with useless crap. his work is only rivaled
> by gadi evron who gets accepted to every conference because declining a fat
> AND jewish person is guarenteed to get 1000s of big nosed ambulance chasers
> after you by the end of business day.
>
> once again we would ilke to thank nate for his cutting edge research and
> hopefully he will get nommed for next years pwnie life time acheivement
> award!
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/