full-disclosure - Re: NO-IP service Flaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <220879281-1233016892-cardhu_decombobulator_blackberry.rim.net-1504586995-@bxe360.bisx.prod.on.blackberry>
Date: Tue, 27 Jan 2009 00:41:59 +0000
From: infolookup@...il.com
To: "ghost" <ghosts@...il.com>, full-disclosure-bounces@...ts.grok.org.uk,
	"Tribal MP" <tribalmp@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: NO-IP service Flaw

Fabio,

What if you are sniffing the traffic for any http session the information is submitted in clear text. The only way this is a real problem is if someone does a mitm attack so for now that's not really a disclosure but a function of the protocol.
Sent from my Verizon Wireless BlackBerry

-----Original Message-----
From: ghost <ghosts@...il.com>

Date: Mon, 26 Jan 2009 19:12:33 
To: Tribal MP<tribalmp@...il.com>
Cc: <full-disclosure@...ts.grok.org.uk>
Subject: Re: [Full-disclosure] NO-IP service Flaw

Posts like these are just as bad as n3td3v posts. Here's an idea,
learn security, then come back with something interesting.

kthnx

On Mon, Jan 26, 2009 at 10:47 AM, Tribal MP <tribalmp@...il.com> wrote:
> A flaw exists in NO-IP service while updating the status. The problem
> reside in the URL and corresponding variables because they are send in
> plain text.
>
> By monitoring HTTP traffic in a machine using NO-IP DUC it's possible
> to intercept the username, password and subdomain for the account.
>
> Example:
> http://dynupdate.no-ip.com/ducupdate.php?username=email@email.com&pass=123456789&h[]=subdomain.no-ip.biz
>
>
> Fabio Pinheiro
> http://dicas3000.blogspot.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/