full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 31 Aug 2010 16:26:20 -0700
From: coderman <coderman@...il.com>
To: Dan Kaminsky <dan@...para.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"cmorris@...odu.edu" <cmorris@...odu.edu>,
	"paul.szabo@...ney.edu.au" <paul.szabo@...ney.edu.au>
Subject: Re: DLL hijacking with Autorun on a USB drive

On Tue, Aug 31, 2010 at 4:14 PM, Dan Kaminsky <dan@...para.com> wrote:
>...
> It's not that they can't. It's that they don't, and we have huge
> amounts of data confirming this. Have you never been to a Moxie
> Marlinspike talk?  His success rates on SSL Stripping a tor node were
> 100%. 100%!!!

this was days into his experiment, however, and those with clue were
scared away from his exit pretty quick. i believe Moxie mentioned this
as a shortcoming in his presentation - it would have been nice to
collect stats from the get go. then he might have shown only a 99.72%
success rate.

(some people *still* use IE over Tor, which is absolute insanity)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/