full-disclosure - Re: Wipe off, rub out, reappear...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCvwp7groKqBVYx436Yr2JZ37qhzm4NhdU8vH7Jo_pa9yVnhA@mail.gmail.com>
Date: Tue, 11 Oct 2011 21:06:46 +1100
From: xD 0x41 <secn3t@...il.com>
To: Christian Sciberras <uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Wipe off, rub out, reappear...

yes ok dude..whatever.. i dun really care, i have my own opinion, you have
yours. goodbye.,


On 11 October 2011 20:29, Christian Sciberras <uuf6429@...il.com> wrote:

> If you ask me, you sound like bragging on something you wrote.
>
> Either that, or you're clueless to what you are saying.
>
> Just because my younger brother won't understand 5 lines of code I wrote
> doesn't make my 5 liner smart...
> Applying the analogy here, just because they're possibly clueless to how OS
> internals work doesn't mean the virus is doing anything particularly smart.
>
>
>
>
>
>
>
>
> On Tue, Oct 11, 2011 at 1:55 AM, xD 0x41 <secn3t@...il.com> wrote:
>
>> Is obvious, this is a very well made executable :)
>> Or, set up well to spread and then hide, and doing so with even its phone
>> home, wich is normal nowdays, for example consider an ircd, it uses
>> PING/PONG, what if you change the rfc, and use ascii characters,then do this
>> to the bot, remove USER mode completely only allow it for set modes/opers,
>> and then try take the thing down, if it is connected thru about 40 different
>> ips and does not rely on dynami dns...
>> it is not impossible, it is happening now, and, it is also visible,
>> however, these c7c centres are so advanced, Ids are just not getting enough
>> info...you cannot do a thing on the properly modified control centres, and,
>> i have seen that code, it is extremely modified version of ircd... it cannot
>> be used by a NOn operator, and uses a totally different rfc to phopne home
>> etc, thus making conventional methods used atm, useless... as they will
>> loook for the strings that they know, and always ids will perform some
>> string of commands, and, then slowly the operator sees the servers, and one
>> by one he blocks YOU out of his network.
>> This is a dog eat dog world, bot masters can be exceptionallt ingenious
>> when it comes to these things, and masking an exe nowdays, is not as simple
>> as some peoples SFX rar kits :)
>> So even kits nowdays, can be way more advanced than 2008/2009 even...
>> there has been a burst of tech, so there is also a burst in virus
>> numbers... but, smart c&c centres, you wont take down so easily, and they
>> will move before you can even decrypt theyre settings... wich is exactly why
>> stuxnet is non stoppable.. unless the owner shuuts it down, it wont  be
>> killed..
>>  xd
>>
>>
>>
>>
>> On 11 October 2011 10:45, Bob Dobbs <bobd10937@...il.com> wrote:
>>
>>> On Mon, Oct 10, 2011 at 4:31 PM, Michael Schmidt <mschmidt@...gstore.com
>>> > wrote:
>>>
>>>>  If its bot net code and it is behind an air barrier then it will never
>>>> phone home. They
>>>>
>>>
>>> It already broke the "air wall" to get in. It can certainly do so to get
>>> out.
>>>
>>> Bob
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/