Message-ID: <CAD6s_XuPY2GNkOrR1WQNURGpFOR9mFxNNWxByzkzfDhpU68Nuw@mail.gmail.com>
Date: Wed, 25 Jan 2012 12:14:35 +0100
From: Christian Sciberras <uuf6429@...il.com>
To: GloW - XD <doomxd@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: VNC viewers: Clipboard of host automatically
 sent to remote machine

For the record...
who are the other 'many on this list' that know you don't troll other than
your alter egos?
'course you don't troll.... can you quote me where I ever said VNC is
secure?

With that, I'll let you troll in peace. I have no interest talking to you
anyway... :)



On Wed, Jan 25, 2012 at 12:04 PM, GloW - XD <doomxd@...il.com> wrote:

> and stupidly, you forgot to addin the second PRIVT post i sent you,
> saying i meant *insecure :)
> now, go try tell me windows vnc is secure again...and, then setup a
> vnc on your box, and, under win32, try your best, when your ready,
> yell out, so i can make a compete fucking fool of ya.
> ok ?
> if this is how you want to play, i am challenging you, if i can own a
> shitty windows setup you 'secure' as best you8 can, here on fd, is
> this trolling is it ?
> its a challenge... maybe, if you read the lame rfb and, pixelisation
> via IP KVM, unfortunately for windows, it aint any different, a pixel
> is placed at X or Y, and, you can place data calls to it, from server
> wich, could be, my bot :)
> want more proof,...keep going with my challenge then.
>
>
> On 25 January 2012 21:38, Christian Sciberras <uuf6429@...il.com> wrote:
> > No, I only read the manual.
> >
> > Now go troll somwhere else. :)
> >
> > On Wed, Jan 25, 2012 at 11:35 AM, GloW - XD <doomxd@...il.com> wrote:
> >>
> >> Windows is even more secure, have you actually, read any of the code /
> >>
> >>
> >> On 25 January 2012 21:30, Christian Sciberras <uuf6429@...il.com>
> wrote:
> >> > That's not necessarily true. On windows you can add custom
> >> > clipboard formats
> >> > that would contain a 'link' to the original source, causing the data
> >> > to be
> >> > actually
> >> > passed when pasting. An example of this is when one copy+pastes a
> file.
> >> > See the Windows Clipboard API for more info.
> >> >
> >> > Chris.
> >> >
> >> >
> >> >
> >> > On Wed, Jan 25, 2012 at 10:54 AM, Mario Vilas <mvilas@...il.com>
> wrote:
> >> >>
> >> >> I'm not sure how the clipboard works in Linux desktops (I understand
> >> >> it's a little different), but at least in Windows environments data
> >> >> has to be copied to the clipboard when you hit Ctrl-C. It can't be
> >> >> copied when you hit Ctrl-V because then the applications wouldn't
> know
> >> >> if there is anything to paste (like you said, the button would be
> >> >> grayed).
> >> >>
> >> >> So to replicate this behavior it's necessary to send the data as it's
> >> >> copied, not as it's pasted. Most (not all, but most) desktop systems
> >> >> assume clipboard data can be freely shared with all applications and
> >> >> don't have any kind of isolation at all. VNC was designed with the
> >> >> same idea.
> >> >>
> >> >> The bottom line is, the problem here is using VNC for what Ben is
> >> >> using it. There are many more problems with that scenario and
> >> >> clipboard sharing may be the least of them.
> >> >>
> >> >> On Wed, Jan 25, 2012 at 8:44 AM, Peter Osterberg <j@....nu> wrote:
> >> >> > On 01/24/2012 07:18 PM, Mario Vilas wrote:
> >> >> >>> Guys, could you please read carefully everything before you
> reply?
> >> >> >> I read carefully. It still didn't make sense, though.
> >> >> >>
> >> >> >>> And you wouldn't be allowed to use copy&paste while you edit
> >> >> >>> sensitive
> >> >> >>> documents either, I guess?
> >> >> >> I don't know how you could get to such a conclusion from what I
> >> >> >> wrote.
> >> >> >>
> >> >> >> You're reporting that if you copy and paste sensitive information
> >> >> >> and
> >> >> >> connect to a VNC session your clipboard data gets sent to the
> remote
> >> >> >> machine. That's pretty obvious and not a security hole that needs
> to
> >> >> >> be plugged.
> >> >> >
> >> >> > I don't think that is what Ben is saying. The clipboard get sent to
> >> >> > the
> >> >> > the server even before it is pasted, this happens without the user
> >> >> > knowing of it.
> >> >> >
> >> >> > Notepad would have the paste button grayed otherwise, if the
> >> >> > clipboard
> >> >> > is empty, right? So it is already on the server before paste is
> >> >> > pressed.
> >> >> >
> >> >> > So what ever was in the clipboard buffer is transmitted to the
> server
> >> >> > on
> >> >> > connection.
> >> >> >
> >> >> > This is at least the assumption I make from reading Ben's mails.
> >> >> > Or...
> >> >> > Is there a cliboard flag saying there is something on the
> clipboard,
> >> >> > but
> >> >> > it isn't transmitted until the user actually pastes? I haven't
> really
> >> >> > got any experience with how the clipboard feature is implemented.
> My
> >> >> > assumption is however that it has to be on server for notepad to be
> >> >> > aware that Paste shouldn't be grayed out...
> >> >> >
> >> >> > I think Ben's report make complete sense actually, it would be
> better
> >> >> > to
> >> >> > have the clipboard feature as a default. Security before
> features...
> >> >> > =)
> >> >> >
> >> >> > _______________________________________________
> >> >> > Full-Disclosure - We believe in it.
> >> >> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> >> > Hosted and sponsored by Secunia - http://secunia.com/
> >> >>
> >> >>
> >> >>
> >> >> --
> >> >> “There's a reason we separate military and the police: one fights the
> >> >> enemy of the state, the other serves and protects the people. When
> the
> >> >> military becomes both, then the enemies of the state tend to become
> >> >> the people.”
> >> >>
> >> >> _______________________________________________
> >> >> Full-Disclosure - We believe in it.
> >> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >
> >> >
> >> >
> >> > _______________________________________________
> >> > Full-Disclosure - We believe in it.
> >> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> > Hosted and sponsored by Secunia - http://secunia.com/
> >
> >
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists