Jump to content

em

Active Members
  • Posts

    1909
  • Joined

  • Last visited

  • Days Won

    26

Posts posted by em

  1. The Intel Security Advanced Threat Research Team has discovered a critical signature forgery vulnerability in the Mozilla Network Security Services (NSS) crypto library that could allow malicious parties to set up fraudulent sites masquerading as legitimate businesses and other organizations.

    The Mozilla NSS library, commonly utilized in the Firefox web browser, can also be found in Thunderbird, Seamonkey, and other Mozilla products. Dubbed “BERserk”, this vulnerability allows for attackers to forge RSA signatures, thereby allowing for the bypass of authentication to websites utilizing SSL/TLS. Given that certificates can be forged for any domain, this issue raises serious concerns around integrity and confidentiality as we traverse what we perceive to be secure websites.

    Why it’s called BERserk

    This attack exploits a vulnerability in the parsing of ASN.1 encoded messages during signature verification. ASN.1 messages are made up of various parts that are encoded using BER (Basic Encoding Rules) and/or DER (Distinguished Encoding Rules). This attack exploits the fact that the length of a field in BER encoding can be made to use many bytes of data. In vulnerable implementations, these bytes are then skipped during parsing. This condition enables the attack. This is a variation on the Bleichenbacher PKCS#1 RSA Signature Verification vulnerability of 2006.

    nss-1024x686.png

    Individual Firefox browser users can take immediate action by updating their browsers with the latest patches from Mozilla.

    Google has also released updates for Google Chrome and ChromeOS, as these products also utilize the vulnerable library.

    Ensuring that privacy and integrity be maintained is core to what we do at Intel Security. As this issue unfolds we will continue to provide updates on effective countermeasures and proper mitigation strategies.

    Sursa mcafee

  2. Salut,

    Sunteti obligati de oamenii cu ochi albastri sa va logati pe PC si sa aratati cateva lucru de ici-colo.

    Desi aveti in home-ul vostru destule prostii, ati pus la punct un sistem care sa stearga tot atunci cand se executa anumite actiuni.

    Intrebare.

    Care ar fi acele actiuni? Cum puteti sterge tot home-ul fara a da de banuit?

    Intrebare: Cum ati face un setup de linux/windows ca atunci cand faceti unele actiuni (aparent normale) sa stearga tot. Bineinteles, nu vreti sa va stergeti din greseala vreodata fisiere. :)

  3. Uneori ave?i aliasuri dar nu le pute?i rula ca root.

    Trebuie s? pune?i in .bashrc

    alias sudo="sudo "

    De exemplu.


    ubuntu@ubuntu-stuff:~$ alias u
    alias u='uname -a; w'
    ubuntu@ubuntu-stuff:~$ u
    Linux ubuntu-stuff 3.13.0-29-generic #53-Ubuntu SMP Wed Jun 4 21:00:20 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
    19:26:30 up 41 days, 8:31, 2 users, load average: 0.01, 0.19, 0.18
    USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
    ubuntu pts/0 10.42.0.2 19:24 6.00s 0.14s 0.00s w
    ubuntu@ubuntu-stuff:~$ sudo u
    sudo: u: command not found
    ubuntu@ubuntu-stuff:~$ alias sudo="sudo "
    ubuntu@ubuntu-stuff:~$ sudo u
    Linux ubuntu-stuff 3.13.0-29-generic #53-Ubuntu SMP Wed Jun 4 21:00:20 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
    19:26:41 up 41 days, 8:31, 2 users, load average: 0.01, 0.18, 0.18
    USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
    ubuntu pts/0 10.42.0.2 19:24 1.00s 0.14s 0.00s w

  4. Trebuia s? zici c? e vorba de un concurs. Ban 666 de minute pân? te prinzi diferen?a dintre "giveaway", "free" ?i "concurs"

    // editat titlu din "Giveway CS:GO FREE ! " in "Concurs CS:GO"

  5. Salutare,

    A?tept?m ?i versiunea lui.

    Din moment ce tu ai pl?tit 1/3 din bani nu o consider neap?rat ?eap?. Sunt de acord c? nu e nici o asem?nare între ce ai vrut tu ?i ce a f?cut el. Îmi pare r?u ca ai fost indus în eroare de acel user title. E scos acum.

    Nu mai comenta?i offtopic aiurea. :-)

  6. Probabil n-ar trebuii sa ma bag dar :

    Daca omu ti-a dat tv ce la ce plm te-ai uitat ? La stele? nu prin mail-uri?

    Acum sa spunem ca sunt generate...a fost asta una din conditiile tale? Sa nu fie generate?

    Logica asta e de 2 lei. S? zicem c? suntem de acord s? îmi dai 5000E pentru o ma?in?. Dup? ce facem tranzac?ia î?i dau o ma?in? de juc?rie. Pula mea, nu am stabilit de dinainte ca ma?ina s? nu fie de juc?rie.

    Este clar ce a vrut omul, ?i c? nu a primit ce a vrut.

    din 5000 de emailuri doar 150 valide

    Asta înseamn? 3% din mailuri valide. E posibil ca, generate cum sunt, s? se fi nimerit unele s? fie chiar pe bune. Asta e ?eap? ?i atât.

  7. Salutare,

    Oricine mai posteaz? în plus va primi ban. Long story short, mie mailurile alea îmi par generate.

    De acum în colo vor posta aici doar cei implica?i în tranzac?ie, sau cei care pot oferi informa?ii utile.

    M? a?tept ca pân? disear? situa?ia s? fie clarificat? ?i unul din ei s? fie out.

×
×
  • Create New...