Re: [Full-disclosure] more rehashes of xss & 'evil gif'



Clearly this class of vulnerabilities is nothing short of epic, entirely
new, and truly worth our time and fear. When combined with the stellar
research and presentation skills of said researchers it meets 3/4
requirements for widespread media cuntbaggery, observe:

1) words that sound new and cool
-->"The attack relies on a new type of hybrid file"

hybrid: hybrid, hmm sort of hydra, sort of like internet super worm of
doom??!! watchout!

2)social networking sites
-->"giving the bad guys access to the victim's Facebook account."

zomgz did someone say facebook? watch out, your teenage whore daughter is
now at risk!

3)moderately not clever acronym
-->"They call this type of file a GIFAR, a contraction of GIF and JAR"

plus it sounds like some sort of mythical beast?! GIFAR, ROAR! do you
think they'll have a cool animation for it on their slides? one can only
dream!

wait, what about the 4th requirement? how about the possibility of anyone
actually being owned? wait, no.


On Tue, Aug 5, 2008 at 1:26 AM, Robert Holgstad <rholgstad@xxxxxxxxx> wrote:


http://www.infoworld.com/article/08/08/01/A_photo_that_can_steal_your_online_credentials_1.html

seems dan isn't the only press whore around! rebouncing from his embarasing
post about 'deputy dan' and the matasano blog - whoosh anyone? nate and his
crew of javascript gurus have whipped up another rehash of an old class of
bugs that has been used in the wild for a long time. we personally want to
thank nate for his great work hes done for conferences over the years
filling up their talking spots with useless crap. his work is only rivaled
by gadi evron who gets accepted to every conference because declining a fat
AND jewish person is guarenteed to get 1000s of big nosed ambulance chasers
after you by the end of business day.

once again we would ilke to thank nate for his cutting edge research and
hopefully he will get nommed for next years pwnie life time acheivement
award!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [Full-disclosure] Selling codes exploiting 0-days vulnerabilities
    ... How is the purchaser assured of receipt of exploit details, what sort ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Call for moderation
    ... how to make filters or sort through topics... ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] sai8 User Data Exposition
    ... 4chan generally care about this sort of thing; ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Wipe off, rub out, reappear...
    ... executable and found it doesn't do that sort of thing. ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: my solar meantime wont gather before I release it
    ... Somebody sort around, unless Madeleine exclaims ... I was concerning to use you some of my frightened sacks. ... If you will suspect Basksh's charter below classifications, ... inside comparative estates, unless they're correct. ...
    (sci.crypt)