Slashdot Mirror

← Back to Domains

Domain: insecure.ws

Stories and comments across the archive that link to insecure.ws.

Comments · 8

  1. Re:reCAPTCHA by Anonymous Coward · · Score: 0 · on Spammers Targeting Microsoft's Revised CAPTCHA

    but at least recaptcha helps translating those books into digital form. which is good =)
    also its not a too bad captcha.

    then again, captcha are all broken by design and only work for so long.

    http://www.insecure.ws/2007/06/15/captcha-wiib-2

  2. URL Handler Exploits appear to be fixed... by EverLurking · · Score: 4, Informative · on Mac OS X 10.3.4 Released
    Well, rebooted just fine. No issues yet. Browsing and E-mail working well, grabbed my home Wireless 802.11b/g with WPA just fine, if anything, reception is LESS flaky now (fewer dropouts seen on AP Grapher and fewer random loss of connectivity).

    Doesn't seem any slower or faster.

    Most importantly, it looks like some of the URI handler problems/security holes are now patched as well. I had uninstalled the "Paranoid Android" Haxie before the update (to make sure there weren't any install issues) so it was no longer running.

    It looks like none of these exploits seem to work any more after the 10.3.4 update.

    Nice work,

    DaveC

  3. URL Handler Exploits appear to be fixed... by EverLurking · · Score: 4, Informative · on Mac OS X 10.3.4 Released
    Well, rebooted just fine. No issues yet. Browsing and E-mail working well, grabbed my home Wireless 802.11b/g with WPA just fine, if anything, reception is LESS flaky now (fewer dropouts seen on AP Grapher and fewer random loss of connectivity).

    Doesn't seem any slower or faster.

    Most importantly, it looks like some of the URI handler problems/security holes are now patched as well. I had uninstalled the "Paranoid Android" Haxie before the update (to make sure there weren't any install issues) so it was no longer running.

    It looks like none of these exploits seem to work any more after the 10.3.4 update.

    Nice work,

    DaveC

  4. Much Ado About Not Much... by lgw4 · · Score: 5, Interesting · on Yet Another Mac OS X Protocol Handler Exploit
    I think this is mainly a PR stunt.
    <quote>
    Sample Exploit

    Ive written a sample exploit that delivers and executes its payload without user intervention and operates by registering its own URL scheme handler. Until Paranoid Android, there was no way of protecting against this attack, which freaked me out enough to write Paranoid Android.:)

    If you click the sample exploit link below, heres what will happen:

    • A disk image named MalwareDiskImage will be mounted on your desktop.
    • LaunchServices will read the Info.plist file of the application in this disk image automatically, and register the application as the default handler for URLs with a 'malware' scheme.
    • The webpage will wait 10 seconds, and then redirect to malware:unused, causing LaunchServices to launch the payload application within the disk image.
    • The application within the disk image will write a text file to the users home directory called owned.txt explaining that the machine has been exploited, will present an alert to the user, and will eject the disk image.

    Because this sample exploit registers its own URL scheme, none of the methods people had been using involving disabling certain scripts, moving Help.app or changing the 'help' URL scheme would protect against it. At this time, only Paranoid Android provides protection from it.

    benign sample exploit -->innocousPage.html

    Portions of this sample exploit are based heavily on a prior sample exploit at insecure.ws Conclusions

    Until Apple fixes this vulnerability, you should install Paranoid Android and surf safely.

    Copyright Jason Harris, 2004, All Rights Reserved

    </quote>
    I'm using 10.3.3 and when I click on the sample exploit URI, nothing happens -- nothing. I've tried this thing 10+ times, scoured my HD for "owned.txt" and can find nothing. Of course, I installed the RCDefaultApp PreferencePane a couple of days ago and had already followed the suggestions posted by John Gruber on http://daringfireball.net but since Paranoid Android is the ONLY thing that can protect against this exploit, I'm at a loss as to explain why my machines aren't affected.
  5. PATCHED ALREADY! by goombah99 · · Score: 1, Informative · on Safari Security Hole Allows Cookie Theft
    move along. no story here. Uh hate to burst everyones' bubble but this is patched if you are using safari version 1.1.1

    as long as I'm reposting things from MacSlash here's one: see for your self by testing the exploit here.

  6. Re:Where's Safari 1.1? by Anonymous Coward · · Score: 0 · on Security Updates Released for Panther and Jaguar

    whaat's wrong with safari? THAT

  7. safari cookie exploit fix not in ?!! by Anonymous Coward · · Score: 0 · on Security Updates Released for Panther and Jaguar

    insecure.ws: Safari cookies theft+exploit is not fixed!!

    the news about the exploit is like one or two days old, and it's not even on slashdot ?? what a shame ! ;p

    btw: the exploit allows about anyone to steal your cookies, including data about you, passwords, eg online bank accounts etc (or amazon/etc or such) it's quite dangerous there's also a demo here: demo /exploit

  8. safari cookie exploit fix not in ?!! by Anonymous Coward · · Score: 0 · on Security Updates Released for Panther and Jaguar

    insecure.ws: Safari cookies theft+exploit is not fixed!!

    the news about the exploit is like one or two days old, and it's not even on slashdot ?? what a shame ! ;p

    btw: the exploit allows about anyone to steal your cookies, including data about you, passwords, eg online bank accounts etc (or amazon/etc or such) it's quite dangerous there's also a demo here: demo /exploit