Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Ubuntu 11.10 now unsecure by default
From: xD 0x41 <secn3t () gmail com>
Date: Sun, 20 Nov 2011 08:16:08 +1100

Ok well how about lets put it simply...

MS have had a Guest user, i believe it is MSUSER***  since what, 1970
? I know locally, i could possibly manipulate registry keys and make
this user 'login' ready... but at this point i have local ax, so a. we
know ms guest user cannot be touched remotely , or is someone putting
up theyre own 0day wich can remotely change ms's inbuilt user... (as i
thought, no one will answer that bit... there is no way to exploit
it).

So if we compare these two os, one would be classed as crappy
(windows), one would be classed as entry-level... now the reason why
ubuntu has this look is simple, you have 3 versions of one OS, Kubuntu
Xubuntu and ubuntu , all split into server-client categorys, and these
are totally different configurations... so stop trying to say Ubuntu
is PRO, it aint, it is handed out on magazines, like many smaller os
are, and then you have places like APC mag, doing direct changeovers
from windows to ubuntu, was a 2010 issue wich actually did this, and
yea, i could prolly find exactly what mag, but i dont think that is
alone...
Ubuntu is portrayed as entry level by its owners, and then having a
thousand local xploits, and people like the e-caliber , making addons
for ubuntu, i would say the popularity of it, is growing less... so
dont worry, im sure there will b less exploitations of Ubuntu..just
not this year :)
have a nice day, m$ r00l users.
xd



On 19 November 2011 07:04, Johan Nestaas <johannestaas () gmail com> wrote:
Sometimes it bothers me that everyone says Ubuntu is made for newbs and that
you're expected to switch distros as soon as you know enough to do it.
I worked as an intern with some folks who developed 802.11s, secure mesh
networking, and they mostly used Ubuntu. I find it extremely fast to
install, set up IDE's, and get a dev workstation up and running. I've never
had an easier time installing a printer. Sure, that helps newbies, but it
also makes work happen quick. If any problems come up, you can't beat their
user base and forums.
I love the freedom of choice, and I switch it up every few months to see how
the other distros are doing, but generally I'm back to ubuntu in a few
weeks.
Also, maybe I'm wrong about this and there are other reasons, but the newest
backtrack is ubuntu based, and they always mention that their distro is
meant for experienced linux users (and more of a toolkit than anything).
I don't know, I guess I feel like ubuntu should be cut some slack for being
newb friendly. It's not such a bad thing.

On Fri, Nov 18, 2011 at 11:32 AM, Olivier <feuille () bibibox fr> wrote:

On 11/18/2011 03:10 PM, Dan Kaminsky wrote:


On Fri, Nov 18, 2011 at 5:01 AM, <Valdis.Kletnieks () vt edu
<mailto:Valdis.Kletnieks () vt edu>> wrote:

    On Thu, 17 Nov 2011 15:53:41 CST, C de-Avillez said:

    > There is no guest account on an Ubuntu server, so at least there
    > this is not a real/perceived risk.

    And nobody's *ever* installed the desktop version on a server
    because they didn't
    know any better, especially from Ubuntu's target audience.  Gotcha.
;)


OK, seriously.  If you're sitting in front of a machine that's
presenting you a login prompt, you've got enough privileges to insert a
bootable USB/CD and pull all the data / make yourself an account
(FDE/Bios PW notwithstanding).

My disk is password protected, and the whole system (except /boot) is
encrypted. Ubuntu guest account is definitively the best way to hack a
running laptop (or workstation).

--
Olivier

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault