SecLists.Org Security Mailing List Archive

Any hacker will tell you that the latest news and exploits are not found on any web site—not even Insecure.Org. No, the cutting edge in security research is and will continue to be the full disclosure mailing lists such as Bugtraq. Here we provide web archives and RSS feeds (now including message extracts), updated in real-time, for many of our favorite lists. Browse the individual lists below, or search them all:

Insecure.Org Lists

Nmap Development — Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to Nmap and related projects. Subscribe here.

zenmap crash in Fedora 34 louzaoh (Apr 22)
This is the message I've got:

➜ zenmap
File "/usr/bin/zenmap", line 114
except ImportError, e:
^
SyntaxError: invalid syntax

➜ rpm -qa zenmap\*
zenmap-7.91-1.noarch

Regards.,

Nmap Bug in payload.cc: corrupted UDP packets during -sU scan mzet via dev (Apr 02)
Hi List,

It was observed that UDP packets that are sent during an UDP port scanning (-sU) are corrupted.

Background:

To make UDP scanning more effective, for many services (ports) Nmap takes content of UDP packets from nmap-payloads
file. Logic for handling this is implemented in payload.cc source file.

Issue:

Due to subtle implementation issue (introduced in...

[NSE] Hex digits in URL encoding should be upper-case nnposter (Apr 01)
For visibility to the broad Nmap community:

I have created issue #2281 to start using upper-case hexadecimal digits
for URL encoding inside NSE. More details at

https://github.com/nmap/nmap/issues/2281

Please leave any comments there.

Cheers,
nnposter

Re: Empty do_ipv4 function in address-info nnposter (Mar 27)
I agree that there is no obvious reason why to have the function there
at all. On the other hand, the script description is pretty clear:

"Shows extra information about IPv6 addresses, such as..."

In other words, there should be no expectation that the script does
anything with IPv4.

Cheers,
nnposter

Empty do_ipv4 function in address-info Toni Ruottu (Mar 27)
Hi!

In the current version of address-info.nse the do_ipv4 function body is
completely empty. Is this a mistake? If it is not a mistake I would at
least expect a comment that explains why the function doesn't do anything.

Cheers, --Toni

PR 2278 - improvement on script ssl-enum-ciphers Sulidi Maimaitiming (Mar 26)
Hi Nmap team,

I have been using the ssl-enum-ciphers script to detect the presence of
weak tls protocols and ciphers and it is a great tool.
However I've noticed many ciphers are rated A for cipher strength (while
they are flagged as weak on SSL Labs for instance), and then I realised
there was a list of warnings aggregated at the port level.
Plus the aggregated output is not always consistent...
I opened a PR on GitHub (...

Re: ssl-enum-ciphers.nse not showing TLS_ECDHE* ciphers nnposter (Mar 20)
<snip>

<snip>>

The script has been updated in r38199. Please see the following comment
for the root cause:

https://github.com/nmap/nmap/issues/1187#issuecomment-803503496

Cheers,
nnposter

Re: Nmap Issue : "kernel: RPC: fragment too large:" Dario Ciccarone (dciccaro) via dev (Mar 16)
https://serverfault.com/questions/652188/nfs-share-problems-rpc-fragment-too-large-xxxxx - second answer on a Google
search for "kernel: RPC: fragment too large:"

With the most absolute respect, and from a professional to another: it would certainly help *immensely* if you could
provide information such as:

* Nmap version and command-line options used
* Operating system, patch level on the host being used to run nmap
*...

Nmap Issue : "kernel: RPC: fragment too large:" PENISSON , TIMOTHÉ (Mar 16)
Hello,
I use Nmap to scan machines and in the logs of some of them, we see this kind of messages appearing in the logs:
"kernel: RPC: fragment too large:".
This message appears globally on all servers scanned by Nmap with an NFS mount.
Is this behavior known by the Nmap community? Is it linked to a specific conf or script?
Is there a workaround to avoid this?

Thanks for your help,

Sincerely,

[Bloc marque]

Timothé PENISSON
MOE...

I keep getting this error every time I try to open the scripting window on windows 10 to input an nse Mike Myers (Mar 16)
Here is the stack trace…

Version: 7.90
Traceback (most recent call last):
File "zenmapGUI\ScriptInterface.pyo", line 261, in script_list_timer_callback
File "zenmapGUI\ScriptInterface.pyo", line 270, in initial_script_list_cb
File "zenmapGUI\ScriptInterface.pyo", line 307, in handle_initial_script_list_output
NameError: global name 'os' is not defined

Thanks for any help. I can use the command...

ssl-enum-ciphers.nse not showing TLS_ECDHE* ciphers Guido van Rooij (Mar 16)
With nmap 7.60, I scanned the host with IP address 3.132.36.206 with the below reesulst:

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-10 11:06 UTC
Nmap scan report for ec2-3-132-36-206.us-east-2.compute.amazonaws.com (3.132.36.206)
Host is up (0.094s latency).

PORT STATE SERVICE VERSION
443/tcp open ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| ssl-enum-ciphers:
| TLSv1.0:
|...

Microsoft publishes Nmap NSE script for detecting Exchange Server SSRF Vulnerability (CVE-2021-26855) Gordon Fyodor Lyon (Mar 16)
It's kind of awesome to see that MS released an Nmap NSE script last week
for detecting the new Exchange Server SSRF Vulnerability (CVE-2021-26855).
They posted it to their GitHub here:

View:
https://github.com/microsoft/CSS-Exchange/blob/main/Security/src/http-vuln-cve2021-26855.nse
Download:
https://github.com/microsoft/CSS-Exchange/releases/latest/download/http-vuln-cve2021-26855.nse

Cheers,
Fyodor

Re: ncat socks5 client is broken nnposter (Mar 15)
Thank you for identifying the issue and proposing a fix. A slightly
modified code has been committed as r38198.

https://github.com/nmap/nmap/commit/024bbf84f137b6e937f8a702cb0718544e48483a

Cheers,
nnposter

ssl-enum-ciphers.nse not showing TLS_ECDHE* ciphers Guido van Rooij (Mar 12)
With nmap 7.60, I scanned the host with IP address 3.132.36.206 with the below reesulst:

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-10 11:06 UTC
Nmap scan report for ec2-3-132-36-206.us-east-2.compute.amazonaws.com (3.132.36.206)
Host is up (0.094s latency).

PORT STATE SERVICE VERSION
443/tcp open ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| ssl-enum-ciphers:
| TLSv1.0:
|...

Should NPING continue to return traceroute results once the a final destination has been reached? Chris Swinney (Mar 08)
Hi all,

Running

nping bbc.co.uk -traceroute -tcp -p 443

Will continue to return results and increment outgoing TTL even though the final destination was found. The result
become difficult to read and irrelevant. Should this be the case?

Cheers

Nmap Announce — Moderated list for the most important new releases and announcements regarding the Nmap Security Scanner and related projects. We recommend that all Nmap users subscribe.

Npcap 1.30 Released: Raw WiFi + Better Performance Gordon Fyodor Lyon (Apr 12)
Hi folks. The Nmap Project is pleased to release Npcap Version 1.30 at
https://npcap.org. We hope Nmap and Wireshark users will be especially
happy with the raw WiFi improvements, since you tend to be particularly
savvy about low-level network inspection. It turns out that some of the
issues we thought were caused by lower level hardware drivers were actually
bugs in our driver. Oops! But at least that means we can fix them
ourselves, and we did....

Npcap 1.20 released Gordon Fyodor Lyon (Mar 16)
Nmap/Npcap Community:

I'm happy to report the release of version 1.20 of the Npcap Windows packet
capturing/sending driver! It's the first release of 2021 and includes
better capabilities for selecting timestamp methods as well as many other
improvements and bug fixes. These include updating the underlying libpcap
library to version 1.10 and building our installer now with NSIS 3. More
details on all this are available from the...

Nmap 7.91 Bugfix Release Gordon Fyodor Lyon (Oct 14)
Hello everyone. I'm glad Nmap 7.90 was so well received! There were so
many improvements that the official announcement (
https://seclists.org/nmap-announce/2020/1) was a bit unwieldy. So Daniel
Miller (who made most of those changes) Tweeted his top highlights at
https://twitter.com/bonsaiviking/status/1313247253197393920

While we do work hard to avoid bugs during development and to catch them
pre-release through continuous integration...

Nmap 7.90 Released! First release since August 2019. Gordon Fyodor Lyon (Oct 03)
Hello everyone. Hot on the heels of the big Npcap 1.00 release (
https://seclists.org/nmap-announce/2020/0), we're delighted to announce a
new Nmap--version 7.90! It's the first Nmap release since Defcon 2019, even
though we've made 16 Npcap releases since then. Raw packets are so
fundamental to Nmap that we really wanted to get it right. With the
production-ready and highly performant Npcap 1.00 driver included, we can
finally...

Npcap 1.00 was just released and a new Nmap is on the way! Gordon Fyodor Lyon (Sep 28)
Hello everyone. I hope you are all safe and well during this nasty
pandemic. I obviously haven't been wearing my marketing hat enough given
that this is my first mail to the Nmap Announcement list since last
August's Nmap 7.80 release. But we've been heads-down programming since
then and have great news to report!

The biggest news is that, after more than 7 years of development and 170
previous public releases, we're...

Full Disclosure — A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

Other Excellent Security Lists

Bugtraq — The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!

Info Security News — Carries news items (generally from mainstream sources) that relate to security.

Daily Dave — This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by ImmunitySec founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave.

Plausible. Dave Aitel via Dailydave (Apr 11)
A while back I was chatting with someone at INFILTRATE, over fried
alligator and more alcohol than I probably should have imbibed, and he
said, "We're going to make fuzzing obsolete, because we have more CPUs on
the problem than anyone can reasonably duplicate, and we're going to
exhaust the space".

And it's PLAUSIBLE in a way. I've watched a few of the live streams that
Brandon Falk does, and you can see how like,...

News Roundups! Dave Aitel via Dailydave (Feb 01)
So lately I've been doing little news roundups on the YouTubes....
Yesterday's is here: https://youtu.be/xgiymt_0isY

Neal Stephenson, in his most recent book, *Fall*, had a character that was
an interesting play on the traditional fantasy "giant" in the sense that
she was normal size, but fractally dense. I feel like we are living that
kind of time - in the sense that gravity is really a measure of how much
stuff is happening...

Re: Fully Automated CONOPs Exercise Pukhraj Singh via Dailydave (Jan 28)
Folks like Joe Slowik
<https://www.youtube.com/watch?v=n7XqxRXwFZ4&ab_channel=CYBERWARCON>, Grugq
<https://www.blackhat.com/docs/webcast/12142017-the-triple-a-threat.pdf>and you
<https://cybersecpolitics.blogspot.com/2016/09/the-stern-stewart-summit-germany-and.html>(Dave)
have tried to articulate the CONOPS for worms since long. In their current
forms, worms look like IO packages in full-spectrum missions. Ignoring...

Re: Fully Automated CONOPs Exercise Dave Aitel via Dailydave (Jan 28)
I mean, the goal of the question is to start putting some meat on the idea
of what "harm" is and how that is reflected both from a policy and
technical perspective. But also: It's useful to put some real definitions
around what is required to make people comfortable with fully-automated
techniques.

I don't think the idea that we are going to come up with and enforce norms
is as useful as figuring out what the norms really are...

Re: Fully Automated CONOPs Exercise Dave Dittrich via Dailydave (Jan 28)
Did any of them mention international humanitarian law, specifically
discrimination, respecting territory of neutral ("green") actors and
their infrastructure, and avoiding harm to neutral third parties and
non-combatants? The problem with most worms is the inability to
accurately discriminate targets and resulting harm. This is an area
where technical experts need to be balanced with operators and policy
makers to ensure that...

Fully Automated CONOPs Exercise Dave Aitel via Dailydave (Jan 27)
So one of my new fav questions to ask policy teams is what they would do if
they were told to switch their offensive team entirely to worms. Nothing
else. Just worms. What needs to change to make that happen - from op tempo
to supply chain to personnel to policy and technological investment.

And how would their defensive team need to change strategically if they
were facing such an offensive team.

It's a fun thing to see people wrap their...

"Severely lacking". Dave Aitel via Dailydave (Jan 20)
Recently I read this post from Maddie Stone of Google's Project Zero:
https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html
. In particular, it has a bolded line of "*As a community, our ability to
detect 0-days being used in the wild is severely lacking to the point that
we can’t draw significant conclusions due to the lack of (and biases in)
the data we have collected.*" which is the most...

[mm4.emwd.com] Please Confirm Your E-mail Address noreply (Jan 07)
Hello from mm4.emwd.com!

You're receiving this e-mail because user SeclistsDD has given yours as an e-mail address to connect their account.

To confirm this is correct, go to
https://lists.aitelfoundation.org/accounts/confirm-email/MzAw:1kxbbR:J_gxtLGlz_7WONRMX9blDLA1rXc/

Thank you from mm4.emwd.com!
mm4.emwd.com

Re: The Lost Decade of Security Metrics Andre Gironda via Dailydave (Jan 05)
MITRE ATK > CVE/CVSS
Enterprise v8 is more granular than ever before for vuln purposes, but
always has been extensive for threat purposes

If you want to express CVEs in maldocs or malware (including webshells) may
I suggest Yara and/or Suricata (maybe shortcuts such as JA3 or JARM if TLS
applies)?
If you want to express CVEs in runtime app infra may I suggest
caldera_pathfinder? e.g., this is heartbleed --...

Re: The Lost Decade of Security Metrics toby via Dailydave (Jan 05)
I don't think you are wrong but your comparison of CVSS and the multiple
(also separately bad) metrics for a WAF isn't effective or accurate.

The values going into CVSS have something in common; they are attempts to
characterize the importance of the vulnerability in question. You are
making (have made before) the claim that the importance of a vulnerability
is too variable and specific to an environment or an attack scenario to be...

Re: The Lost Decade of Security Metrics Chuck McAuley via Dailydave (Jan 05)
Throughput* is perhaps the wrong unit of measure. Most of the time you would be interested in measuring
“requests/second” or “transactions/second”. Aside from say a content ingesting site/repeater
(facebook/twitter/instagram), almost all content for a WAF to handle is inbound, using low amounts of available
bandwidth. The outbound content is rarely inspected by such a device, with the exception of 5xx error or similar
(headers).

A...

The Lost Decade of Security Metrics Dave Aitel via Dailydave (Jan 05)
A thousand years ago I subscribed to the Security Metrics mailing list.
Metrics are important - or rather, I think good decision making is
important, and without metrics your decision making is essentially luck.
But we haven't seen any progress on this in a decade, and I wanted to talk
about the meta-reason why: Oversimplification in the hopes of scaling.

There's a theme in security metrics, a deep Wrong, that the community
cannot...

PaulDotCom — General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast.

BHIS Sorta Top Used Tools of 2018 John - Black Hills Information Security (Dec 06)
Free Webcast

Hello all,

For our next webcast we will cover some of the core tools we use all the time at Black Hills Information Security.
However, there will be a twist. We will not talk about Nessus, Nmap, or Metasploit. Why? Because there are a ton of new
(and older) tools we use that fall outside of the standard tools you see in every security book/blog out there.

Basically, we are trying to be edgy and different.

You may want to come...

BHIS Webcast - Tues 10/2 @ 11am MDT John Strand - Black Hills Information Security (Sep 26)
Hello All,

In this next webcast I want to cover what I am doing with the BHIS Systems team to create a C2/Implant/Malware test
bed. Testing our C2/malware solutions is important because vendors tend to lie or over-hype their capabilities. I will
cross reference some different malware specimens to the MITRE ATT&CK framework and we will cover how you can use these
techniques to test your defensive solutions at both the endpoint and the...

BHIS Webcast: The PenTest Pyramid of Pain 9/4 - 11am MDT Sierra - Black Hills Information Security (Aug 29)
Hello!

How are you all? We had a fantastic webcast last week with John Strand and Chris Brenton and we're still working
through some unexpected hiccups to get the recording up and posted. The podcast version is on our blog, and the YouTube
version will be posted shortly on the Active Countermeasures channel and blog as well. Thanks for all of you who
ventured over to attend!

Ready for another awesome BHIS webcast? Dakota is back and...

Webcast with CJ: Tues 7/24 at 11am Sierra - Black Hills Information Security (Jul 19)
Our upcoming webcast will be about POLICY...

Did you check out when you heard “policy”? Policy can often seem like a drudgery, but it’s also an important and
potentially overlooked part of business and procedure; it’s the framework on which security is really built!

CJ, our COO and Head of Sales has experience writing, assessing and implementing policies for many different kinds of
companies. And if you are worried it will be dry and...

Microsoft Sec Notification — Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products—note how most have a prominent and often-misleading "mitigating factors" section.

Microsoft Security Update Minor Revisions Microsoft (Dec 11)
********************************************************************
Title: Microsoft Security Update Minor Revisions
Issued: December 11, 2018
********************************************************************

Summary
=======

The following CVE has undergone a minor revision
increment:

* CVE-2018-8172

Revision Information:
=====================

- CVE-2018-8172 | Visual Studio Remote Code Execution
Vulnerability
-...

Microsoft Security Update Minor Revisions Microsoft (Nov 14)
********************************************************************
Title: Microsoft Security Update Minor Revisions
Issued: November 14, 2018
********************************************************************

Summary
=======

The following CVEs and advisory have undergone a minor revision
increment:

* CVE-2018-8454
* CVE-2018-8552
* ADV990001

Revision Information:
=====================

- CVE-2018-8454 | Windows Audio Service...

Microsoft Security Update Minor Revisions Microsoft (Oct 24)
********************************************************************
Title: Microsoft Security Update Minor Revisions
Issued: October 24, 2018
********************************************************************

Summary
=======

The following CVE has undergone a minor revision increment:

* CVE-2018-8512

Revision Information:
=====================

- CVE-2018-8512 | Microsoft Edge Security Feature Bypass
Vulnerability
-...

Microsoft Security Update Releases Microsoft (Oct 19)
********************************************************************
Title: Microsoft Security Update Releases
Issued: October 19, 2018
********************************************************************

Summary
=======

The following CVE been added to the October 2018 Security updates:

* CVE-2018-8569

Revision Information:
=====================

- CVE-2018-8569 | Yammer Desktop Application Remote Code Execution
Vulnerability
-...

Microsoft Security Update Releases Microsoft (Oct 17)
********************************************************************
Title: Microsoft Security Update Releases
Issued: October 17, 2018
********************************************************************

Summary
=======

The following CVEs have undergone a major revision increment:

* CVE-2010-3190

Revision Information:
=====================

- CVE-2010-3190 | MFC Insecure Library Loading Vulnerability
-...

Microsoft Security Update Minor Revisions Microsoft (Oct 09)
********************************************************************
Title: Microsoft Security Update Minor Revisions
Issued: October 9, 2018
********************************************************************

Summary
=======

The following CVE has undergone a minor revision increment:

* CVE-2018-8531

Revision Information:
=====================

- CVE-2018-8531 | Azure IoT Device Client SDK Memory Corruption
Vulnerability
-...

Microsoft Security Update Releases Microsoft (Oct 09)
********************************************************************
Title: Microsoft Security Update Releases
Issued: October 9, 2018
********************************************************************

Summary
=======

The following CVE been added to the October 2018 Security updates:

* CVE-2018-8292

Revision Information:
=====================

- CVE-2018-8292 | .NET Core Information Disclosure Vulnerability
-...

Microsoft Security Update Releases Microsoft (Oct 09)
********************************************************************
Title: Microsoft Security Update Releases
Issued: October 9, 2018
********************************************************************

Summary
=======

The following bulletin has undergone a major revision increment:

* MS11-025

Revision Information:
=====================

- https://docs.microsoft.com/en-us/security-updates/
SecurityBulletins/2011/ms11-025:...

Microsoft Security Update Summary for October 9, 2018 Microsoft (Oct 09)
********************************************************************
Microsoft Security Update Summary for October 9, 2018
Issued: October 9, 2018
********************************************************************

This summary lists security updates released for October 9, 2018.

Complete information for the October 2018 security update release can
Be found at
<https://portal.msrc.microsoft.com/en-us/security-guidance>.

Please note the...

Microsoft Security Update Releases Microsoft (Oct 02)
********************************************************************
Title: Microsoft Security Update Releases
Issued: October 2, 2018
********************************************************************

Summary
=======

The following CVE has undergone a major revision increment:

* CVE-2018-0952

Revision Information:
=====================

- CVE-2018-0952 | Diagnostic Hub Standard Collector Elevation of
Privilege Vulnerability
-...

Microsoft Security Advisory Notification Microsoft (Sep 12)
********************************************************************
Title: Microsoft Security Advisory Notification
Issued: September 12, 2018
********************************************************************

Security Advisories Released or Updated on September 12, 2018
===================================================================

* Microsoft Security Advisory ADV180022

- Title: Windows Denial of Service Vulnerability
-...

Microsoft Security Update Minor Revisions Microsoft (Sep 12)
********************************************************************
Title: Microsoft Security Update Minor Revisions
Issued: September 12, 2018
********************************************************************

Summary
=======

The following CVEs have undergone a minor revision increment:

* CVE-2018-8421
* CVE-2018-8468

Revision Information:
=====================

- CVE-2018-8421 | .NET Framework Remote Code Execution
Vulnerability...

Microsoft Security Update Summary for September 11, 2018 Microsoft (Sep 11)
********************************************************************
Microsoft Security Update Summary for September 11, 2018
Issued: September 11, 2018
********************************************************************

This summary lists security updates released for September 11, 2018.

Complete information for the September 2018 security update release can
Be found at
<https://portal.msrc.microsoft.com/en-us/security-guidance>....

Microsoft Security Update Releases Microsoft (Sep 11)
********************************************************************
Title: Microsoft Security Update Releases
Issued: September 11, 2018
********************************************************************

Summary
=======

The following CVE has undergone a major revision increment:

* CVE-2018-8154

Revision Information:
=====================

- CVE-2018-8154 | Microsoft Exchange Memory Corruption
Vulnerability
-...

Microsoft Security Advisory Notification Microsoft (Sep 11)
********************************************************************
Title: Microsoft Security Advisory Notification
Issued: September 11, 2018
********************************************************************

Security Advisories Released or Updated on September 11, 2018
===================================================================

* Microsoft Security Advisory ADV180002

- Title: Guidance to mitigate speculative execution...

Funsec — While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community

Verizon: 1.5M of Contact Records Stolen, Now on Sale Jeffrey Walton (Mar 26)
http://www.mobipicker.com/verizon-1-5m-contact-records-stolen-now-sale/:

A business to business telecommunication giant,
Verizon Enterprise Solutions, a Basking Ridge,
New Jersey-based company, has been the latest
victim of a cyber crime that stole 1.5 million contact
records of the customers of Verizon...

I don't quite understand this double talk. Could someone explain to me:

A spokesperson from Verizon said that...

Statement on Lavabit Citation in Apple Case Jeffrey Walton (Mar 16)
(From John Young on another list):
http://www.facebook.com/KingLadar/posts/10156714933135038

As many of you already know, the government cited the Lavabit case in
a footnote. The problem is their description insinuates a precedent
that was never created. Obviously I was somewhat disturbed by their
misrepresentation. So I decided to draft a statement. And keep in
mind, these are the same people who say "trust us." Click continue to
read...

The NSA's back door has given every US secret to our enemies Jeffrey Walton (Feb 29)
http://www.businessinsider.com/john-mcafee-nsa-back-door-gives-every-us-secret-to-enemies-2016-2

Deng Xiaoping, in 1979 - his second year as supreme leader of China -
perceived a fundamental truth that has yet to be fully grasped by most
Western leaders: Software, if properly weaponized, could be far more
destructive than any nuclear arsenal.

Under Deng’s leadership, China began one of the most ambitious and
sophisticated meta- software...

Can Spies Break Apple Crypto? Jeffrey Walton (Feb 27)
Here's an interesting exchange between Cryptome and Michael Froomkin,
Law Professor at University of Miami, on the All Writs Act
(http://cryptome.org/2016/02/can-spies-break-apple-crypto.htm):

-----

A. Michael Froomkin:

The factual posture in the key Supreme Court precedent, New York
Telephone, involved a situation where only the subject of the order
was capable of providing the assistance at issue. This is the basis
for Apple's...

The FBI's iPhone Problem: Tactical vs. Strategic Thinking Jeffrey Walton (Feb 23)
http://www.technewsworld.com/story/83130.html

I'm an ex-sheriff, and I've been in and out of security jobs for much
of my life, so I've got some familiarity with the issues underlying
the drama between the FBI and Apple. FBI officials -- and likely those
in every other three-letter agency and their counterparts all over the
world -- would like an easier way to do their jobs. Wouldn't we all?

If they could put cameras in...

Wanted: Cryptography Products for Worldwide Survey Jeffrey Walton (Jan 01)
(http://www.schneier.com/crypto-gram/archives/2015/1215.html):

In 1999, Lance Hoffman, David Balenson, and others published a survey
of non-US cryptographic products. The point of the survey was to
illustrate that there was a robust international market in these
products, and that US-only export restrictions on strong encryption
did nothing to prevent its adoption and everything to disadvantage US
corporations. This was an important contribution...

CERT Advisories — The Computer Emergency Response Team has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists.

Open Source Security — Discussion of security flaws, concepts, and practices in the Open Source community

Re: DNS rebinding vulnerability in npupnp Gabriel Corona (Apr 25)
Le 20/04/2021 à 09:54, Gabriel Corona a écrit :

This is CVE-2021-31718.

Gabriel

Re: kopano-core 11.0.1.77: Remote DoS with out-of-bounds access Robert Scheck (Apr 24)
The affected Zarafa versions are identically to CVE-2021-28994 (verified),
thus all versions since Zarafa 6.30.0 Beta 1 (SVN Rev. 13713) are affected.

Given the crash and error messages in old Zarafa versions look different
than in more recent Zarafa/Kopano versions, here is how it looked for me
when verifying the Zarafa version introducing the flaw:

Pid 1545 caught SIGABRT (6), out of memory or unhandled exception, traceback:
backtrace length:...

Re: Malicious commits to Linux kernel as part of university study Thomas Ward (Apr 24)
Clarification is from 2020. That clarification doesn't address the fact that this is still technically research
misconduct regardless of the clarifications. The Linux Kernel has banned commits from University of Michigan because
of a large volume of noise and useless patch requests among other things. So it still requires a misconduct evaluation.

⁣Get BlueMail for Android

-------- Original Message --------
From: Silas...

Re: Malicious commits to Linux kernel as part of university study Silas (Apr 24)
Hello,

They issued a clarification as well:
https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf

- S

CVE-2021-26291: Apache Maven: block repositories using http by default Brian Fox (Apr 23)
Subject: CVE-2021-26291: Apache Maven: block repositories using http by default

Description:

Apache Maven will follow repositories that are defined in a
dependency’s Project Object Model (pom) which may be surprising to
some users, resulting in potential risk if a malicious actor takes
over that repository or is able to insert themselves into a position
to pretend to be that repository. Maven is changing the default
behavior in 3.8.1+ to no...

Re: Malicious commits to Linux kernel as part of university study James Feister (Apr 23)
It is naive to think this adversarial behavior is not already taking place.

The overall response I have seen to this should be encouraging to all of
us that live in these open-source and free software communities. It
shows how our system works. In this case, the actors were identified,
attributed to a publicly known group, and weeded out. The key part is
the information was freely shared, everyone knows about it and can take
what they feel are...

Re: Malicious commits to Linux kernel as part of university study Greg KH (Apr 23)
The people involved agree after-the-fact to the airing of those things.
No such thing happened here at all.

Those who need to know, know who "George Spelvin" is, that is not an
issue.

greg k-h

Re: Malicious commits to Linux kernel as part of university study Kurt H Maier (Apr 23)
This could have been coordinated with kernel maintainers who were
willing to participate, for instance by placing sabotaged code in a
time-locked escrow to be revealed after a set window. This is not
an all-or-nothing proposition. Red team protocols vary, but none of
them start with "first, pick an unsuspecting cadre of strangers trying to
build something, then attack it."

Those prank shows are generally not produced with money from...

Re: Malicious commits to Linux kernel as part of university study Jan Engelhardt (Apr 23)
If you alert the crowd that something is about to happen, you can no
longer observe how the crowd acts in an unalerted state, dooming the
research effort.

Not to encourage UMN's conduct, but I'd find that the prank shows on TV
(let alone Youtube) are a much more severe intrusion, but somehow those
shows still run.

What's more, with the pitchfork way this incident is being responded to,
future researchers may choose to...

Re: Malicious commits to Linux kernel as part of university study Eric Biggers (Apr 22)
Note that one of the patches (the one matching Figure 11 in their paper) did get
accepted and is in mainline. However, it doesn't actually have a bug as
intended, apparently because the author misunderstood what pci_disable_device()
does. So I'm not sure what the story is for that patch. Incompetence is
normally much more likely than malice, but this case would be doubly incompetent
(failing to actually write a malicious patch and...

Re: Malicious commits to Linux kernel as part of university study Francis Booth (Apr 22)
Mark,

by Aditya which did manage to make it into the stable trees.

https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3NcPu=17qyVyEEtVMVR_g51Ma6Q () mail gmail com/

So I think we can agree that there may be more submissions that have made
it through that we aren't yet aware of.

Re: Malicious commits to Linux kernel as part of university study Michael Orlitzky (Apr 22)
If you believe them, the researchers never intended to allow the bad
commits into the kernel:

https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf

On the one hand, they're wasting everyone's time to report a
vulnerability that everyone knows exists already and finding
conclusions that are all obvious and/or useless. But on the other hand,
they don't sound quite as daft as the headlines make them seem. Overly
naive...

Re: Malicious commits to Linux kernel as part of university study Mark Steward (Apr 22)
...

This looks like a good guess to me, and if correct, means none of the
submissions in the paper were successful:

https://lore.kernel.org/linux-nfs/YIEqt8iAPVq8sG+t@sol.localdomain/

Mark

Re: Malicious commits to Linux kernel as part of university study r00t4dm (Apr 22)
Hello,

This case demonstrates that the possibility of a supply chain attack is
very high.
If the supply chain attack is sophisticated enough, this case may succeed.
e.g:

One day I committed some code, This code is a normal function.
After Five days, I committed some code, This code also is a normal function.

...

After three month, I committed it dozens of times, But These committed
code together to form a vulnerability.
I don't know how...

Re: Malicious commits to Linux kernel as part of university study Ariadne Conill (Apr 22)
Hello,

The paper says that they used throwaway Gmail accounts to submit the
patches. Frustratingly, they have not identified which patches they
succeeded in landing in that paper.

However, the paper also claims that they generated these "hypocrite"
commits using an LLVM-based static analysis tool.

Which means the work introduced by Aditya is likely directly related to
this experiment, since it has the same "feel" to...

Educause Security Discussion — Securing networks and computers in an academic environment.

Re: Virtual CISO Tej Patel (Apr 23)
OculusIT (https://www.oculusit.com/it-consulting/#cisoservices) - happy to share experiences directly.

Best,

--Tej

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Dr. Christopher
Davis
Sent: Friday, April 23, 2021 10:11 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Virtual CISO

Has anyone employed the services of a virtual CISO (or company) to help them design and...

Re: Virtual CISO David Eilken (Apr 23)
I might suggest BobCat Cyber. He's an ex-EY security consultant that could
be price competitive if that is a key criteria for you. He's very solid and
thorough. Started his career at Mitre.

Best,
Dave Eilken
[image: Maricopa Community College District Office logo]
DAVID EILKEN MA, MBA, CISSP-ISSMP
MARICOPA COMMUNITY COLLEGES
Information Security Officer | ITS
2411 West 14th Street, Tempe, AZ 85281
david.eilken () domail maricopa edu...

Re: Virtual CISO Koppel, Lorna (Apr 23)
I suggest talking to SideChannel – they provide virtual/fractional CISOs. Started by some VERY smart CISOs that like
to help smaller companies/institutions.
Reach out to Brian Haugli or visit https://www.sidechannel.com/

Lorna L. Koppel
Director of Information Security
Office of Information Security (OIS)
Tufts University
169 Holland
Street<...

Re: Virtual CISO Mattehew Prescott (Apr 23)
We didn't do a vCISO but we have and are using Vantage Consulting,
www.vantagetcg.com. They are an EDUCAUSE partner.

Thanks,
Matt Prescott, Security Analyst
Information Technology
(o) 325-674-2882
Abilene Christian University
[image: Abilene Christian University]

On Fri, Apr 23, 2021 at 9:10 AM Dr. Christopher Davis <CDavis () franciscan edu>
wrote:

**********
Replies to EDUCAUSE Community Group emails are sent to the entire...

Virtual CISO Dr. Christopher Davis (Apr 23)
Has anyone employed the services of a virtual CISO (or company) to help them design and implement a security program
for their school? Any recommendations, good or bad, are appreciated!

Pax Christi,

Dr. Chris Davis
Director of Information Technology Services
[Franciscan University logo]
Franciscan University of Steubenville
1235 University Blvd., Steubenville, OH 43952
740-284-5192 | cdavis () franciscan edu

St. Isidore, please pray that God...

Re: Emeriti Faculty Licensing Carter, Cyrus B (Apr 22)
I was curious about what you said. I found this article.
https://support.microsoft.com/en-us/topic/manage-graduating-student-licenses-and-content-in-microsoft-365-education-ba3142c7-fa7d-46d2-9efd-f1ee751cd400

basically If the institution wishes to maintain the email for alumni they can. But keeping the specific student license
is not part of the deal. This part below is FREE part that may be what was referenced by our Vendor regarding alumni....

Re: Emeriti Faculty Licensing Carter, Cyrus B (Apr 21)
That may be true. And it may be part of the license type we have . I was just repeating what was told to me. Either way
we are not going that route so is a moot point for us. I know this doesn't help anyone else with the question that
was posed. Sorry.

Get Outlook for Android<https://aka.ms/ghei36>

________________________________
From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on...

Re: Emeriti Faculty Licensing Mandi Witkovsky (Apr 21)
I'm not a licensing expert but I have always been told that per MS licensing, alumni are only entitled to email.

mandi

Mandi Witkovsky
Director, Identity and Access Management
for the Purdue University system
witkovsm () pfw edu<mailto:witkovsm () pfw edu>

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Carter, Cyrus B
Sent: Wednesday, April 21, 2021 2:41 PM
To: SECURITY ()...

Re: Emeriti Faculty Licensing Carter, Cyrus B (Apr 21)
We are currently migrating our Student tenant into our main tenant (fac/staff) in Azure AD. That was brought up if we
wanted to setup Alumni constituency to allow users to keep some of the office365 components. Its my understanding that
it is free but you as the institution would still have to manage it. As of now our leadership does not wish to
implement this for alumni because its just one more thing that would require us to manage and...

!!UPDATED TIMES!! [REGISTRATION OPEN] 2021 REN-ISAC Blended Threat Workshop - OSU Sarah Bigham (Apr 21)
<<< text/html; charset=utf-8: Unrecognized >>>

Emeriti Faculty Licensing Kimmitt, Jonathan (Apr 21)
Hi all,

Back in January there was a good conversation on the list about services that .edu's provide emeriti faculty
members.....

For those that let them keep their account, specifically in office365, how do you handle licensing? Do you add to your
employee count to cover those licenses?

Thanks!

-Jonathan

~
Jonathan Kimmitt
CISSP, FIP, CDPSE, CIPP/E, CIPM, CIPT,
OTCP,GLEG, GPEN, GSNA, PCIP, CEH
Chief Information Security Officer...

[Webinar] Rapid IAM Cloud-based Digital Transformation at California Institute of the Arts Hazel Woods (Apr 21)
<<< text/html: EXCLUDED >>>

[REGISTRATION OPEN] 2021 REN-ISAC Blended Threat Workshop - OSU Sarah Bigham (Apr 21)
<<< text/html; charset=utf-8: Unrecognized >>>

Re: MFA for Incarcerated Students Matt Weatherford (Apr 20)
Could the incarcerated student work in a "study room" with a landline
that accepts incoming phone calls? (more likely than allowing a cell
phone, but still feels unlikely)

DUO 2FA allows you to add in a "Call my landline and tell me a code" 2fa
option.
A shared incoming phone line has its share of risks and isnt tied
directly to a user in the way 2FA prefers, but might work here.

Matt Weatherford
University of...

2021 RIMM Call for Proposals Now Open! Sarah Bigham (Apr 20)
<<< text/html; charset=utf-8: Unrecognized >>>

Internet Issues and Infrastructure

NANOG — The North American Network Operators' Group discusses fundamental Internet infrastructure issues such as routing, IP address allocation, and containing malicious activity.

Re: DoD IP Space Michael Butler via NANOG (Apr 25)
The footnote (11) on page 7 of https://www.gao.gov/assets/gao-20-402.pdf
seems to be most relevant ..

"We are not aware of any statutory requirements that directly address
the ability of a government agency to transfer or sell IP addresses to a
third party, but DOD would face legal and policy constraints to any
potential sale or transfer of the addresses to a third party outside of
the government. Among other things, this is because...

Re: DoD IP Space Randy Bush (Apr 25)
john,

my altzheimer's device tells me that some years back there was a
documented written agreement between arin and the dod along the lines of
dod getting a large swath of ipv6 space[0] in exchange for agreeing to
return[1] or otherwise put into public use a half dozen ipv4 /8s.

could you refresh my memory, e.g. with the document, please? thanks.

randy

Re: DoD IP Space Martin Hannigan (Apr 25)
If you apply that ideology to 0/0 you're not going to have much of an
Internet beyond cat pics.

Wish i was in the room when they turned it on. I hope they make a tiktok of
the expressions of everyone looking at the first data. [ joke ]

Warm regards,

-M<

Re: DoD IP Space sronan (Apr 25)
So you are claiming that ARIN has jurisdiction over DoD IP space?

Sent from my iPhone

Re: DoD IP Space John Curran (Apr 25)
Sronan -

For avoidance of doubt (and to save folks some digging), I will observe that the number resources associated with the
U.S. DoD handle I referenced do not include DoD’s legacy IPv4 number resource holdings. However, there are indeed
are registration agreements with the US DoD that pertain to the DoD’s legacy IPv4 number resource holdings, and this
may be readily confirmed by reviewing the CBO assessment report for the...

Re: DoD IP Space John Curran (Apr 25)
Sronan -

I’d suggest asking rather than making assertions when it comes to ARIN, as this will avoid propagating existing
misinformation in the community.

Many US government agencies, including the US Department of Defense, have signed registration services agreements with
ARIN.

From https://account.arin.net/public/member-list -

United States Department of Defense (DoD)

USDDD<...

Re: DoD IP Space John Curran (Apr 25)
This doesn’t sound good, no matter how you slice it. The lack of
transparency with a civilian resource is troubling at a minimum.

You do understand that the addresses in question are not and have
never been "civilian." They came into DoD's possession when this was
all still a military project funded by what's now DARPA.

Personally, I think we may have an all time record for the largest
honeypot ever constructed. I'd...

Re: DoD IP Space sronan (Apr 25)
Except these DoD blocks don’t fall under ARIM justification, as they predate ARIN. It is very likely that the DoD has
never and will never sign any sort of ARIN agreement.

Sent from my iPhone

RE: DoD IP Space Jean St-Laurent via NANOG (Apr 25)
This is true and very interesting, but the opposite is also true.

They are now reachable from probably nearly anywhere and therefore open for business. 😊

Let's see what will slowly appear in shodan.io and shadowserver.org

Jean

-----Original Message-----
From: NANOG <nanog-bounces+jean=ddostest.me () nanog org> On Behalf Of William Herrin
Sent: April 24, 2021 6:46 PM
To: Mel Beckman <mel () beckman org>
Cc: nanog () nanog...

Re: DoD IP Space John Curran (Apr 25)
Mr. Beckman -

As noted by Mark Foster below, the listed contact information for the DoD address blocks is indeed correct, and (as you
yourself confirmed) may be used to successfully contact the organization. ARIN does not have the mandate to force any
organization “to deal” with any other, but I can assure you that the contacts listed for the resources in the ARIN
registry have been used to resolve actual technical problems without any...

Re: DoD IP Space Mark Foster (Apr 25)
Hi Mel,

I'd expect ARIN to hold them to account for complying with ARIN rules,
if they are subject. In years gone by, I have been able to contact US
DoD organisations using published contact methods to address technical
issues. So even if there's technical non-compliance (which i'd agree
should be addressed), it could be a lot worse.

As for the DoD's accountability via your system of government, my view
would be that...

Re: DoD IP Space Christian de Larrinaga via NANOG (Apr 25)
Is the DoD still the owner?

Re: DoD IP Space Bill Woodcock (Apr 25)
I think I’d characterize it, rather, as a possible privatization of public property.

If someone builds a house in the middle of a public park, it’s not _what they’re doing in the house_ that concerns me.

-Bill

Re: DoD IP Space Mel Beckman (Apr 25)
Mark,

ARIN rules require every IP space holder to publish accurate — and effective — Admin, Tech, and Abuse POCs. The DOD
hasn’t done this, as I pointed out, and as you can test for yourself. Your expectation that the DOD will “generally
comply with all of the expected norms” is sorely naive, and already disproven.

As far as “why does anyone on the Internet need to publish to your arbitrary standards”, you seem to forget that...

Fwd: Re: OOB management options @ 60 Hudson & 1 Summer Lost Email Forwarder [Do Not Reply][DART-4276] via NANOG (Apr 25)
Before getting rid of the cellular based OOB, look into some more detail
about exactly what LTE modems are in those. I've seen some remarkable
results from equipment using the 600/700 bands (tmobile, verizon) for
getting signal into deeply buried concrete structures. There's a lot of
different types and capabilities of cellular data modems on the market.

On Thu, Apr 15, 2021 at 3:15 PM Matthew Crocker <matthew () corp crocker...

The RISKS Forum — Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed.

Risks Digest 32.61 RISKS List Owner (Apr 23)
RISKS-LIST: Risks-Forum Digest Friday 23 April 2021 Volume 32 : Issue 61

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.61>
The current issue can also be found at
<...

Risks Digest 32.60 RISKS List Owner (Apr 17)
RISKS-LIST: Risks-Forum Digest Saturday 17 April 2021 Volume 32 : Issue 60

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.60>
The current issue can also be found at
<...

Risks Digest 32.59 RISKS List Owner (Apr 04)
RISKS-LIST: Risks-Forum Digest Sunday 4 April 2021 Volume 32 : Issue 59

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.59>
The current issue can also be found at
<...

Risks Digest 32.58 RISKS List Owner (Apr 01)
RISKS-LIST: Risks-Forum Digest Thursday 1 April 2021 Volume 32 : Issue 58

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.58>
The current issue can also be found at
<...

Risks Digest 32.57 RISKS List Owner (Mar 23)
RISKS-LIST: Risks-Forum Digest Tuesday 23 March 2021 Volume 32 : Issue 57

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.57>
The current issue can also be found at
<...

Risks Digest 32.56 RISKS List Owner (Mar 19)
RISKS-LIST: Risks-Forum Digest Friday 19 March 2021 Volume 32 : Issue 56

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.56>
The current issue can also be found at
<...

Risks Digest 32.55 RISKS List Owner (Mar 16)
RISKS-LIST: Risks-Forum Digest Tuesday March 2021 Volume 32 : Issue 55

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.55>
The current issue can also be found at
<...

Risks Digest 32.54 RISKS List Owner (Mar 13)
RISKS-LIST: Risks-Forum Digest Saturday 13 March 2021 Volume 32 : Issue 54

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.54>
The current issue can also be found at
<...

Risks Digest 32.53 RISKS List Owner (Mar 12)
RISKS-LIST: Risks-Forum Digest Friday 12 February 2021 Volume 32 : Issue 53

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.53>
The current issue can also be found at
<...

Risks Digest 32.52 RISKS List Owner (Mar 06)
RISKS-LIST: Risks-Forum Digest Saturday 6 March 2021 Volume 32 : Issue 52

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.52>
The current issue can also be found at
<...

Risks Digest 32.51 RISKS List Owner (Feb 22)
RISKS-LIST: Risks-Forum Digest Monday 22 February 2021 Volume 32 : Issue 51

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.51>
The current issue can also be found at
<...

Risks Digest 32.50 RISKS List Owner (Feb 19)
RISKS-LIST: Risks-Forum Digest Friday 19 February 2021 Volume 32 : Issue 50

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.50>
The current issue can also be found at
<...

Risks Digest 32.49 RISKS List Owner (Feb 12)
RISKS-LIST: Risks-Forum Digest Friday 12 February 2021 Volume 32 : Issue 49

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.49>
The current issue can also be found at
<...

Risks Digest 32.48 RISKS List Owner (Feb 05)
RISKS-LIST: Risks-Forum Digest Friday 5 February 2021 Volume 32 : Issue 48

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.48>
The current issue can also be found at
<...

Risks Digest 32.47 RISKS List Owner (Jan 29)
RISKS-LIST: Risks-Forum Digest Friday 29 January 2021 Volume 32 : Issue 47

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.47>
The current issue can also be found at
<...

BreachExchange — BreachExchange focuses on all things data breach. Topics include actual data breaches, cyber insurance, risk management, metrics and more. This archive includes its predecessor, the Data Loss news and discussion lists.

Open Source Tool Development

Wireshark — Discussion of the free and open source Wireshark network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.

Re: Wireshark 3.4.5 is now available Graham Bloice (Apr 25)
The Wireshark release policy can be found on the wiki page: ReleasePolicy ·
Wiki · Wireshark Foundation / wireshark · GitLab
<https://gitlab.com/wireshark/wireshark/-/wikis/Development/ReleasePolicy>

TL;DR; Only bugfixes are backported from master to a stable branch.
Increasing dissector support for more protocol coverage is a grey area.

Re: Wireshark 3.4.5 is now available Roland Knall (Apr 25)
Normally it is a cut-off date. Exceptions are only made for bigger bug-fixes and security fixes

Re: Wireshark 3.4.5 is now available Constantine Gavrilov (Apr 25)
A quick question. I have been working on nvme dissector and I see that
some changes from dev tree are in and some are left out.

How is release selection made? Is it a cut-off date or manual choice?

Re: Status label for issues Jirka Novak (Apr 24)
Hi Uli,

I agree with you. I'm missing this information about created issues too.
I propose one more kind of label/labels. It is more about interaction
with reporter of the issue - "waiting for response". There are many
issues opened for years where last message is request for sample or more
information. I think that if such issue is opened for years with no
reaction, it is useless and should be closed....

Re: Having problem tracing multiple ip addresses Ricardo Díez Antequera (Apr 23)
Have you used 192.168.60.200 (the subnet address) or 192.168.60.203 (the broadcast address for the subnet) for a
device? Those addresses are reserved in your subnet and could cause errors in tcpdump engine. A /30 subnet only
supports 2 hosts.

Regards,

Ricardo

---- Robert Blair escribió ----

Sent via: Wireshark-users mailing list <wireshark-users () wireshark org>
Archives: https://www.wireshark.org/lists/wireshark-users...

Re: Having problem tracing multiple ip addresses chuck c (Apr 23)
You will probably get more feedback on the Wireshark Q&A site:
https://ask.wireshark.org/questions/

If you open a question there, include the output of "wireshark -v" or
"tshark -v".
These include OS information and version info for the libraries and program.
Maybe throw in "netstat -nr" (if it's not sensitive info) in case packets
go out one interface and return on another.

On Fri, Apr 23, 2021 at 1:36 PM...

Having problem tracing multiple ip addresses Robert Blair (Apr 23)
I changed three IoT devices from DHCP to static addresses so I could trace all
three of them.

when I enter "net 192.168.60.201" in the capture filter I get all traffic to
and from the ip.

If I enter "net 192.168.60.200/30" I get all fraffic from the ip addresses but
none going to the ip addresses. According to the documentation at
<https://wiki.wireshark.org/CaptureFilters> that syntax shoud capture all
traffic going...

Re: Status label for issues Graham Bloice (Apr 23)
Ah, I thought this was some different label, sorry for the noise.

Re: Status label for issues Pascal Quantin (Apr 23)
Hi Graham,

23 avr. 2021 16:39:16 Graham Bloice <graham.bloice () trihedral com>:

We already have an enhancement label.

@Uli, LGTM.

Cheers,
Pascal.

Re: Status label for issues Graham Bloice (Apr 23)
How will issues that aren't bugs be handled, e.g. enhancement requests?

Status label for issues Uli Heilmeier (Apr 23)
Hi everyone,

For issues (especially bugs) I really miss the status field which was available with Bugzilla.

Therefore I would like to create these scoped labels [1]:

ws-status::unconfirmed => This bug has recently been added to the issue tracker. Nobody has confirmed that this bug is
valid.
ws-status::confirmed => This bug is valid.
ws-status::in-progress => This bug is not yet resolved, but is assigned to the proper person who is...

Re: Rough consensus and quiet humming Josh Clark (Apr 22)
hmmmm

Re: Rough consensus and quiet humming Francesco Fondelli (Apr 22)
Meetecho team introduced the "virtual hum tool"... there should be a draft
somewhere describing it. Hmm.

Re: Rough consensus and quiet humming Graham Bloice (Apr 22)
In a covid pandemic, working from home world, no one can hear you hum.

Rough consensus and quiet humming Guy Harris (Apr 22)
https://twitter.com/MeghanEMorris/status/1382109954224521216/photo/1

Snort — Everyone's favorite open source IDS, Snort. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists.

Snort Blog: 2.9.8.3 Shared Object end-of-life Joel Esler (jesler) via Snort-sigs (Apr 22)
https://blog.snort.org/2021/04/2983-shared-object-end-of-life.html

2.9.8.3 Shared Object end-of-life

Attention users of SNORTⓇ version 2.9.8.3: This serves as your official end-of-life notification. However, this EOL
notification is a bit unique.

We will be moving to an “end of life” for shared object rules for Snort version 2.9.8.3 in 90 days, (July 20, 2021).
After that, for an indeterminate amount of time after July 20, we will...

Snort Subscriber Rules Update 2021-04-22 Research (Apr 22)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-other
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2021-04-21 Research (Apr 21)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-chrome,
malware-cnc, policy-other, protocol-voip, server-apache and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Re: Fwd: question. Russ Combs (rucombs) via Snort-devel (Apr 20)
This should be posted to snort-users or snort-sigs. snort-devel is for bugs and related development work.

Russ

________________________________
From: Snort-devel <snort-devel-bounces () lists snort org> on behalf of juan patricioo via Snort-devel <snort-devel ()
lists snort org>
Sent: Thursday, April 15, 2021 4:09 PM
To: snort-devel () lists snort org <snort-devel () lists snort org>
Subject: [Snort-devel] Fwd: question....

Snort Subscriber Rules Update 2021-04-20 Research (Apr 20)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the malware-cnc and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Fwd: question. juan patricioo via Snort-devel (Apr 19)
---------- Forwarded message ---------
De: juan patricioo <cursoredesinap9644 () gmail com>
Date: jue, 15 abr 2021 a las 21:59
Subject: question.
To: <snort-users () lists snort org>

Hello, im trying to do a rule in snort that can capture de text on a text
field in the next formulary:

http://cekb.unileon.es/formulario.html

[image: image.png]

Im trying:

*alert tcp any any -> any 80 (msg:"script text";...

Snort Subscriber Rules Update 2021-04-15 Research (Apr 15)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-chrome,
file-pdf, indicator-obfuscation, malware-backdoor, malware-cnc and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2021-04-13 Research (Apr 13)
Talos Snort Subscriber Rules Update

Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.

Details:
Microsoft Vulnerability CVE-2021-28310:
A coding deficiency exists in Microsoft Win32k that may lead to an
escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 57403 through 57404.

Microsoft Vulnerability...

Snort Blog: New "Snort 3 and me" webinar series launches on April 20 Joel Esler (jesler) via Snort-sigs (Apr 08)
We’re launching some webinars about the transition to Snort 3. They are totally free, and your information will not be
used for any marketing purposes.

Snort Subscriber Rules Update 2021-04-08 Research (Apr 08)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2021-04-06 Research (Apr 06)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and file-other rule
sets to provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2021-04-01 Research (Apr 01)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-ie,
exploit-kit, indicator-obfuscation, indicator-shellcode, malware-cnc,
netbios, protocol-dns, protocol-voip, server-oracle and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please...

Snort Subscriber Rules Update 2021-03-30 Research (Mar 30)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-other,
malware-cnc, os-windows, protocol-tftp and server-webapp rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Blog: Official EOL Notice for 2.9.15.0, 2.9.15.1 and 2.9.16.0 Joel Esler (jesler) via Snort-sigs (Mar 29)
https://blog.snort.org/2021/03/official-eol-notice-for-29150-29151-and.html

Official EOL Notice for 2.9.15.0, 2.9.15.1 and 2.9.16.0

Attention Snort User and Integrators:

This blog post serves as your official 90-day notice that we will be EOL'ing rule support for versions 2.9.15.0,
2.9.15.1, and 2.9.16.0 as of 2021-06-21 or June 21, 2021.

As we release new versions of Snort, occasionally we have to decommission older versions, lowering...

Snort Blog: 2.9.17.1 has been released! Joel Esler (jesler) via Snort-sigs (Mar 29)
https://blog.snort.org/2021/03/29171-has-been-released.html

2.9.17.1 has been released!

Join us as we are pleased to release a minor bug fix version of Snort 2.9.17.1! Since all new development focus in on
Snort 3<https://snort.org/snort3>, we encourage you to take a look.

First, some release notes:

Snort 2.9.17.1

Improvements / Fix

* Fixed wrong reference to configuration during
* Fixed possible memleak in appid.
*...

More Lists

Related Resources

We're always looking for great network security related lists to archive. To suggest one, mail Fyodor.