ShmooCon07 "Hack it" Contest

During Shmoocon2007 there was a contest open to interested hackers. If you're curious about it but hadn`t chance to join the con, well it's still open for you to check your skills but don't expect any reward :> If you like to get familiar with challenges in Cons, you can try this one. It's consisted of 8 levels, each one require different class of skills. you can try it HERE .
If you're not 31337 enough to solve them, here's the answers for you but I highly recommend you NOT to get it before giving the challenge a try . Such challenges are cool until you do not have the answers and should get them yourself . Finally because this challenge comes from ShmooCon does NOT mean it's something magical or hard to solve.

WOVB - A good learning refrence

Referring to my previous post , here's their first release :

WOVB #01: 2007-04-02 Bypassing Vista Firewall, Flying over obstructive line

Well, to save your time , here's the top result of #1 :
"remote crash(BSOD) by a malformed IPv6 packet on default firewall configuration"
....
Oh wait ! something looked wrong somewhere...
please read this and come back . I'll wait.

Haha , how do you feel now ? :>
Yes, I've been tricked too while quickly reviewing their first advisory. But Jerome's try showed us clearly that HUMAN FACTOR is still the case we should worry about more than anything. Although I believe this try was not a fair one , but still a GREAT example of real world cases! why? because intruders always hit us from the point we never expect. We all knew so called "WOVB Team" and it was the _trust_ a real attacker looks for, as a sample attack vector. As Jerome noted, what if there was some kind of attack-script behind this scenario to infect your system? while reviewing my own weblog's hits, I see >70% of my visitors critically vulnerable to different KNOWN attack vectors. I'm sure he have done such analyze on his own logs too.
I'm too sleepy to continue blogging , but still thinking/laughing about this eye-opening case and the way I've been tricked !

Nice try Jerome ! thanks for not sharing screen-shot of my e-mail as well :D

wtf ?! it sucks :) ... ( Yet Another Post about ANI case )

If you've been blind reading this from my previus "brwosing history" , then I've something more interesting . I don't know I should like this or get worry , but as author says :

"Update: It also bypass eeye security ani patch!"
I'm sure you know where above line comes from!
Well, Eeye warned us multiple times about NO GUARANTEE on their patch, but I bet non of us expected their guarantee to expire that soon :> anyway feel free to try ZERT patch till the day MS release their patch (if they don't patch their patch again, of course!).
After all , since long time ago I don't care about IE nor it's bugs no matter how serious or wild they may be(although this one is not IE ones, but IE is the most used attack vector). consider this just a note for IE lovers/p0wners...

And I hope you still remember about April's ...