Referring to my previous post , here's their first release :
WOVB #01: 2007-04-02 Bypassing Vista Firewall, Flying over obstructive line
Well, to save your time , here's the top result of #1 :
"remote crash(BSOD) by a malformed IPv6 packet on default firewall configuration"
....
Oh wait ! something looked wrong somewhere...
please read this and come back . I'll wait.
Haha , how do you feel now ? :>
Yes, I've been tricked too while quickly reviewing their first advisory. But Jerome's try showed us clearly that HUMAN FACTOR is still the case we should worry about more than anything. Although I believe this try was not a fair one , but still a GREAT example of real world cases! why? because intruders always hit us from the point we never expect. We all knew so called "WOVB Team" and it was the _trust_ a real attacker looks for, as a sample attack vector. As Jerome noted, what if there was some kind of attack-script behind this scenario to infect your system? while reviewing my own weblog's hits, I see >70% of my visitors critically vulnerable to different KNOWN attack vectors. I'm sure he have done such analyze on his own logs too.
I'm too sleepy to continue blogging , but still thinking/laughing about this eye-opening case and the way I've been tricked !
Nice try Jerome ! thanks for not sharing screen-shot of my e-mail as well :D
WOVB #01: 2007-04-02 Bypassing Vista Firewall, Flying over obstructive line
Well, to save your time , here's the top result of #1 :
"remote crash(BSOD) by a malformed IPv6 packet on default firewall configuration"
....
Oh wait ! something looked wrong somewhere...
please read this and come back . I'll wait.
Haha , how do you feel now ? :>
Yes, I've been tricked too while quickly reviewing their first advisory. But Jerome's try showed us clearly that HUMAN FACTOR is still the case we should worry about more than anything. Although I believe this try was not a fair one , but still a GREAT example of real world cases! why? because intruders always hit us from the point we never expect. We all knew so called "WOVB Team" and it was the _trust_ a real attacker looks for, as a sample attack vector. As Jerome noted, what if there was some kind of attack-script behind this scenario to infect your system? while reviewing my own weblog's hits, I see >70% of my visitors critically vulnerable to different KNOWN attack vectors. I'm sure he have done such analyze on his own logs too.
I'm too sleepy to continue blogging , but still thinking/laughing about this eye-opening case and the way I've been tricked !
Nice try Jerome ! thanks for not sharing screen-shot of my e-mail as well :D
No comments:
Post a Comment