|
Petronius -> RE: Maybe leaving CM.. A warning (7/15/2007 6:29:51 AM)
|
quote:
ORIGINAL: OrionTheWolf (RE: Maybe leaving CM.. A warning - 7/14/2007 8:33:01 PM , p. 10)
Dude you need to do your own research. Here is what has been refered to:
"
"We recently learned of a buffer overflow security issue in an ActiveX control. This control is part of the code for webcam image upload and viewing. Upon learning of this issue, we began working towards a resolution and expect to have a fix shortly," said Terrell Karlsten, a Yahoo spokesman. "
The entire article can be found here http://news.com.com/8301-10784_3-9726594-7.html
It can also be found on many other ISS forums and sites.
You do not have to be a genius to do alot of this "hacker" stuff, because the real hackers/programmers will make it into a nice little program that all you have to do is install and run. Is where the term "kiddie" hacker came from.
Orion
On the good side, first, if you want to document a security problem you do it the way OriontheWolf did (and Lothlauren did earlier.) You don't wave your arms about and point to something like the Microsoft web site as others had done.
O. claims the bug he documented was "what was referred to." I see no evidence for this at all. My recollection is that the discussion has been marked by rather wild claims of dangers. Somebody mentioned that the passive viewing of a web cam could open your system.
I don't see evidence that the person's generic statement was in any way to be traced to the particular bug that O. documented.
There are also bugs that are of purely academic interest. They're never exploited because while exploitation is theoretically possible, the complexity of using them or the time required is astronomical.
I'm not saying the bug O. documented is one of these. But there is no code that uses it and never has been. That, at least, is my reading of the statement "Currently, no zero-day exploits exist, Maiffret [founder of eEye who discovered the problem] said...."(1.)
eEye's description of the problem doesn't mention web cams, at least as presented by the earlier article. Rather the company writes "Multiple flaws exist within Yahoo! Messenger which allow for remote execution of arbitrary code with minimal user interaction."(2.)
O. is also quite correct to state that some security problems don't require one to be a high-level hacker because others who are have released programs to breach the security. That's indeed where the "'kiddie' hacker" came from. It's also where the phrase "cookbook kiddie" came from (referring to new hackers who had collected a series of programs or instructions (the 'cookbook') to utilize the flaws.
But O. was quite wrong when he wrote that I "had to do my own research." I didn't make the claim about web cams; somebody else did. It isn't up to me to research their claim; it is up to them to present the results or evidence.
1. Dawn Kawamoto, "Yahoo IM hit with critical security flaws," Newsblog, June 6, 2007
http://news.com.com/8301-10784_3-9726594-7.html
2. http://research.eeye.com/html/advisories/upcoming/20070605.html
|
|
|
|
