freebsd security - May 2005 - Mozilla 1.0.4 security update (Just install it, will keep all settings) + Important note from me,please read,those uninterested,please dont flame ;)

Update to the mozilla vulnerabilities wich were not Publicly reported
(To MY standard, for BSD/Cros platform users) , so i performed my own
research,PoC's etc, and have submitted all my results.
I wont say i had ANYTHING atall todo with the Update, BUT please
Update a.s.a.p to mozilla v1.0.4 , that should stop atleast ONE
exploit, the other may be a simple matter oif not allowing your
Javascript to 'perform certain commands' , atm,my setting is to
'allow
window resizing' only, wich seems all it needs to function, and it is
'handy', (unfortunately).

http://mozilla.mirrors.tds.net/pub/mozilla.org/firefox/releases/1.0.4/
^^
thats one mirror.

This was the first 'major' exploitation, so it is trying to be kept
under relative control. If i had some more 'company' support, as my
recent Isp has become tired with amount of work I have had to putin
(Hence = $$ basically to pay me).
~~~~
Some comments from Me personally to ANYONE interested (I will work
seriously on this,at a Very LOW fee(If any..), only if certain things
are met), but anyhow this is the stuff wich is iportant.
First 2 Points,
1. No one seems to give a rats bum about spamming, and i have got a
non public scanner+exploiter wich infects BSD mailservers,and can
massmail, i receive this 2 weeks ago, but dues to my limited
knowledge, was only able to have the place shutdown,however, not
before a colleague had to sit down and manually deleye about 40,000
emails.
So it is NOT just a small prolem, the real problem, is educating
Admins and Techs, and I will tel you right now, it does NOT matter
about where you come from, it is what you know, so ignore people from
symantec thinking they have a "solution to everything" , say one word
to them "Mophine by Holy-Father", and that should shutup 99% of the
A/V.
2. The situation is now beyond just a "joke" , it is now for profit,I
have intercepted unpacked binaries,unfortately,as I have limited
support,I can only trace the major attackers,using the attackers
equipment,sire,i could find many "roots' etc. I mean the actual
"offender address/details".
I dont think this has ever been successfully done,I am willing to
start a project, anti-spam or similar, and will start with Victoria.
Asin - Remote disinfection, well,if people WONT secure, then i will
secure theyre machine for them, or , spit me ideas..im waiting,have
been along time.
Note also, I am not nor, have ever been a "hacker", so you can make
whatever presumptions you like. I am a 30yr old, who was compromised
about 10times,then tried to attack the comromisers,but realised they
were MUCH more powerful than me, so i had to backoff...heres a quick
ref if you like, one small example::

http://www.airscanner.com/pubs/hacked1.pdf
http://www.airscanner.com/pubs/hacked2.pdf

This is what i mean by ... educating people, the people who this
happens to, it shouldnt be happening to, and some of that is not
updating due to piracy etc,BUT alo is done on purpose, and for many
reasons wich i cannot draw into here nor now, it is much larger than
this,although xdcc wrezkits will be a focus,as i can easily find
these,logins,passwords,and complete info, only because I have
personally developed MY OWN app for that.So i can confidentally say, I
have done my homework.
However it is time to open up, ive had enough seeing silly spams
everyday and reporting to spoof@ebay.com etc.
I am offering to shutdown MAJOR hacking orgs,such as makers of these
exploits, but i have ONE problem, who do i speak to, who do i
trust,who will indeed work with me to try and legalise a section for
"sertain experienced people"?!?!

This is a NEW area, wich should really be inputted by some people who
have done 'extensive' testing, to point of stuff i cannot mention here
even,these people will understand my post,and know what i am saying.
Please Note:: I can supply much more simple searches etc wich have
yielded me extremnely sensitive info, yes i had to poke about on
hackers websites,but err, isnt that what they are doing? This is the
major problem, I need authority to 'investigate' , and in this area,it
is not really funded,however,imagine if all .au dns and normal servers
were running @ Peak. I think , alot more Isps would get success,as
with the users mainly,connection and everything would be improved
majorly.Just remember, you can maybe ignore it, but the problem is no
longer ignoreable to system admins, so I am acting,those with me, are
welcome to join me and we will register it as a project etc.
I am currently looking through the ports to find a better security
feature for FreeBSD,i thikk it should be bettered/improved.
So ANY offers to aid me in my research, would be welcomed greatly,
Regards,
Drew B.
-- 
------------------------------------------
Drew B.
/* Security researcher/expert,threat-focus,Freelance */
------------------------------------------

On Thu, May 12, 2005 at 07:18:04PM +1000, Drew B. [Security Expertise/Freelance
Security research]. wrote:
> Update to the mozilla vulnerabilities wich were not Publicly reported
> (To MY standard, for BSD/Cros platform users) , so i performed my own
These have been documented in vuxml already. Thanks anyway.

<rest of original message omitted>

-- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology
Yale University School of Medicine
SenseLab | Research Assistant
http://cowbert.2y.net/

These have been documented in vuxml already. Thanks anyway.


Ohh , i am mising somewhere i should be looking then perhaps, thankyou
for letting me know, FreeBSD mailing lists, and the asociated Cvs etc,
its so large ,thankyou for pointing that out, was a flaw in my
Information gathering system, thankyou for notifying me. :-)
Regards,
Drew B.

On 5/12/05, Peter C. Lai <sirmoo@cowbert.2y.net>
wrote:
> On Thu, May 12, 2005 at 07:18:04PM +1000, Drew B. [Security
Expertise/Freelance Security research]. wrote:
> > Update to the mozilla vulnerabilities wich were not Publicly reported
> > (To MY standard, for BSD/Cros platform users) , so i performed my own
> 
> These have been documented in vuxml already. Thanks anyway.
> 
> <rest of original message omitted>
> 
> --
> Peter C. Lai
> University of Connecticut
> Dept. of Molecular and Cell Biology
> Yale University School of Medicine
> SenseLab | Research Assistant
> http://cowbert.2y.net/
> 
> 

-- 
------------------------------------------
Drew B.
/* Security researcher/expert,threat-focus,Freelance */
------------------------------------------