- cypherpunks-legacy - lists.cpunks.org

XSS flaw found at "https://www.e-gold.com" (fwd)
by Eugen Leitl 13 Dec '02

13 Dec '02

---------- Forwarded message ---------- Date: 10 Dec 2002 12:50:03 -0000 From: Liu Die Yu <liudieyuinchina(a)yahoo.com.cn> To: bugtraq(a)securityfocus.com Subject: XSS flaw found at "https://www.e-gold.com" i know bugtraq doesn't accept vulnerability on one site, but the following info is important; please suggest a forum for me to post. ----=======------ XSSatEGOLD-Content-Tech XSS flaw found at "https://www.e-gold.com" technically, it's nothing new. XSS at E-gold is very dangerous. E-gold is one of the most popular way to do international business. and unlike credit card system, e-gold sent, it never comes back. there is no refund policy. so stealing passphrase means stealing real gold. it's important, so i take it seriously. [tested] browser:MSIEv6 time:2002/12/10 UTC+800 [demo] at http://www16.brinkster.com/liudieyu/XSSatEGOLD/XSSatEGOLD-MyPage.htm or http://clik.to/liudieyu ==>XSSatEGOLD or [CODE.URL START] https://www.e-gold.com/acct/historycsv.asp? initial=1xxxx"><SCRIPT>s="You_can_NOT_trust_this_page_if_you_got_if_from_a_ link.____by_LiuDieYu_http://clik.to/liudieyu";w=window.open("https://www.e- gold.com/acct/login.html");setTimeout("w.document.write (s)",150);</SCRIPT>&startmonth=12&startday=4&startyear=1996&endmonth=12&end day=4&endyear=2003&paymentsreceived=1&oldsort=tstamp&page=1 [CODE.URL END] [exp] technically, there is only one thing important for XSS attackers: some CGI can only be found when you are logged in, but they can be reached even if you are not logged in. of course, the module dealing with logged-in users is different from the one dealing with un-logged-in users. so, you have to test in both situations to ensure it's not XSS vulnerable. [contact] http://clik.to/liudieyu ==> "how to contact liu die yu" section [BTW] this flaw can be found easily with FASX at http://clik.to/fasx

1 0

Re: [MPUNKS] Cypherpunks December Mtg: HIGHFIRE Design Session
by Bill Stewart 13 Dec '02

13 Dec '02

At 05:21 AM 12/13/2002 +0000, Peter Fairbrother wrote: >Dave Del Torto wrote: > > > Resumes should be in plain > > ASCII text format with a PGP signature (detached sigs are OK) and on > > floppy disk or CD-R also containing a copy of the applicant's PGP > > public key. > >Fuck off. > >If you think that a PGP key is good enough, you don't know the threats you >are facing with GAK and the like. If you think a resume should be >required... >-- >Peter Fairbrother He didn't say you needed a resume to get into the meeting; he said you needed it if you wanted to apply for a job so they can show the people they're asking for grant money that they've got a bunch of highly qualified people that are interested in working on the project. If it's like most projects, the resume is largely separate from whether everybody knows whether you write great code quickly, but it can be a hook to remind them who's interested. Personally, I like resumes to be in hand-written well-styled HTML :-)

1 0

Re: Extradition, Snatching, and the Danger of Traveling to Other Countries
by Peter Fairbrother 13 Dec '02

13 Dec '02

Anonymous wrote: > On Thu, 12 Dec 2002 10:47:25 -0800, Tim May wrote: >> >> America used to disdain the secret trials, the Star Chamber proceedings so >> endemic in other parts of the world. Now we have them. >> >> We will reap what we sow. >> >> --Tim May > > Spot on. But what, if anything, do you think can be done to > reverse this slide to Red White and Blue Stalinism with good PR? > I trust you are not one of those who will prattle something like > "exercise your right to vote", or "write your > congressperson/MP", etc. In practical terms, in a surveillance > society, what can the regular person do to strike a blow in > opposition to the direct attack on the Constitution and civil > liberties and civil rights? > > Do we need a program to oppose the progrom? Dear America, Yes, It's hard, but here's how. First, you can make comms unreadable. There are well-known ways to do this. Second, you can make comms untraceable. Ways to do this exist, and better ones are being developed*. Third, you can make comms available to everyone - the 'net might help here. If you don't choose to use these methods, the consequences are up to you. But secure comms alone will only provide you with useful information, by themselves they aren't enough; you need to vote. Lots of you. Nothing else really matters. To "them", and you. -- Peter Fairbrother

1 0

Re: Anonymous blogging
by GaryJeffers＠aol.com 13 Dec '02

13 Dec '02

My Fellow Cypherpunks, My defense against getting overwhelmed with Cypherpunks list mail is to use Guan Sin Ong 's excellent archieve: http://www.inet-one.com/cypherpunks . I find this easy and I don't have to delete tons of mail. Yours Truly, Gary Jeffers

1 0

Art Bell nearing retirement
by London Morning 12 Dec '02

12 Dec '02

Hello your email address was found at http://cypherpunks.venona.com/ this was during a search for readers that might be interested in a different kind of news, much in the way the Art Bell radio show has discussed in the past. I am the editor of The London Morning Paper and invite you to a free subscription. It is email based and is sent daily. It includes news from a different slant and that of contemporary press for comparison. May I send you a sample? James van Etten, Editor contact: AB(a)beam.screaming.net London, W14 0HD - United Kingdom 0044 207 603 5340

1 0

Re: Libel lunacy -all laws apply fnord everywhere
by Major Variola (ret) 12 Dec '02

12 Dec '02

Quoth Steve: >Under this logic a retailer in one > country, selling a controversial book to someone in another country, could > involve publishers in yet a third country to litigation in the second > country. Bizarre. > > The real question is whether any judgement is enforceable. Depends if the Dow Jones CEOs ever go to Australia. Ask Mr. Skylarov about enforceability. Better yet, ask his wife or newborn.

1 0

Anonymous blogging
by Nomen Nescio 12 Dec '02

12 Dec '02

I get a lot of compliments on my anonymous posts here. Thanks very much guys, keep those cards and letters coming. But cypherpunks isn't that great a forum for publishing ideas. Take a look at http://www.inet-one.com/cypherpunks/current/maillist.html to see the unfiltered list feed. Sure, no subscriber with half a clue actually sees it like this, but that's how it looks to the outside world. It's tough to find the nuggets of enlightenment buried amongst the crap. I'd like to start publishing a blog. But of course given the sensitivity of my position and the boldness of my arguments, it's important that there be strong anonymity protection. Does anyone have advice on how to get started with anonymous blogging? I have access to Windows, Linux and Mac systems, and I could go through anonymizer.com or some other service if necessary. Ideally I'd like to use one of the turnkey blog clients for ease of setup and use. Thanks for your suggestions.

6 6

Christmas Greetings!
by Charly Calder Faux Furs 12 Dec '02

12 Dec '02

Faux Chinchilla Faux Fox Manhattan Mink Midnight Mink Faux Fur Throw: Faux Fur Throws are ideal choice to make your living space more cozy, elegant or plain cool. Charly Calder throws come in a variety of best quality TISSAVEL Faux Furs (Black & Brown Mink, Sable, Red & Purple Fox, Wolf and more) Our exclusive offer only available at: www.charlycalder.com Forward this e-mail to a friend, and automatically enter to WIN! Happy Holidays! If you wish no longer to receive e-mail offers from us, send e-mail to ccalder(a)directvinternet.com, with subject line Remove. We apologize for the inconvenience.

1 0

Re: Anonymous blogging and unlicensed medical advice.
by Steve Schear 11 Dec '02

11 Dec '02

At 04:27 PM 12/11/2002 -0800, Bill Stewart wrote: >At 08:43 AM 12/11/2002 -0800, Tim May wrote: >>On Wednesday, December 11, 2002, at 01:31 AM, Morlock Elloi wrote: >> In particular, there's a flu medicine that >doesn't leave you feeling good, but takes you from feeling awful to >feeling not so hot, which is a major improvement, at the cost of a >small amount of ipecac in the pills. Speaking about over the counter, has anyone one the list tried Zicam cold remedy? I've used it twice and all my symptoms disappeared with a few hours. No cold! Available at druggists for <$10/spray bottle (2 bottles for <$13 at Costco). No need for universities and major drug companies to spend millions searching for what will turn out to be an expensive prescriptive. Its here and now and over the counter. steve

1 0

Re: "Satellites to challenge Pentagon Spin"
by Dan Veeneman 11 Dec '02

11 Dec '02

At 03:13 PM 12/11/02 -0800, you wrote: >Space war already exists. Laser blinding and buckets of >BB's will wipe out a satelite quite nicely. You're thinking too crudely. Imagine, if you will, being able to control the downlink content of such a spacecraft. Analogous to finding an eavesdropping device in your office. Much better to feed it false information than shut it off. >Making it >look like an accident is going to be harder, but I bet >that's coming too. Already been done, at least to comsats. Cheers, Dan

1 0