Comments on: Misterious Ghost Stories http://hackademix.net/2008/05/09/misterious-ghost-stories/ Giorgio Maone's answers to the Web, the Universe, and Everything Sun, 06 Jul 2008 19:51:54 +0000 http://wordpress.org/?v=2.2.3 By: Nathan McFeters http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7897 Nathan McFeters Mon, 12 May 2008 15:02:39 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7897 Yeah, I would've loved to give you the details to get it fixed. Apparently the issue has been fixed in IE, so perhaps sirdarkcat's is a new issue... or a new instance of the same attack. -Nate Yeah, I would’ve loved to give you the details to get it fixed. Apparently the issue has been fixed in IE, so perhaps sirdarkcat’s is a new issue… or a new instance of the same attack.

-Nate

]]> By: James http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7894 James Mon, 12 May 2008 09:39:46 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7894 Probably not related, but http://www.thomasfrank.se/sessionvars.html is interesting. Probably not related, but http://www.thomasfrank.se/sessionvars.html is interesting.

]]> By: Giorgio http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7891 Giorgio Mon, 12 May 2008 05:50:38 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7891 @<b>Nate</b>: No need to explain why you can't give away details, the comment of yours I linked to "<a href="http://talkback.zdnet.com/5208-12691-0.html?forumID=1&threadID=47358&messageID=882431&start=0" target="_blank" rel="nofollow external" rel="nofollow">pretends</a>" was clear enough. I added a smile at the end of the statement you quoted: I was only trying to be ironic about the fact we've got an issue announced and looking like a doomsday device threatening "all browsers", known to an audience of <s>hackers</s> security researchers who may or may not have good intentions, and no information to build a mitigation plan, other than throw-away browser sessions and <a href="http://noscript.net" rel="nofollow">our best friend</a>. Cheers :) @Nate:
No need to explain why you can’t give away details, the comment of yours I linked to “pretends” was clear enough.
I added a smile at the end of the statement you quoted: I was only trying to be ironic about the fact we’ve got an issue announced and looking like a doomsday device threatening “all browsers”, known to an audience of hackers security researchers who may or may not have good intentions, and no information to build a mitigation plan, other than throw-away browser sessions and our best friend.

Cheers :)

]]> By: Nathan McFeters http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7886 Nathan McFeters Sun, 11 May 2008 23:35:02 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7886 Yo Georgio! "Then we’ve got two quite reticent posts by Nate McFeters, who was there but pretends he doesn’t remember well enough and/or he can’t disclose such an atomic bomb." Why call me out like that? There is two points I can say, 1.) I did see the talk and understand the attack, but I'm not certain I can accurately recount the entire attack vector, nor is it my place since it was someone else's research (Manuel). 2.) I discussed this at length with Microsoft and they asked me not to talk about it for now, as this may still be a useable attack vector on several browsers. Being that they invited me to a private conference for discussions about research I was working on, and NOT as a journalist, I respect their wishes. They gave me exclusive coverage of the event, which was very cool of them, and so respecting their wishes about this issue was a small thing to give up. I just had a look at sirdarkcat's posting... I think it is very similar, but I don't think it's the exact same thing. Certainly he understands the concepts, but I'll let Manuel or one of the other attendees confirm that. I wasn't really taking notes on the whole ordeal, as I had some other work I was also doing at the time for my real job, so like I said, not 100% certain of how he did it, the general idea sounds very similar to what sirdarkcat has done, which is very serious in any case. -Nate Yo Georgio!

"Then we’ve got two quite reticent posts by Nate McFeters, who was there but pretends he doesn’t remember well enough and/or he can’t disclose such an atomic bomb."

Why call me out like that?

There is two points I can say,

1.) I did see the talk and understand the attack, but I’m not certain I can accurately recount the entire attack vector, nor is it my place since it was someone else’s research (Manuel).
2.) I discussed this at length with Microsoft and they asked me not to talk about it for now, as this may still be a useable attack vector on several browsers. Being that they invited me to a private conference for discussions about research I was working on, and NOT as a journalist, I respect their wishes. They gave me exclusive coverage of the event, which was very cool of them, and so respecting their wishes about this issue was a small thing to give up.

I just had a look at sirdarkcat’s posting… I think it is very similar, but I don’t think it’s the exact same thing. Certainly he understands the concepts, but I’ll let Manuel or one of the other attendees confirm that. I wasn’t really taking notes on the whole ordeal, as I had some other work I was also doing at the time for my real job, so like I said, not 100% certain of how he did it, the general idea sounds very similar to what sirdarkcat has done, which is very serious in any case.

-Nate

]]> By: hackademix.net » Who You Gonna Call? http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7885 hackademix.net » Who You Gonna Call? Sun, 11 May 2008 22:25:44 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7885 [...] Misterious Ghost Stories 12 05 2008 [...] […] Misterious Ghost Stories 12 05 2008 […]

]]> By: Giorgio http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7883 Giorgio Sun, 11 May 2008 22:10:06 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7883 @<b>Sirdarckcat</b>: I Ain't 'fraid of no catz :) 10x! @Sirdarckcat:
I Ain’t ‘fraid of no catz :)
10x!

]]> By: sirdarckcat http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7882 sirdarckcat Sun, 11 May 2008 21:59:34 +0000 http://hackademix.net/2008/05/09/misterious-ghost-stories/#comment-7882 Can I Haz Ghostz? http://sirdarckcat.blogspot.com/2008/05/browsers-ghost-busters.html (lol catz have ruined my life) Can I Haz Ghostz?
http://sirdarckcat.blogspot.com/2008/05/browsers-ghost-busters.html

(lol catz have ruined my life)

]]>