Re: Full-Disclosure Digest, Vol 91, Issue 23

[James <magot_man () hotmail com>]

Unsubscribe

Sent from my iPad

On 18/09/2012, at 10:47 PM, full-disclosure-request () lists grok org uk wrote:

> Send Full-Disclosure mailing list submissions to
>    full-disclosure () lists grok org uk
>
> To subscribe or unsubscribe via the World Wide Web, visit
>    https://lists.grok.org.uk/mailman/listinfo/full-disclosure
> or, via email, send a message with subject or body 'help' to
>    full-disclosure-request () lists grok org uk
>
> You can reach the person managing the list at
>    full-disclosure-owner () lists grok org uk
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Full-Disclosure digest..."
>
>
> Note to digest recipients - when replying to digest posts, please trim your post appropriately. Thank you.
>
>
> Today's Topics:
>
>   1. Re: Adobe Flash UpdateInstalls Other Warez    without Consent
>      (Jeffrey Walton)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 17 Sep 2012 13:59:12 -0400
> From: Jeffrey Walton <noloader () gmail com>
> Subject: Re: [Full-disclosure] Adobe Flash UpdateInstalls Other Warez
>    without Consent
> To: Christian Sciberras <uuf6429 () gmail com>
> Cc: Disclosure <full-disclosure () lists grok org uk>,    BugTraq
>    <bugtraq () securityfocus com>
> Message-ID:
>    <CAH8yC8nDGN8Hy2e8mKmcKTSe8cPjeDnszSrNDGvwaq2Qu07j2w () mail gmail com>
> Content-Type: text/plain; charset="utf-8"
>
> Hi Christian,
>
> > So, I was updating flash on a computer lately, when I noticed the
> > prompt below*, reminding me of this conversation.
> Its a different URL. The URL I used was provided by the Adobe Flash Update
> Service.
>
> Considering how bad they've done in userland, its a scary thought they are
> installing software at an elevated privilege level (and IT allows it).
>
> > or maybe it just took me a few weeks to photoshop this....
> If you can't program them or secure them, you might as well paint on them.
>
> Jeff
>
> On Mon, Sep 17, 2012 at 1:39 PM, Christian Sciberras <uuf6429 () gmail com>wrote:
>
> > So, I was updating flash on a computer lately, when I noticed the prompt
> > below*, reminding me of this conversation.
> >
> > *or maybe it just took me a few weeks to photoshop this....you decide.
> >
> > To the more reasonable readers, I guess Adobe could have had a genuine
> > mistake / bug in their code....nothing new.
> > Don't know why it's such a big deal.
> >
> >
> >
> > [image: Inline image 1]
> > On Sun, Sep 9, 2012 at 11:21 PM, Marcio B. Jr. <marcio.barbado () gmail com>wrote:
> >
> > > You may be interested in getting acquainted with the fact that life is
> > > possible (it's actually stupendously better) without crapware.
> > >
> > > On Thu, Sep 6, 2012 at 2:09 PM, Jeffrey Walton <noloader () gmail com>
> > > wrote:
> > > > The company that writes the worlds most insecure software [1,2,3] has
> > > > figured out a way to further increase an attack surface.
> > > >
> > > > Adobe now includes additional warez in their updates without consent.
> > > > The warez includes a browser and tools bar. The attached image is what
> > > > I got when I agreed to update Adobe Flash because of recent security
> > > > vulnerability fixes.
> > > >
> > > > It appears Adobe has become a whore to Google like Mozilla.
> > > >
> > > > +1 Adobe.
> > > >
> > > > [1] http://www.google.com/#q=Adobe+site%3Asecurityfocus.com.
> > > > [2]
> > > http://web.nvd.nist.gov/view/vuln/search-results?query=adobe&search_type=all&cves=on
> > > > [3]
> > > http://lastwatchdog.com/adobe-surpasses-microsoft-favorite-hackers-target/
> > > > [4] http://www.theregister.co.uk/2009/12/29/security_predictions_2010/
> > > >
> > > > [SNIP]
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20120917/6db9e97e/attachment.html 
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: not available
> Type: image/png
> Size: 211549 bytes
> Desc: not available
> Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20120917/6db9e97e/attachment.png 
>
> ------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> End of Full-Disclosure Digest, Vol 91, Issue 23
> ***********************************************

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/