Full Disclosure mailing list archives
Kaspersky Lab Online Activation Center remote brute force vulnerability
From: www417 <www417 () gmail com>
Date: Sun, 21 Sep 2008 09:48:17 +0800
Dear all: I found vulnerability in Kaspersky Lab Online Activation center ( https://activation.kaspersky.com). The threat will help a remote attacker to brute force activation code and sale to victim. Remote attackers only need a script (Perl or Python or Windows Batch) and a GUN program (wget or curl). Although the number of activation code is so huge that brute force, but I still have idea for make it easy. Successfully exploitation the threat, remote attackers have ability to online steal lots activation codes. I have posted a POC for showing the thread, you can download from http://www417.googlepages.com/kaspersky.zip I also added a file, named "Readme.txt" for detail how to use the tool. Please scan the tools by your Anti-Virus, and then test them on safely machine. * I also had sent the detail of the vulnerability to Kaspersky, but looks like they did not interest. :( Thanks and Regards www417
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Kaspersky Lab Online Activation Center remote brute force vulnerability www417 (Sep 20)