Find the answer to your Linux question:
Page 2 of 2 FirstFirst 1 2
Results 11 to 17 of 17
Originally Posted by Steven_G OK, what part of go argue with the guy who did the demo at Black Hat did you not get the first time? And, even I ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #11
    Linux Engineer
    Join Date
    Apr 2012
    Location
    Virginia, USA
    Posts
    889

    Quote Originally Posted by Steven_G View Post
    OK, what part of go argue with the guy who did the demo at Black Hat did you not get the first time?

    And, even I know enough about sec to know that stuff can go years without getting fixed; especially if the company that supplies the tech denies there is a problem.

    One of the guys I read went here a couple of months back and just for poops and giggles tried several dozen old DOS exploits on 7. Most did not work. But a few did, and he rated two of them as critical; DOS EXPLOITS!!! (I suppose you want a link for that now too?)

    MS has a track record of letting known, publicly announced exploits go six months or more without fixing them. And some that they try to fix they have to keep trying for a year or two before they get it right.

    So, what's so shocking about the script kiddies discovering something a year or two before it went public and it still not being fixed three years later?

    I mean what is it? Did you buy a lot of Dell laptops for your company and now you're afraid you're going to lose your job? Or are just you P.O.'d that a security guard has a better reading list than a "PROFESSIONAL?
    All those stories about how other people fixed this exploit is what's really helping your case. I'm sure that somebody, somewhere can corroborate such a real-world exploit has infected PCs, and that they have identified and fixed it.
    So far, you've linked to an article from 2009, and have convinced only yourself that you fixed something.

  2. #12
    Linux User Steven_G's Avatar
    Join Date
    Jun 2012
    Location
    Western US
    Posts
    401
    OK, I know it must be really brusing your wettle ego and chappin your muffs that a stupid ol' securitie gord wid a GED has more of a clue than you do, so go argue with this guy who just wrote this not even three months ago.

    ------------

    Edit

    Win32/CompuTrace.A

    -------------

    2nd Edit

    Core Labs report on how to exploit Computrace. with video demonstrations of how to take control of the process and redirect it to the server of your choice with a full white paper, slide show and utilities to implement the hack. (Gee, that could never be exploited or turned in to a virus.)

    -------------

    Peace, I'm out. I'm obviously too stooooooooooopid to have anything new to share with someone as perfect as yourself.

    For anyone interested in killing it: Follow the hack down in the notes and then you'll also have to manually edit your registry with tools that can unlock null values to remove all traces. Then you can set the service to disabled. You'll have to repeat this every time you reinstall the OS. Or when you order the machine you can tell them not to turn it on, or you can just run *nix.
    Last edited by Steven_G; 08-15-2012 at 04:11 AM.

  3. #13
    Linux Engineer
    Join Date
    Apr 2012
    Location
    Virginia, USA
    Posts
    889
    Quote Originally Posted by Steven_G View Post
    OK, I know it must be really brusing your wettle ego and chappin your muffs that a stupid ol' securitie gord wid a GED has more of a clue than you do, so go argue with this guy who just wrote this not even three months ago.

    ------------

    Edit

    Win32/CompuTrace.A

    -------------

    2nd Edit

    Core Labs report on how to exploit Computrace. with video demonstrations of how to take control of the process and redirect it to the server of your choice with a full white paper, slide show and utilities to implement the hack. (Gee, that could never be exploited or turned in to a virus.)

    -------------

    Peace, I'm out. I'm obviously too stooooooooooopid to have anything new to share with someone as perfect as yourself.

    For anyone interested in killing it: Follow the hack down in the notes and then you'll also have to manually edit your registry with tools that can unlock null values to remove all traces. Then you can set the service to disabled. You'll have to repeat this every time you reinstall the OS. Or when you order the machine you can tell them not to turn it on, or you can just run *nix.
    Despite your best efforts, you still haven't linked to any actual exploits.
    From the article you linked:
    Someone merely needs to figure out an easily repeatable way to point it at their own server
    IE, it hasn't been done. The only thing this kid is talking about is your silly little black-hat expo article where a couple nerds pretended they found something. The only 'fix' you have found is disabling the lojack features, not actually patching or disinfecting of the firmware, etc.

    Again, I don't dispute that there's a anti-theft device in the laptops. I don't dispute there's a way to turn it off. I just dispute that you were able to determine that you were infected by any real-world exploit.
    Maybe if you stop using file sharing programs on Windows you'll stop getting viruses, is all I'm saying.
    Last edited by mizzle; 08-15-2012 at 01:53 PM. Reason: spelling

  4. #14
    Linux User Steven_G's Avatar
    Join Date
    Jun 2012
    Location
    Western US
    Posts
    401
    Last edited by Steven_G; 08-15-2012 at 09:45 PM.

  5. #15
    Linux Engineer
    Join Date
    Apr 2012
    Location
    Virginia, USA
    Posts
    889
    Quote Originally Posted by Steven_G View Post
    Move along folks, move along. Nothing to lok at here; just a friggin idjit securitie gord havin a coniption over nufin. Move along folks, now just move her right along.
    (OMG, I hope my boss doesn't find out about this. I've been telling him for years that Dell laptops are the shiznet. He'll have my hide for sure.)
    Do you read the links you post? The only one that mentions an exploit is the first link, and it was not isolated to the lojack software, they just proposed that as a possibility.
    Strangely enough, it was on an HP machine.

  6. #16
    Linux User Steven_G's Avatar
    Join Date
    Jun 2012
    Location
    Western US
    Posts
    401
    I'm not going to argue with you any more. You obviously have some kind of investment in this not being true. If you bother to read all the way through everything I've posted, follow the links inside the stuff I've posted and do some research of your own (isn't that what you *nix gurus are always yelling at us noobs about?) then you can plainly see (unless you just refuse to, which you do for whatever reason) that there have been serious security concerns related to computrace, across all hardware platforms, since as early as 2005.

    I and a very few other early posters started implicating computrace as an infection / vulnerability vector in the wild about two years ago. And we were flamebroiled by jerkwads like you.

    Now the reports are slowly becoming more frequent. Currently the newest reports seem to be most prevalent in China and Russia.

    And don't even give me a bunch of blowhard crap about it could not have been in the wild that long without being officially detected.

    There is good evdience that proto-variants of Stuxnet have been in the wild and undetected possiblly as long as since 2008. And the official "discovery" of it was probably more political than technical. Kaspersky has close ties to Putin and his former coworkers in what used to be the KGB.

    I'm not saying that this is state sponsored.

    I am saying that there is good evidence that there are many, many very serious issues with computrace, including explotation / infection vectors, that you (evidently) have a vested reason to refuse to even consider as a posibility.

    Therefore there is no further point to this conversation.

    However, when this one does finally blow up I will go pull my old posts and not only shove them straight up the wazoo of those who flamebroiled me two years ago, I'll also make darn sure I get credit for being one of the earliest people to see it.

    Chow Bella.

  7. #17
    oz
    oz is offline
    forum.guy
    Join Date
    May 2004
    Location
    arch linux
    Posts
    18,733
    Guys, please take this ongoing argument between yourselves to your Private Message boxes.

    Sorry, lukeschwab, if you want to discuss this topic any further, please start a fresh thread because this one has been derailed for too long and I'm going to close it.

    Thank you.
    oz

Page 2 of 2 FirstFirst 1 2

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •