http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/ just for yours informations i write this article my test for injections in freesitch version of my tests freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
Please do not use our project to try to make your blog more popular. Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30. This extension is also vulnerable “by virtue of the stupidity of the composer” <extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension> You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this. On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com> wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
Antony i dont see why ?? this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ... many peoples can make dialplans witch use of this expressions ... On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com>wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
To me it sounds like a way to sound the alarms and bring negative attention. For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly. The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest. On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com>wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
i prefer FreeSwitch im left Asterisk FreeSwitch is Very Very betther then Asterisk in my option !! my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !! On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com>wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
correct, You could write a CGI for apache too that could let someone figure out how to download the root password. By default, nobody should trust the data supplied by the outside user. FreeSWITCH cannot do this for you or the limitations would impair desired functionality. All you have to do is look for a digit sequence in your dial string. Moreover you need to make sure even then that it's safe to pass this digit string to the provider. Here in USA we share the 1 country code with several other countries that could cost 50 cents to a dollar a minute. So you are not even safe when you made sure it's a number. On Mon, Feb 22, 2010 at 11:09 AM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com>wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com>wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
Eder, If you fear people can do such *really stupid* things, and this is nice from you, please add something to the wiki, for example a paragraph in the dialplan page, or whatever, explaining why this is a stupid thing. If you publish a page in your blog, that look like a security alert, or that you found a security flaw in FS, people will rightly think that you are just looking for some attention in the search engines, and to bring viewers to your page. Also, in doing so, you push non technical people to think there is a security problem in FS, and this is really a big damage to the project. Because it is not true, it is just how it look like in your page. So, delete that page, and add something to the wiki, if you care about telling people not to do stupid things. But please, be aware that your page, the page you published, is really something that do a damage and put a bad light on a project, and there is no one reason for doing this. -giovanni On Mon, Feb 22, 2010 at 6:09 PM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com> wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
yeah can somebody make one wiki for this alert?? im make down my link page now to prevent thes problems !! OK On Mon, Feb 22, 2010 at 2:26 PM, Giovanni Maruzzelli <gmaruzz@celliax.org>wrote:
Eder,
If you fear people can do such *really stupid* things, and this is nice from you, please add something to the wiki, for example a paragraph in the dialplan page, or whatever, explaining why this is a stupid thing.
If you publish a page in your blog, that look like a security alert, or that you found a security flaw in FS, people will rightly think that you are just looking for some attention in the search engines, and to bring viewers to your page.
Also, in doing so, you push non technical people to think there is a security problem in FS, and this is really a big damage to the project. Because it is not true, it is just how it look like in your page.
So, delete that page, and add something to the wiki, if you care about telling people not to do stupid things.
But please, be aware that your page, the page you published, is really something that do a damage and put a bad light on a project, and there is no one reason for doing this.
-giovanni
On Mon, Feb 22, 2010 at 6:09 PM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on
our
own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific extension on the FreeSWITCH custom made for your attack. It’s like saying if you
leave
your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com> wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for
injections
in freesitch
version of my tests
freeswitch@internal> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com<MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org<sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely,
Giovanni Maruzzelli Cell : +39-347-2665618
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Link Down :-) i thaks if somebody create one wiki witch this alert Eng Eder de Souza On Mon, Feb 22, 2010 at 2:39 PM, Eder Souza <ederwander@gmail.com> wrote:
yeah can somebody make one wiki for this alert??
im make down my link page now to prevent thes problems !!
OK
On Mon, Feb 22, 2010 at 2:26 PM, Giovanni Maruzzelli < gmaruzz@celliax.org> wrote:
Eder,
If you fear people can do such *really stupid* things, and this is nice from you, please add something to the wiki, for example a paragraph in the dialplan page, or whatever, explaining why this is a stupid thing.
If you publish a page in your blog, that look like a security alert, or that you found a security flaw in FS, people will rightly think that you are just looking for some attention in the search engines, and to bring viewers to your page.
Also, in doing so, you push non technical people to think there is a security problem in FS, and this is really a big damage to the project. Because it is not true, it is just how it look like in your page.
So, delete that page, and add something to the wiki, if you care about telling people not to do stupid things.
But please, be aware that your page, the page you published, is really something that do a damage and put a bad light on a project, and there is no one reason for doing this.
-giovanni
On Mon, Feb 22, 2010 at 6:09 PM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on
our
own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of
regular
expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
Please do not use our project to try to make your blog more popular.
Your example requires you to prepare an intentional specific
extension
on the FreeSWITCH custom made for your attack. It’s like saying if you leave your door wide open at your house and call and tell someone, they can come and rob you at 8:30.
This extension is also vulnerable “by virtue of the stupidity of the composer”
<extension name=”please-hack-me”/> <condition> <action application=”system” data=”${destination_number}”/> </condition> </extension>
You should not allow tainted data from outside system to be fed directly into your code. There is a regex system in place to extract legitimate data from the user tainted input and safeguard against this.
On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com> wrote: > > > http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/ > > just for yours informations i write this article my test for injections > in freesitch > > version of my tests > > freeswitch@internal> version > FreeSWITCH Version 1.0.5-20100218-0400 (hacked) > freeswitch@internal> > > > > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com<MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org<sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com<MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org<sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely,
Giovanni Maruzzelli Cell : +39-347-2665618
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks a lot, Eder. If you feel like, you can add a paragraph yourself, then we'll edit if necessary. Just let us know. -giovanni On Mon, Feb 22, 2010 at 6:45 PM, Eder Souza <ederwander@gmail.com> wrote:
Link Down :-)
i thaks if somebody create one wiki witch this alert
Eng Eder de Souza
On Mon, Feb 22, 2010 at 2:39 PM, Eder Souza <ederwander@gmail.com> wrote:
yeah can somebody make one wiki for this alert??
im make down my link page now to prevent thes problems !!
OK
On Mon, Feb 22, 2010 at 2:26 PM, Giovanni Maruzzelli <gmaruzz@celliax.org> wrote:
Eder,
If you fear people can do such *really stupid* things, and this is nice from you, please add something to the wiki, for example a paragraph in the dialplan page, or whatever, explaining why this is a stupid thing.
If you publish a page in your blog, that look like a security alert, or that you found a security flaw in FS, people will rightly think that you are just looking for some attention in the search engines, and to bring viewers to your page.
Also, in doing so, you push non technical people to think there is a security problem in FS, and this is really a big damage to the project. Because it is not true, it is just how it look like in your page.
So, delete that page, and add something to the wiki, if you care about telling people not to do stupid things.
But please, be aware that your page, the page you published, is really something that do a damage and put a bad light on a project, and there is no one reason for doing this.
-giovanni
On Mon, Feb 22, 2010 at 6:09 PM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
Antony i dont see why ??
this is just one alert for all comunity of danger in the use of regular expression (.*) or (.*) ...
many peoples can make dialplans witch use of this expressions ...
On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale <anthony.minessale@gmail.com> wrote: > > Please do not use our project to try to make your blog more popular. > > Your example requires you to prepare an intentional specific > extension > on the FreeSWITCH custom made for your attack. It’s like saying if > you leave > your door wide open at your house and call and tell someone, they > can come > and rob you at 8:30. > > This extension is also vulnerable “by virtue of the stupidity of the > composer” > > <extension name=”please-hack-me”/> > <condition> > <action application=”system” data=”${destination_number}”/> > </condition> > </extension> > > You should not allow tainted data from outside system to be fed > directly > into your code. There is a regex system in place to extract > legitimate data > from the user tainted input and safeguard against this. > > > > On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com> > wrote: >> >> >> >> http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/ >> >> just for yours informations i write this article my test for >> injections >> in freesitch >> >> version of my tests >> >> freeswitch@internal> version >> FreeSWITCH Version 1.0.5-20100218-0400 (hacked) >> freeswitch@internal> >> >> >> >> >> _______________________________________________ >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> >> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> http://www.freeswitch.org >> > > > > -- > Anthony Minessale II > > FreeSWITCH http://www.freeswitch.org/ > ClueCon http://www.cluecon.com/ > Twitter: http://twitter.com/FreeSWITCH_wire > > AIM: anthm > MSN:anthony_minessale@hotmail.com > GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com > IRC: irc.freenode.net #freeswitch > > FreeSWITCH Developer Conference > sip:888@conference.freeswitch.org > iax:guest@conference.freeswitch.org/888 > googletalk:conf+888@conference.freeswitch.org > pstn:+19193869900 > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely,
Giovanni Maruzzelli Cell : +39-347-2665618
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
i thaks if somebody create one wiki witch this alert
A place to change is Example 1 of the dialplan XML examples. You can tell people not to use the catchall expressions, because you cannot trust information from the sender. http://wiki.freeswitch.org/wiki/Dialplan_XML A word of caution could also be added to http://wiki.freeswitch.org/wiki/Regular_Expression -- Russell Mosemann ________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
Perfect place lol On Mon, Feb 22, 2010 at 3:27 PM, <Russell.Mosemann@cune.org> wrote:
i thaks if somebody create one wiki witch this alert
A place to change is Example 1 of the dialplan XML examples. You can tell people not to use the catchall expressions, because you cannot trust information from the sender.
http://wiki.freeswitch.org/wiki/Dialplan_XML
A word of caution could also be added to
http://wiki.freeswitch.org/wiki/Regular_Expression
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
http://wiki.freeswitch.org/wiki/User:Ederwander On Mon, Feb 22, 2010 at 3:38 PM, Eder Souza <ederwander@gmail.com> wrote:
Perfect place lol
On Mon, Feb 22, 2010 at 3:27 PM, <Russell.Mosemann@cune.org> wrote:
i thaks if somebody create one wiki witch this alert
A place to change is Example 1 of the dialplan XML examples. You can tell people not to use the catchall expressions, because you cannot trust information from the sender.
http://wiki.freeswitch.org/wiki/Dialplan_XML
A word of caution could also be added to
http://wiki.freeswitch.org/wiki/Regular_Expression
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Why not actually edit the real wiki pages instead of hiding this information on your user page? On Feb 22, 2010, at 2:13 PM, Eder Souza wrote:
http://wiki.freeswitch.org/wiki/User:Ederwander
On Mon, Feb 22, 2010 at 3:38 PM, Eder Souza <ederwander@gmail.com> wrote: Perfect place lol
On Mon, Feb 22, 2010 at 3:27 PM, <Russell.Mosemann@cune.org> wrote:
i thaks if somebody create one wiki witch this alert
A place to change is Example 1 of the dialplan XML examples. You can tell people not to use the catchall expressions, because you cannot trust information from the sender.
http://wiki.freeswitch.org/wiki/Dialplan_XML
A word of caution could also be added to
http://wiki.freeswitch.org/wiki/Regular_Expression
-- Russell Mosemann
a good response to this would be to put appropriate notes on the wiki about what is good practice in this respect. Perhaps a patch to the default configs to add notes with an extra warning would be good as well. Mike On Mon, Feb 22, 2010 at 12:09 PM, Eder Souza <ederwander@gmail.com> wrote:
i prefer FreeSwitch im left Asterisk
FreeSwitch is Very Very betther then Asterisk in my option !!
my intention is just say dont use (.*), (.+) or combinations of this regular expressions, for me FreeSwitch is the betther !!
On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
To me it sounds like a way to sound the alarms and bring negative attention.
For instance, if you were sincerely concerned, you could have told us about your discovery privately first, and we could feature a story on our own site warning people of this danger and reminding them how to compose extension properly.
The posting was instead made like a big public announcement calling our software "imperfect". Yes it is imperfect, It can't properly detect someone being a moron 100% of the time but it sure tries it's darndest.
On 02/22/2010 11:58 PM, Eder Souza wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/ just for yours informations i write this article my test for injections in freesitch version of my tests freeswitch@internal <mailto:freeswitch@internal>> version FreeSWITCH Version 1.0.5-20100218-0400 (hacked) freeswitch@internal <mailto:freeswitch@internal>>
Leaving your car unlocked, the keys in the ignition, and a big sign on the windscreen saying "THIS CAR IS UNLOCKED" has a comparable effect. This is a sleazy way to get page hits. Someone really should create a wordpress blacklist. Steve
On Mon, Feb 22, 2010 at 3:58 PM, Eder Souza <ederwander@gmail.com> wrote:
http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
just for yours informations i write this article my test for injections in freesitch
version of my tests
I look forward to next week's blog post where you reveal that "rm -rf /" results in unexpected data loss.
participants (8)
-
Anthony Minessale
-
Brian West
-
Dan Lane
-
Eder Souza
-
Giovanni Maruzzelli
-
Michael Jerris
-
Russell.Mosemann＠cune.org
-
Steve Underwood