[Full-disclosure] Fwd: What's going on about Pangolin

[Tremaine Lea]

It's more of an academic point than anything.  Large companies and
widely recognizable names that have established reputations are more
likely to be taken at their word when they indicate an app they've put
out is a false positive.  

Individuals don't get the same level of social credit, and are more
likely to be put to the question and tested more stringently because
there is no pre-existing relationship with the end user, and thus less
trust and a host of other factors.

The reality, imnsho, is that all applications should be given high
levels of scrutiny by security minded people.  It certainly wasn't my
intent to pick on this particular application, but to make a point about
full disclosure in a much more general sense.

Cheers,


-- 
Tremaine Lea
Network Security Consultant
Intrepid ACL
"Paranoia for hire"


On Sat, 2008-03-29 at 00:17 +0000, Nemes wrote:
> This is not anykind of trojan or has it got anykind of backdoor in it.
> 
> I've been using it for a few days now and its fine.
> 
> I had a process monitor running and aTCP/IP UDP connections monitor
> running when i unpacked the rar and ran pangolin for the first time,
> NOTHING HAPPENED except for the application starting.
> 
> I did an "upx.exe -d pangolin.exe" on my copy and I got 1 FILE
> UNPACKED..
> 
> No trojans no abckdoors, no virus nothing!
> Its fine!
> 
> N
> 
> ---------- Forwarded message ----------
> From: Tremaine Lea <tremaine at gmail.com>
> Date: 28 Mar 2008 17:20
> Subject: Re: [Full-disclosure] What's going on about Pangolin
> To: mastahflank at gmail.com
> Cc: full-disclosure at lists.grok.org.uk,
> full-disclosure-bounces at lists.grok.org.uk
> 
> Why should he show the source to his work?
> 
> To allay valid concerns of the intended users.
> 
> With some of the discussion at this point, it would certainly benefit
> the author if he wants to gain wider usage and discourage uninformed
> opinion.
> 
> ---
> 
> Tremaine Lea
> Network Security Consultant
> Intrepid ACL
> "Paranoia for hire"
> 
> 
> 
> On 28-Mar-08, at 10:38 AM, josh wrote:
> > Why should he show the source to his work. I don't see him selling
> > it, he isn't twisting your arm to use it. He released it for free.
> > Either use it or don't.
> > Sent from my BlackBerry® smartphone with SprintSpeed
> >
> > -----Original Message-----
> > From: "Andreas Selvicki" <drsynack at gmail.com>
> >
> > Date: Fri, 28 Mar 2008 10:25:25
> > To:full-disclosure at lists.grok.org.uk
> > Subject: Re: [Full-disclosure] What's going on about Pangolin
> >
> >
> > Let's see the source please.
> >
> >
> > On 3/26/08, zwell at sohu.com <mailto:zwell at sohu.com>  <zwell at sohu.com
> <mailto:zwell at sohu.com
> > > > wrote:
> > I've just read the discussion from here, seriously, I don't know
> > what's going on.
> > I've coded it since 2005 and never release it until this year. And I
> > really do not know why it be treated as a backdoor.
> >
> > If you think it is a backdoor, so please do a reverse engineering on
> > it. You can capture the network packet, you can list all the strings
> > in it, even you can hook APIs in it. Do anything you like to make
> > sure whether it's backdoor or not.
> >
> > BTW, I packeted it through UPX to reduce the size. And some people
> > focused on "http://www.nosec.org/web/index.txt
> <http://www.nosec.org/web/index.txt
> > > ", which is used in ORACLE injection mode when the target database
> > is in intranet so we can use some store-procs to make the target to
> > visit our website then we can receive the internet address that is
> > mapped to outside. Anybody who is good at oracle injection should
> > know this.
> >
> > Really, I wanna know why!!!
> >
> >
> >
> > < div class="w134">
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 489 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080329/b024ea15/attachment.bin