MS Windows GDI+ Proof of Concept (MS08-052) Version 2

John Smith from EvilFingers released the second version of MS Windows GDI+ Proof of Concept (MS08-052). This can be found at http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt. The entire list of PatchTuesday PoC's can be found here. PatchTuesday Analysis page can be found at http://www.evilfingers.com/patchTuesday/analysis.php, where Ion Visser published an analysis document on analysis of MS08-053 Windows Media Encoder wmex.dll ActiveX Control Buffer Overflow. Ion is also coming up with overall analysis document on the GDI+ PoC's that released last month and that will be releasing in future.

If you have any questions regarding this or any other stuff, contact us at contact.fingers @ gmail.com.

- EF

New Tools - releasing in EF

EvilFingers just released a base64 - Encoder/Decoder. Kindly, test it and let us know if you wish something to be changed or something to be added to the existing stuff.

We are currently working on releasing a subnet calc. We understand that these tools already exist, though our aim is to integrate such tools with other tools that would make the real time job faster for certain professionals who are into this.

Kindly do stay in touch at contact.fingers @ gmail.com


- EF

Rishi Narang - The first Google chrome exploit writer

Rishi Narang (Founder, Greyhat) Team Lead, EvilFingers Community was the one and only gentleman who released the first exploit for Chrome in EvilFingers and brought EvilFingers into media and to the world's attention. We thank him for all his contributions to the community and our best wishes for him to continue the same.

Rishi is a Vulnerability Specialist and looking at his experience, he has has been doing the same for 3+ yrs. He is also a forum moderator, writer, beta-tester and proof-reader for Hakin9 magazine.

Thank you for choosing our community.

- EF

Phishtank - Thee Anti-phishing Portal

Phishtank is a project that is in existence since 2006. Phishtank wins the PC World award for Top Product of 2008. EvilFingers.com did its first release of anti-phishing effort by submitting its first find at Phishtank, which can be found here.

We wish that such an effort continues to the extent of collaborating with such teams in building a secured information infrastructure. Our best wishes to Phishtank in all its efforts.

- EF

EvilFingers Team Lead - Ion Visser

Ion is a really good engineer and a cool analyst. His way of performing analysis in the reverse has always yielded many publications and analysis materials to our team. Ion is also good at vulnerability assessment and has been doing all of these for years. He is volunteering for only one team in the entire world.

Thanks to Ion for contributing lively and solely for EvilFingers.

- EF

Association of Certified Fraud Examiners (ACFE)

ACFE certifies the anti-fraud professionals with the Certified Fraud Examiner(CFE) after testing them with 4 domains as listed on their official site.

Based on the info in the official website, " The mission of ACFE Foundation is to increase the body of anti-fraud knowledge and support future anti-fraud professionals worldwide through the funding of scholarships, endowments, research, and other educational projects. ACFE Foundation works to encourage students to pursue careers in fraud examination and provide resources for research on the detection and deterrence of fraud. "

ACFE has been there for decades, and to be precise they were here even before the information era or the Dot-Com world. There are many CPA's and CFA's who used to get certified as CFE and right now, many information security professionals are getting themselves certified with CFE.

EvilFingers thought of talking about anti-fraud section, since we thought that it was interesting to start some projects on the same. If you have any ideas or would like to collaborate in any similar stuff or in any other projects, kindly contact us as soon as possible as we work on FCFS(First-come-first-served) basis.

Thank you & Regards

- EF

EvilFingers Team Lead - Aditya K Sood

Aditya K Sood (Founder, Secniche) is a team lead at EvilFingers community. Aditya has been publishing articles at Hakin9 for the past few years and he has also been really active in practical implementation of information security. Unlike many Security Evangelists, Aditya doesn't consider himself as one. In his belief, it is a title that other should believe that you are and not a title that you could coin yourself with. He has published papers in many issues of USENIX journal and has been really active with Vulnerability Assessment. Aditya has been speaker for many well known conferences such as OWASP, XCON and so on.

We would like to acknowledge Aditya for his work and dedication.

- EF