- Apr 25, 2015
- 1,844
- 2
- 2,197
- 327
Note: Sit back and relax while reading through this thread, enjoy some popcorn maybe.
The TeamSpeak 3 exploit being published by "scurippio" (attention whore) is documented on many websites, he spammed them into kiddie exploit databases. On behalf of all the R4P3 researchers, that is irritating to us. We spent days of teamwork from the first discovery of this caching system issue to the full disclosure we did. We had this exploited successfully in early September (2015). No one else had any mentioning of this issue at that point in time. Most importantly, we would like our purpose to be known --- our one and only goal is to make TeamSpeak 3 safer for people by discovering security issues to be patched. So, you might ask why we even publish anything? We enjoy educating people on security, it is fun for us to teach people, see this: http://artofproblemsolving.com/articles/learning-through-teaching
The security issue was then leaked by one of our internal researchers. At that point in time we chose to offer up a full disclosure announcement which we pretty much explained how it works and any 13 year old script-kiddie could have stolen the information we provided to recreate the exploit (which is what apparently happened) --- what professional steals vulnerability findings? You're cool, man(.)
Most importantly scurippio, your published documentation on the exploit demonstrates you are a self-proclaimed black hat hacker, hah.
To conclude, R4P3 believes the TeamSpeak development team has acted appropriately in response to our full disclosure and thankfully they treated this security issue with seriousness to prevent script kiddies like scurippio from "owning" computer systems. WE ARE PROUD TO SAY THAT IF YOU UPDATE TO THE LATEST VERSION OF TEAMSPEAK 3, YOU ARE MUCH SAFER.
I would like to add that this is a REMOTE FILE INCLUSION and DIRECTORY TRAVERSAL attack, not a REMOTE CODE EXECUTION attack like Scurippio mentioned. There are many security issues working together here. The biggest security issue is the way Microsoft Windows systems handle Startup files and their creation... if your Startup folder was appropriately secured, this issue would be less concerning. TeamSpeak itself did not have a RCE (Remote Code Execution) vulnerability/exploit. The Windows system itself is just so weak that without appropriate authorization, a startup file was placed. I would consider this a dropper attack, definitely not a RCE though.
The TeamSpeak 3 exploit being published by "scurippio" (attention whore) is documented on many websites, he spammed them into kiddie exploit databases. On behalf of all the R4P3 researchers, that is irritating to us. We spent days of teamwork from the first discovery of this caching system issue to the full disclosure we did. We had this exploited successfully in early September (2015). No one else had any mentioning of this issue at that point in time. Most importantly, we would like our purpose to be known --- our one and only goal is to make TeamSpeak 3 safer for people by discovering security issues to be patched. So, you might ask why we even publish anything? We enjoy educating people on security, it is fun for us to teach people, see this: http://artofproblemsolving.com/articles/learning-through-teaching
The security issue was then leaked by one of our internal researchers. At that point in time we chose to offer up a full disclosure announcement which we pretty much explained how it works and any 13 year old script-kiddie could have stolen the information we provided to recreate the exploit (which is what apparently happened) --- what professional steals vulnerability findings? You're cool, man(.)
Most importantly scurippio, your published documentation on the exploit demonstrates you are a self-proclaimed black hat hacker, hah.
Code:
APPLICATIONNAME="OwnedByScurippio"To conclude, R4P3 believes the TeamSpeak development team has acted appropriately in response to our full disclosure and thankfully they treated this security issue with seriousness to prevent script kiddies like scurippio from "owning" computer systems. WE ARE PROUD TO SAY THAT IF YOU UPDATE TO THE LATEST VERSION OF TEAMSPEAK 3, YOU ARE MUCH SAFER.
I would like to add that this is a REMOTE FILE INCLUSION and DIRECTORY TRAVERSAL attack, not a REMOTE CODE EXECUTION attack like Scurippio mentioned. There are many security issues working together here. The biggest security issue is the way Microsoft Windows systems handle Startup files and their creation... if your Startup folder was appropriately secured, this issue would be less concerning. TeamSpeak itself did not have a RCE (Remote Code Execution) vulnerability/exploit. The Windows system itself is just so weak that without appropriate authorization, a startup file was placed. I would consider this a dropper attack, definitely not a RCE though.
Last edited:
