Nexus

While conducting research for a case note on the recent CJEU decision in the 'Oberbank/Santander/DSVG' colourless trade mark decision (here), this Kat has come across another contourless colour trade mark dispute. This one is currently pending before the German Bundesgerichtshof (the German Federal Court of Justice, the uninitiated) and relates to the use of shades of yellow on language learning related goods and products. Having had a look at the various media reports on the case (see e.g. here, here, here), it does promise some excitement.

Yellow too...

Background: German dictionary publisher Langenscheidt and language software publisher Rosetta Stone both use shades of yellow. Langenscheidt mostly for the covers of its bilingual dictionaries and other bilingual products, Rosetta Stone mostly for its language learning software. A conflict ensured and Langeschedit took the matter went to court, more precisely before the Higher Regional Court of Cologne (case reference 6 U 38/12 of 9 November 2012). Langenscheidt alleged trade mark infringement due to Rosetta Stone’s use of the colour yellow on the packaging of its language software, its website and its (TV) advertisements. The Cologne judges agreed and ordered an injunction of Rosetta Stone’s use of the colour yellow and declared it liable for damages and costs. From a consumer’s perspective, the court found, Langescheidt and Rosetta Stone’s products and colours were very similar. Potential buyers could therefore be confused into thinking that Rosetta Stone’s yellow branded software came from Langenscheidt. This risk was increased by the fact that that Langenscheidt’s yellow dictionaries and related language products had already been on the German market and consumers were familiar with them.

Rosetta Stone appealed this decision to the Bundesgerichtshof and also commenced separate proceedings for the cancellation of Langenscheidt’s German trade mark registration the the abstract colour yellow. This cancellation was refused by the German Patent and Trademark Office and on appeal also by the German Federal Patent Court.

It is now the Bundesgerichtshof to decide in this dispute. The decision is expected in September 2014. This Kat would not be surprised if the Oberbank and Santander cases also ended up at the Bundesgerichtshof, but we shall wait and see.

For our German speaking readers, the FAZ newspaper has published a (fun) colour trade mark quiz which can be accessed here.

Read More Add comment

PwnStar - Script for multi attack (for all your fake-AP needs!)

By 0x000216

Read

0 Comments

A bash script to launch a Soft AP, configurable with a wide variety of attack options. Includes a number of index.html and server php scripts, for sniffing/phishing. Can act as multi-client captive portal using php and iptables. Launches classic exploits such as evil-PDF. De-auth with aireplay, airdrop-ng or MDK3.

Usage

Basic Menu

1) Honeypot: get the victim onto your AP, then use nmap, metasploit etc
             no internet access given

2) Grab WPA handshake

3) Sniffing: provide internet access, then be MITM

4) Simple web server with dnsspoof: redirect the victim to your webpage

5) Karmetasploit

6) Browser_autopwn

1) Relies on auto-connections ie the device connnects without the owner being aware. You can then attempt to exploit it. Target the fake-AP ESSID to something the device has likely connected to previously eg Starbucks WiFi

2) Sometimes it is quicker to steal the handshake than sniff it passively. Set up the AP with the same name and channel as the target, and then DOS the target. Airbase will save a pcap containing the handshake to /root/PwnSTAR-n.cap.

3) Provides an open network, so you can sniff the victim's activities.

4) Uses apache to serve a webpage. There is an option to load your own page eg one you have cloned. The provided page (hotspot_3) asks for email details. Note the client is forced to the page by DNS spoofing. They can only proceed to the internet if you manually stop dnsspoof. DNS-caching in the client is a problem with this technique. The captive portal in the advanced menu is a much better way of hosting hotspot_3

5&6) Provides all the config files to properly set-up Karmetasploit and Browser_autopwn.

Advanced Menu

a) Captive portals (phish/sniff)

b) Captive portal + PDF exploit (targets Adobe Reader < v9.3)

c) MSXML 0day (CVE-2012-1889: MSXML Uninitialized Memory Corruption)

d) Java_jre17_jmxbean

e) Choose another browser exploit

a) Uses iptables rules to route the clients. This is a fully functioning captive portal, and can track and block/allow multiple connections simultaneously. Avoids the problems of dns-spoofing. There are two built-in web options:

1) Serves hotspot3. Does not allow clients onto the internet until credentials have been given.

2) Allows you to add a personal header to the index.php. You could probably copy the php functions from this page onto a cloned page, and load that instead.

b) A captive portal which blocks the client until they have downloaded a pdf. This contains a malicious java applet. Includes a virgin pdf to which you can add your own payload.

c&d) Launches a couple of example browser exploits

e) Gives a skeleton framework for loading any browser exploit of your choice. Edit PwnSTAR browser_exploit_fn directly for more control.

Nexus

NAV 2013 - cumulative update 16 Released.

Crow is C++ Microframework for Web (inspired by Python Flask)

3-D Scanning Firm Matterport Raises $16 Million More to Speed Up Mobile Plans

For Taylor Swift, the Future of Music Is a Love Story

Academically Adrift: Limited Learning on College Campuses

Another colour trade mark dispute: Langenscheidt vs Rosetta Stone (Yellow)

PwnStar - Script for multi attack (for all your fake-AP needs!)

Usage

Basic Menu

Advanced Menu

Reverse exe dll files

Forcing the use of a Proxy

Recent Posts

Facebook