
Network Hacking 175
Wrighter the Pessimist writes: "In this article on Yahoo, they report that computer hacking has become easier, partially because of devices that have built-in computers, like printers and playstations. However, it also lists a number of 'ordinary' (obsolete?) methods of 'hacking' - such as gaining physical access to a corporate computer, and social engineering. It would be interesting to see a study done on this, to see how many attacks are actually carried out from such devices." The article touches on the Dreamcast Attack mentioned the other day, but also some slightly less bulky approaches. Be on the lookout for dark-clad intruders slipping CD-Rs into machines at your workplace ...
Obsolete? (Score:5, Informative)
As long as there are people, social engineering will work wonderfully.
Re:Obsolete? (Score:2, Insightful)
Re:Obsolete? (Score:1)
Re:Obsolete? (Score:2)
They day social engineering is obsolete is the day there are no more humans and computers rule the world.
This is true. A lot of the most successful modern worms and virii are based largely on a social engineering concept -- trying to get people to do something that will compromise their machine. Love Bug, Klez, Sircam all rely on trying to trick people into clicking on an attachment to launch their payload. They masquerade as legitimate e-mail from people you know and hope you're dumb enough to fall for their tricks. That sounds like a form of social engineering to me.
Re:quit it. go outside. (Score:2)
Hey! I'm in a bar waiting for a woman to show up.
The guy a couple seats down is trying to hack me, so it's kinda fun.
I think NY is getting geeky.
Re:quit it. go outside. (Score:1)
Pot..kettle...black...any of this ringing a bell?
Re:quit it. go outside. (Score:1)
I'm married, I have a reason to be on slashdot on saturday =)
Re:quit it. go outside. (Score:1)
Comment removed (Score:4, Insightful)
Other avenues of attack . . . (Score:3, Interesting)
Those viruses and trojans slip neatly by all the elaborate MS Exchance server based virus scanners we have.
And since this is a non-technology sector corporation, they try to cut costs where ever they can, which means McAffee virus scan on the local computers, which has caused so many conflicts between the latest virus definitions and programs like Microsoft Word that most end users tend to turn automatic virus checking off without permission.
In the end, social engineering will never be "obsolete".
Re:Other avenues of attack . . . (Score:1)
Re:Other avenues of attack . . . (Score:1)
How true. It need not even be hotmail or some such. Just send in something that looks like a resumé that does the job.
Re:Other avenues of attack . . . (Score:2)
No, I don't work for them. Yes, we are a customer.
Re:Other avenues of attack . . . (Score:2)
It only took about two hours after the block for Human Resources to give us a frantic call to unblock those sites.
As I mentioned, my company is a non-tech sector based company, so the IT department is seen as an unwanted, but necessary evil. And of course, all but two of the higher level executives complained on end about not being able to check their AOL accounts at work.
And that's another area of attack. The number of executives who put a copy of AOL on their corporate laptops to access personal AOL accounts from home and on the road is insane. And then there's the small remote properties which have access to our network through Citrix, who invariably have a copy of AOL running, often with more spywared software than I care to think about.
It all comes back to the simple fact that human nature and social engineering are the weakest links.
Re:Other avenues of attack . . . (Score:1)
While this will stop the 99% of people harmlessly using webmail, it will not touch the 1% who're technically clued and determined to get around it, be it to just read their mail, or to do malicious damage.
I have admin'ed several websense boxes (as well as multiple other proxies.) I am a network/security consultant, and the first point I make to any of my customers who want to use an internet control mechanism (i.e. filtering proxy) is that anyone sufficiently determined will get around it--don't try to solve non-technical problems with technology.
In short, websense makes managers feel good, but it does not work. It doesn't work for SSH port forwarders, it'll work even less once distributed proxy avoidance toys like Triangle Boy gain widespread use, and it'll completely break down once .NET and friends get spinning (read the part where proxy avoidance is explicitly mentioned in .NET docs.)
At this point, I should probably mention that almost all filtering software works very similarly, that is, it draws from combinations of blacklists meticulously compiled by cat-eyed librarian types trolling for smut, keyword lists, file extensions and content signatures (breaks down with encrypted files, unless you just want to block everything you don't recognize) and sometimes some sort of gymcrackery involving content pattern matching (such as the company claiming to be able to detect porn pictures from the amount of flesh.) The latter rarely work correctly.
That said, you're just as well off using something free, like DansGuardian [dansguardian.org] or SquidGuard [squidguard.org] with one of the myriad of free filter lists they link to--assuming you can give your management the same feelgood effect from something free or cheap that they'd normally get from forking out $30k upwards to a company like WebSense.
By the way, did I mention that there is no IDS product which can consistently and reliably detect HTTPS-tunneled SSH traffic based on packet (or even stream) signatures?
In short, your idea for blocking webmail sites works, as long as your only goal is to prevent the casual user from getting at viruses and other Bad Things (tm) by means other than the corporate sanctioned means, like your local Exchange server. Good Luck! :-)
Re:hmmm (Score:1)
Breaking a Network's security Restrictions can be made difficult, it's just not easy to put the proper restrictions in place on an M$ Product like 2K or XP.
Re:hmmm (Score:1)
Which under Windows is an immensly fun system that checks to make sure the file name is the same.
Heh.
Amazing how many programs still work after being renamed to calc.exe
Re: (Score:2)
Re:hmmm (Score:1)
When some compilers compile, they store the "original" name somewhere in the binary - MS compilers do this for sure.
Of course there is always the most extreme case scenario of a person making a custom tool to break into your system, allowing them to compile it with whatever name they want to.
CRCs or such would help, but even those can be worked around, though with an immense amount of difficulty.
I remember an article on slashdot quite a while back about a mathematical proof showing that once physical access was gained to the machine, nothing could stop security from being broken down eventually. Though in the most extreme of cases it may take many years and many millions of dollars worth of equipment. ^_^
Re:hmmm (Score:1)
It's hard to stop someone putting that disc in, but it's very easy to disable autorun for data discs. (Music can still start automatically, if you want that) It can probably be done by the admin via a policy file, so no user needs to be trusted. No problem there.
Re:hmmm (Score:1)
Re:hmmm (Score:1)
Re:hmmm (Score:2)
Then I burned an autorun CD that would kill their screensaver when popped in to their CDROM drive. I very rarely ran in to a workstation with autorun disabled. What I usually got was quick desktop access and often a customer comment card thanking me for the quick turn-around.
why bother with autorun CDs? (Score:2)
Re:why bother with autorun CDs? (Score:2)
The autorun CD would be much easier than rebooting the machine and definitely tipping off the user that their machine has been used to do something. You'd also face the possibility of passwords on the CMOS setup screen and the system bootup. Then you face even more frustration when you finally do get it to boot up and it comes up in OpenBSD or Linux instead of Win98 and LILO has a password on it so you can't just go use a different init to bypass it without entering a password. Ho hum. Not to mention you can't pull the drive out physically and swap it because the damn user has padlocked the case cover shut. These crazy users!
Re:hmmm (Score:2)
He called it "Black Hat Linux". Them were crazy times; it was a wonder girls wouldn't talk to us.
Re:hmmm (Score:2)
Nobody noticed - or if they did, they realized they couldn't complain without tipping us off that they were installing games | stuff | whatever.
Re:hmmm (Score:1)
Firewall logs, histories, all sorts of junk.
Stealing Secrets 101 (Score:5, Insightful)
If doing this for a living rather than being a sad muppet who thinks its "cool" (Snowboarding is cool, Skydiving is cool, hacking IIS is not cool).
1) Buy people, rival firm has a product you need to sabotage... well hire their best brains so it turns out shit... and you get the product as well.
2) Have a clipboard, 99% of companies and people in those companies will not query a suit with a clipboard. This gives you the ability to walk into any areas saying you are doing a "Time and motion" study for the new Quality Iniative. Or do an "assets" audit and take away servers for "verification" that aren't on the "official register".
3) Buy the people
4) Have someone join as a graduate, or even as a more senior person. Sure it violates their contract, but just pay them the cash.
5) Supply the network upgrade at low low prices via a subsiduary, then ensure they can be "remotely administered as part of the outsourcing and support deal".
6) Buy the people
7) Walk into PC support, ask for a backup of your server from date X put onto new server Y. Or even better just get the required files burnt onto CD. Sure you have to fake the paper work, but that isn't hard.
All of these will be more effective than hiring script kiddies.
WARNING: Do not try the above at a military base, unless you want to get shot, corporations will normally just have you prosecuted.
Strangers accessing the network... (Score:4, Interesting)
At my local Walmart, the store's network backbone is located 20 feet from the door leading to the backstock room. There are no obtrusions (except for the occasional six-wheelers with merchandise), and the door's always open. Three-quarters of the time, there's no one in the room, and even if there is, it's typically a low-end manager (the high-end managers like to stick with their own offices) who don't know about how computers work. There's only a "regional" administrator...Walmart feels it's more efficient to let the machines work on their own and pay someone only when the machines don't work.
All you need to do is look young, wear kahki's and a polo shirt, and carry your "geek-bag-o-goodies", and no one will question you being there. As long as you look like you know what you're doing, no one will think otherwise. In fact, there was even one time where I walked in there completely unanounced just to use the telephone (I work for a vendor, not for Walmart). A manager saw me as he walked on by outside the room, and had no problems with me being in that room.
Now, realize that the computer network at Walmart controls everything...the lights, heating, TV / Radio / Announcement systems, the ATM network, evertything. Every Walmart has a satellite hookup to the mainframe (no idea where that is).
My point is that people are way to afraid that someone's going to get them by hacking into the computer, while no one's worried at all about someone walking in and getting them from the inside. There are some wide-open doors when it comes to internal network security (or lack-thereof), and it doesn't take a Hollywood actor to pull off a slip into the server room of almost any company.
Re:Strangers accessing the network... (Score:2)
I do know that it's a pain in the ass when Home Office turns off all the store systems on sundays during christmas season, because it thinks that the store is closed.
Regarding physical security to the store server, it was usually quite good. Only one door in, and that was almost always locked. Any non-manager, non-accounting personnel had to be escorted by a manager anytime they were there. I don't know if that's just a quirk of that store, or if it's corporate policy. All I know is that I like a fulltime job in a small business (nice little camera shop) a hell of a lot better than being a Walmart electronics monkey.
Re:Safeguarding Secrets 101 (Score:3, Informative)
1) Buy people, rival firm has a product you need to sabotage... well hire their best brains so it turns out shit... and you get the product as well.
Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.
2) Have a clipboard, 99% of companies and people in those companies will not query a suit with a clipboard. This gives you the ability to walk into any areas saying you are doing a "Time and motion" study for the new Quality Iniative. Or do an "assets" audit and take away servers for "verification" that aren't on the "official register".
Our facility, though comprising over 300 people, functions as a closely knit team. Nobody unknown to us gets past the lobby, clipboard or not.
3) Buy the people
Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.
4) Have someone join as a graduate, or even as a more senior person. Sure it violates their contract, but just pay them the cash.
Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.
5) Supply the network upgrade at low low prices via a subsiduary, then ensure they can be "remotely administered as part of the outsourcing and support deal".
We manage all our networks internally. An "outsourcing and support deal" would be laughable.
6) Buy the people
Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.
7) Walk into PC support, ask for a backup of your server from date X put onto new server Y. Or even better just get the required files burnt onto CD. Sure you have to fake the paper work, but that isn't hard.
All of our change requests are managed electronically. To "fake the paperwork", you'd need access to a logged-in system, an acccount on the change management system, and you'd have to show up the next morning to represent your request at the daily change control meeting. Also, we manage our own backups. Nobody unkown to us would ever request one.
All of these will be more effective than hiring script kiddies.
None of these would be any more effective than hiring script kiddies. (Funny story: just this week a script kiddie was caught pounding one of our IPs. Security tracked him down and printed out a desist request on a printer on the kid's network. The attacks stopped a few minutes later.)
Re:Safeguarding Secrets 101 (Score:2)
Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.
I fail to see your argument here. for a large sum of money I would have a very hard time doing the "right thing", even involving murder, theft, etc. Perhaps I'm cynical, but I feel everyone has a price and it's typically not much more than a few million.
Working for a great company is one thing, but making enough to never have to work again is, in a word, priceless.
Re:Safeguarding Secrets 101 (Score:2)
Anyway, who's going to pay you "several million" to "never have to work again"? The whole reason that money's out there to begin with is they want you to work for them, instead of the competition.
Re:Safeguarding Secrets 101 (Score:2)
The whole reason that money's out there to begin with is they want you to work for them, instead of the competition.
I'm sorry,perhaps I misread the previous comments. My understanding what not that a company wanted to steal away employees as much a sabotage the competion. In the case of sabotage you most certainly would pay a large amount to never see a certain rival company's employee ever again.
what!!? (Score:2, Funny)
holy SHIT!
im taking it back to the shop before a fucking TERRORIST hacks into it
Re:what!!? (Score:1)
Linksys Vulnerabilities? (Score:1, Interesting)
Serious question [I thought about submitting to Ask Slashdot, but this thread should be just as good]: We've been using a LOT of Linksys devices (NAT routers, wireless access points, etc.). Does anyone have any info [preferably with URLs] about Linksys security vulnerabilities? Thanks.
Re:Linksys Vulnerabilities? (Score:1, Funny)
Re:Linksys Vulnerabilities? (Score:1)
The article's a bit late (Score:5, Funny)
Changing passwords often (Score:1, Insightful)
Printer trojans (Score:5, Interesting)
Postscript is a pretty powerful programming language, and most printers today have it embedded. While I don't think it has TCP/IP capability yet, it wouldn't surprise me if someone doesn't find a stupid reason to implement at feature into the printer language, or even something that allows more low level control of the printer hardware could be used to gain access to the network. Remember people, it doesn't have to be easy. Virus/Trojan writers pride themselves on invading the bold new frontier. Don't get complacent.
As more appliances get network connectivity and more flexible embedded processors and operating systems, they'll all be subject to the same concerns. I'm already addressing some of these issues with my simple home automation projects. The computer I use to control things is isolated from the rest of the network other than the single open port for commands. Despite the security I might have implemented on my network, I can't assume that the network is always safe. And while right now I only have lamps and sprinklers on this system, when more complex (and potentially dangerous) appliances get added, a comprised system becomes a serious liability.
-Restil
Re:Printer trojans (Score:1)
Re:Printer trojans (Score:2)
for those that can't remember the venerable ANSI.SYS: you could remap keys to do something completely different. i.e. map the enter key to do 'echo y | deltree c:\*.*', or the obvious format c: equivalent.
I used ANSI.SYS for my ueber kewl customized prompts of course :)
Re:Printer trojans (Score:1)
Re:Printer trojans (Score:1)
Security History 101 (Score:1)
nothing is unhackable (Score:2)
crack a mac (Score:2)
Dark-clad intruders? (Score:4, Funny)
You mean outsourced sysadmins? Yeah them's a nasty lot.
Related article, also on Yahoo! (Score:3, Interesting)
Dark clothes (Score:3, Funny)
Who started this crap anyway? All bad guys must wear stereotypical clothing?
Re:Dark clothes (Score:2)
Re:Dark clothes (Score:2)
hard access? Hmm... (Score:1)
Social Hacking (Score:1)
Any Ideas?
Re:Social Hacking (Score:1)
I suggest you gain some social skills first. A good start is to go outside and meet "normal" people, or dating girls. Hope this help!
Then he would not blend into the server room, duh.
Just another Nerd, not out of place, but a normal person in a server room? Woooh now, hoooold on!
Gee, hacking is dangerous (Score:1, Troll)
All these "what if" scenarios and "theoretical" hacks, and very little in the way of real world demonstration.
Now Printers are vulnerable....but I didn't see or read about any demonstrations that showed how to determine what printer was on a network, how to get into that network and how to "own" a printer, and what could be done after the printer was compromised. Did anyone do an nmap -sS -O on an IP of a Lexmark 1200 to see what processor and OS came up?....doubtful. Anyone demonstrate how to connect and get a banner and prompt with netcat? (if they did, what would they do, print with only magenta or screw around with the queue?)
I'd worry more about the fact that they got on the network in the firt place than the fact that they could take over the printer.
And the CDROM attack...A Hacker could mail a CDROM and get it to install on a PC because some luser is curious? Yah, I suppose. Or the sysadmin could make accounts in NT and W2k that doesn't allow programs to be installed...hell, they don't even have to allow CDROM access.
Maybe they should testify before congress and claim that they can bring down the internet in 30 minutes from a HP Plotter, or that Osama Bin Laden will now mail CD's promising free "Click Art" to unsuspecting secretaries around the US with a thing for "Precious Moments" themes. Because Congress will shovel any amount of money to greedy bastards wearing a propeller beanie, and talking about things they know nothing about.
Ironic that these guys often start out by breaking into places, then demanding alot of money to protect the world from people like them, and then advocating jail time for future business competitors down the road.
Re:Gee, hacking is dangerous (Score:3, Funny)
Suppose, nothing! these guys [aol.com] do it all the time!
That's a 1337 hack (Score:3, Funny)
I'd really like to see that ... I'm curious as to what kind of axe is used.
Re:That's a 1337 hack (Score:2)
Not panicing... (Score:2, Funny)
Now I had thought that was a reflection of the mean streak in management.
Now I learn that its a security precaution. That's alright then.
Patrick
famous quotes (Score:1, Funny)
There's a market for 3, maybe 4, computers in the world.
DMCA will foster innovation.
Social engineering is obsolete.
Uh oh, possible future FUD avenue... (Score:1, Interesting)
How long until our favorite company (ahem) uses this to spin some tale about how the "signed OS" BIOS replacement is the right way to go? "Get this, and you don't have to worry about rogue hax0rs".
Unfortunately it also lets them tighten their grip like with the DRM stuff that keeps coming up. Blah.
Re:Uh oh, possible future FUD avenue... (Score:1)
Social engineering? (Score:1)
As for these small devices that people use to "hack", I largely doubt there is much to worry about.
Re:Social engineering? (Score:2)
and whats even worse is when they use the same password for lots of accounts. Just one accident with a keystroke recorder or social engineer and they've given someone else access to everything.
uneducated users (Score:4, Interesting)
There are users I call who hand over the same information without any thought. Most of the time, I am there busy telling users to please not give me that information. The comparison of the username/password being like an ATM card and pin just doesn't work.
Our abuse department (yes we have one) has a two strikes and you're out policy. That is to say, if anything happens from your account the first time, you are given a warning and forced to read the entire IT policy. The second time, you account is deactivated in effect terminating your employment/affiliation with the university. You pretty much need your account for everything.
This issue has been spoken about for years and things rarely improve, but I still believe educating users is the best way to eventually solve the problems here.
What is the point of the news story? (Score:2)
You can get unauthorized access to a network easily by gaining physical access first.
As computers proliferate and approach ubiquity, security becomes a larger issue.
These are the central themes I identified. This is not news. It is hardly even analysis.
Actually, it struck me more as a kind of public service announcement designed to raise levels of awareness.
Social Engineering is still the biggest threat (Score:2, Informative)
Recent example - we were converting 17 years of production data from a mainframe into a the replacement system. With the volume, we needed an uninterrupted 40 hour window, but the client performed a cold backup of the database nightly.
The process in place says we call the production DBA's (who know us, and are employees, not contractors like us) and they pass official word to the operators in the datacenter.
Well, after 9 hours of loading, the database goes down at 5:00am. We call the prod dba's, and the on-call guy doesn't answer. So I call the ops center. The story I get is that a contractor on another project requested a backup of some critial files stored on the db box. He did this directly with the operator at 11:00 the night before, and the operator didn't even remember his name.
If a simple phone call to ops is all it takes to take the system down, why bother with the standard exploits?
I can just see (Score:3, Funny)
Spammers going after a network printer...
loop (1..1000)line.font = bold;
line.size = 18pt;
line.output = "Need more toner? Call us at ###-####"
line.pagebreak
endloop()
When *was* it hard? (Score:1)
Cant hack into a Mac OS! NEVER done once (BugTraq) (Score:1, Interesting)
I know some indication of that particular news piece is regarding cheap local machine packet grabbing, not WAN exploits, but the fact is still the same, no Mac OS 8x or 9x have EVER once been rooted.
In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.
That is why the US Army gave up on MS IIS and got a Mac for a web server.
I am not talking about BSD derived MacOS X (which already had a couple of exploits) I am talking about current Mac OS 9.x and earlier.
Why is is hack proof? These reasons
1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT
2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root their is no false sense of security.
3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not.
4>: Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not file name extension).
5> Macs never run code ever merely based on how a file is named. ".exe" suffixes mean nothing. For example the file type is 4 characters of user-invisible attributes, along with many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For example file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable by designof creating an executable file. The file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually. TOTAL security.
4> Stack return address positioned in safer location than some intel osses. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.
7> There are less macs, though there are huge cash prizes for cracking into a MacOS based WebStar server. Less macs means less hacker interest, but there are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes, so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc). But some huge high performance sites use load-balancing webstar
8> MacOS source not available traditionally, except within apple, similar to Microsoft source availability to its summer interns and engineers, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.
Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.
One 3rd party tool created the only known exploit backdoor in mac history and that was back in 1995 and is not, nor was, a widely used tool. I do not even know its name. From 1995 to 2002 not one macintosh web server on the internet has been broken into or defaced EVER. Other than that event ages ago in 1995, no mac web server has ever been rooted,defaced,owned,scanned,exploited, etc.
I think its quite amusing that there are over 200 or 300 known vulenerabilities in RedHat over the years and not one MacOS 9.x or older remote exploit hack. There are even vulnerabilities a month ago in OpenBSD.
Not one exploit. And that includes Webstar and other web servers on the Mac.
--- too bad the linux community is so stubborn that they refuse to understand that the Mac has always been the most secure OS.
BugTraq concurs.
Re:Cant hack into a Mac OS! NEVER done once (BugTr (Score:1)
The big problem with RedHat is that by default, the box is HIGHLY unsecure. Lots of stuff running and possibly hackable.
And even if all you say is surely true, you are wrong, the most secure server is not a MAC.....It's simply the system that is managed by a good admin. I'm pretty sure 95% of the hacks were made possible because the admins didn't do their work( like updating the packages ).
Hacking? You mean vandalism? (Score:2, Insightful)
Even if we were to give up the battle over the original meaning of the word (a concession I do not make), the meaning being propagated by the media seems deliberately designed to cause confusion. When the same word is used to refer to (a) exploring and/or modifying a system you own, (b) breaking or bypassing the security features of a system someone else owns, and (c) breaking into and vandalizing a system someone owns, it gives the impression that anyone who does any of these things is a criminal -- or, conversely, that anyone who vandalizes someone else's computer system is just having a little innocent fun.
If you want to talking about someone breaking into someone else's computer system, call it what it is -- trespassing. If you want to talking about someone deliberately modifying someone else's computer system without permission, call it what it is -- vandalism.
Sega at work. (Score:1)
gaining physical access for DOS attacks (Score:1)
this hi-tek method consists of unpluging a server or network cable.
FDISK (Score:1)
Re:FDISK (Score:2)
Web server written in PostScript (sources) (Score:3, Interesting)
As it points out, you can't listen on any port you want, because PostSCript lacks the ability to open sockets, post listens, or accept connections.
On the other hand, a few modifications, and it can listen on the LPR port of an HP network printer (all it has to do is intecept new connections, not listen or accept by itself).
-- Terry
Wow. (Score:1)
To be fair, any hacker who can slip a CD into an iPaq deserves net access from whoever they choose...
The Grammar Nazi Speaks (Score:1)
I believe that you mean "whomever".
Re:Wow. (Score:2)
Social Engineering (Score:1)
Five minutes later, we had a new password. I wasn't asked for an invoice number, name, or anything. I was a little worried. Should ISPs and such start taking 'hints' and stuff (mother's maiden name.. etc)?
Personally, I think it's a dilemma. Customer service reps think that since someone went to the effort to call, they must be the account owners. It's no surprise Kevin Mitnick knows more about the Vegas phone system than the phone company does! Ask, and ye shall receive. Someone else ask, and they shall receive too. :(
Social engineering obsolete? (Score:1)
Hi! (Score:2)
Re:news? (Score:2, Troll)
Kierthos
Re:news? (Score:1)
Re:news? (Score:1)
Kierthos
Re:news? (Score:2, Insightful)
Some people avoid to call some contemporary music "Rhythm and Blues", because there was a different style of that name before.
I avoid to call malicious hackers just hackers, because hacking is fun, a healthy sport for both yourself and the society you live in.
If you think I am wrong, search the web for the Jargon File. It points to some good reading about the history of the term.
--
Re:news? (Score:1)
Knowing where bugs and vulnerabilities exist and publishing them to the general public as to what's going on with a particular IT vendor is aiding and abedding criminal activity?
Shouldn't it be creating software/hardware with bugs and vulernabilities be illegal?
Re:news? (Score:2, Insightful)
Likewise, someone who publishes bugs and vulnerabilities with no actual interest in seeing those fixed should be hammered as well. I mean, if it's a cracker or a script kiddie who is publishing vulnerabilities so that other crackers and script kiddies can exploit them, well, that's just as bad as not fixing the vulnerability. If it's someone publishing them with the intended purpose of having them fixed, again, different circumstances.
Kierthos
Re:news? (Score:2)
Re:news? (Score:2)
By definition, a script kiddie is not publishing exploits.
Re:news? (Score:1)
Non-terroristic Americans always obey and support the law 100%.
Civil disobedience is often necessary. Or do you think that Martin Luther King, Jr. and all the other people in the Civil Rights movement during the last half of the past century are terrorists? When a law is wrong you have to speak up and say so. When speaking up gets you in trouble with the law, then civil disobedience and protest is the next avenue. If that doesn't work, actual revolution may be needed.
This is embedded in our political tradition. If you don't think so, here's what the Declaration of Independence says:
When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature's God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the separation.
In other words, if there is just cause it is okay to do things that the American Colonists did, the protests (Colonists went to England to plead the case with the King and Parliament), the civil disobedience (The Boston Tea Party), and finally to revolt, if need be.
When we see our civil liberties and privacy removed by our government and large corporations we have a civic responsibility to stop it, as do all like minded people.
Re:"With printers, attackers dont even have to ent (Score:1)
My radio signals aren't going anywheres.
Re:Password Rememberers/Managers etc. (Score:1)
Do you have some evidence of this, or is it just a joke? Since you said all closed source password-managing programs do this, I presume you have a great deal of evidence.
Re:Password Rememberers/Managers etc. (Score:2)
Re:Password Rememberers/Managers etc. (Score:2)