I want to go to the Black Hat
June 12, 2008
Trip to BlackHat 2008
I’m hope my corporate master will let me go to the Blackhat and Defcon training/convention this year. I doubt it since “Massa” Corporate isn’t in the business of giving out anything that the gubment hasn’t paid for. Then again… they did offer to pay my way through a Masters degree program provided I stay with them for the entire time. Over all, they are not a bad lot… I’ve dealt with much worse that is for certain.
If I go to BlackHat 2008, I’ll probably attend Security Horizons, NSA Information Assurance Management course.
Popularity: 1% [?]
Bruce Schneier’s Defcon Badge Goes for $200+
August 18, 2007

Get off of Bruce’s dick..
I was hoping to snatch it up for $3. To my surprise, it is over 200 duckets! The hell with that.
Popularity: 3% [?]
Point and click Gmail hacking at Black Hat
August 4, 2007
This hack uses sniffing on a network:
The attack is actually quite simple. First Graham needs to be able to sniff data packets and in our case the open Wi-Fi network at the convention fulfilled that requirement. He then ran Ferret to copy all the cookies flying through the air. Finally, Graham cloned those cookies into his browser – in easy point-and-click fashion - with a home-grown tool called Hamster.
The counter to this is to NEVER login at open networks (particularly the blackhat and for the love of all things holy and good NEVER login without encryption at the defcon)
td daily - gmail hack @ blackhat
Popularity: 3% [?]
Howto Say the IPV6 Number
December 12, 2006
If you didn’t know, IPv4, the current network layer protocol used on the Internet is due to be replace with a new networking protocol called IPv6. IPv4 is a 32-bit addressing scheme that allows 4,294,967,296 possible unique addresses. IPv6 is a 128-bit addressing scheme that allows much more.
This is the number of possible IPv6 numbers that are possible:
340,282,366,920,938,463,463,374,607,431,768,211,456
And here is how to say the number.
340- undecillion
282- decillion
366- nonillion
920- octillion
938- septillion
463- sextillion
463- quintillion
374- quadrillion
607- trillion
431- billion
768- million
211- thousand
456
HOW BIG IS THAT REALLY??!
2^128=340,282,366,920,938,463,463,374,607,431,768,211,456 = 3.4×10^38
– 50 octillion addresses for each of the 6.5 Billion people on earth
– Every atom in the human body could have IPv6 address
– Windshield wipers on your car may have and IPv6 address (every device can be “pingable”)
Pros and Cons of IPv6:
CON
• Lack of migration plan
• Definition of “compliance”? (dod)
• Long address (2001:0000:1080:8c88:8:800:200C:417A)
• Security issues
• No tools to check IPv6 packets, so this exploit has no way to be stopped yet
– Windows XP supports IPv6 but the SP2 firewall would not detect rogue data inside ICMPv6 packets
PRO
• ipv6 for everything
• Japan already on top of it
• Help countries like China and India
Here are some other interesting numbers:
Popularity: 3% [?]
Technorati Tags: IPv4, IPv6, undecillion, decillion, nonillion, octillion, septillion, sextillion, quintillion, quadrillion, trillion, billion, million, thousand
Pirates Vs. Ninjas
September 29, 2006
PIRATES
A pirates mission statement is to rape and pillage. They steal as a way of life. Morals and values be damn. A pirate would steal from his own mother if she left her guard down. He would take advantage of his sister if she had the booty. New pirates really don’t appreciate anything. Some pirates steal because they really do appreciate a quality product. Some of these pirates are activists for individual freedom. They live by the code and freedom of the sea/nature. To them ownership and property is an illusion created by man. These are the most devious types of pirates who usually end up being captains of ships full of pirates. If these pirates ever get caught it will usually be too late because they will have already exploited, liquidated and stolen so much that most assets they have pilfered will never be recovered. Furthermore, they are probably completely beyond being rehabilitation by external means such as torture, imprisonment or indoctrination into high society.
NINJAS
A ninja, on the other hand, lives and dies by a code because of this they can be very dangerous. They have a certain belief that they are willing to kill for. Assassination is what the ninja is trained to do. They sneak in silently, make the kill and get out quickly without a trace. A great ninja will only be detected by the absence of evidence. You will only know that they were there if they want you to know. To the untrained eye, the ninja’s target died of natural causes. The ninja’s skill is a thing of deadly grace and beauty like a black widow spider. The especially good ninjas have an almost spiritual code and mental discipline that gives them seemingly supernatural powers. To the lay person, ninjas don’t exist, they are just ancient legends. If someone brags about being a ninja they are more than likely NOT a ninja. A ninja is so close to the edge that they are love, hated and feared by those who know they exist. Contrary to popular belief, not all ninja’s are evil. Some ninja’s are mercenaries, some ninjas only kill bad guys, some ninja don’t kill at all… but they could if they wanted to.
Popularity: 2% [?]
What is a Hacker?
September 14, 2006
“A hacker is someone who thinks outside the box. It’s someone who discards conventional wisdom, and does something else instead. It’s someone who looks at the edge and wonders what’s beyond. It’s someone who sees a set of rules and wonders what happens if you don’t follow them. A hacker is someone who experiments with the limitations of systems for intellectual curiosity.”
The above is a quote from crypto living legend Bruce Shneier’s book, Beyond Fear. This is exactly how I feel about hacking. Hacking is a major asset to Information System Security… if fact is THEE only real asset. I’ve had arguements with some of my peers about this. Information Security Pro vs. Hacker. If the typical information system security pro doesn’t get smart on hacking (security/programming) techniques, security will continue to be a losing battle. Cyber criminals have no problem learning the latest exploits, they have no boundaries and this gives them a “superpower” against security professionals. Some Information security professionals, on the otherhand, restrict themselves by categorizing hacking as bad. They see it as unethical and not responsible.
It is unethical and not responsible to NOT know hacking techniques that might exploit a customers system.
Thanks for the post Bruce. I hope you will make another appearance at the Defcon.
read more | digg story
Popularity: 4% [?]
Defon14 was great!
August 13, 2006
There was a lot of great stuff at Defcon 14.
The last Defcon that I went to was Defcon11 in 2003. Defcon 14 has grown quite a bit since then. According to DarkTangent it was about 7000 geeks/hackers/security pros/phreaks strong. The great thing about this particular Defcon was the change of venue. Defcon 11 was at Alexis Park. This one was at the Riviera hotel.
Many of the rooms at Alexis Park had no A/C. The worst thing was that many of the rooms would get packed and have to turn people away. At times it seemed that this might cause a riot!
As far as I know, only one room got too packed this time it was “Googling: I’m Feeling (un)Lucky” by Greg Conti.
I have a lot of favorites but what stands out for me was “Beyond Social Engineering: Tools for Reinventing Yourself” by Theime Richard. He had interesting ideas about the importance of integrating spirituality into your life to balance the difference personality profiles and life changes that happen more and more in a world of fast moving technology. He discussed modifying your persona with reference to your “meta-self”, or hacking yourself. Very interesting and insightful.
I loved all the breifings on privacy and the legal battles against the government and AT&T. I will definitely be getting involved.

Others that stand out are The Making of atlas: Kiddie to Hacker in 5 Sleepless Nights, by atlas. I thought it was a great introduction to REAL hacking, which is pretty damn hardcore. Atlas and his team 1stPlace actually won Capture the Flag, the main event at Defcon.
There was S. Korean team their that got honorable mention, since the flew all the way around the world just to play the game.
Popularity: 2% [?]
Defon14 was great!
August 7, 2006
There was a lot of great stuff at Defcon 14.
The last Defcon that I went to was Defcon11 in 2003. Defcon 14 has grown quite a bit since then. According to DarkTangent it was about 7000 strong. The great thing was the venue. Defcon 11 was at Alexis Park. This one was at the Riviera hotel.
Many of the rooms at Alexis Park had no A/C. The worst thing was that many of the rooms would get packed and have to turn people away. At times it seemed that this might cause a riot!
As far as I know, only one room got too packed this time it was “Googling: I’m Feeling (un)Lucky” by Greg Conti.
I have a lot of favorites but what stands out for me was “Beyond Social Engineering: Tools for Reinventing Yourself” by Theime Richard. He had interesting ideas about the importance of integrating spirituality into your life to balance the difference personality profiles and life changes that happen more and more in a world of fast moving technology. He discussed modifying your persona with reference to your “meta-self”, or hacking yourself. Very interesting and insightful.
I loved all the breifings on privacy and the legal battles against the government and AT&T. I will definitely be getting involved.
Others that stand out are The Making of atlas: Kiddie to Hacker in 5 Sleepless Nights, by atlas. I thought it was a great introduction to REAL hacking, which is pretty damn hardcore. Atlas and his team 1stPlace actually won Capture the Flag, the main event at Defcon.
There was S. Korean team their that got honorable mention, since the flew all the way around the world just to play the game.
Popularity: 1% [?]
Cisco to be under scrutiny again at Black Hat
July 21, 2006
“Cisco Systems Inc.’s products will again come under scrutiny at this year’s Black Hat USA 2006 conference, which kicks off later this month in Las Vegas. Conference organizers say that 15 new exploits will be discussed at this year’s event and that two of them target NAC (Network Admission Control).”
Now if Cisco had any understanding of the importants of transparency with the technical community in this age of free information, they would break this news themselves and have solutions and mitigations to fix it. Instead they are too worried about the bottom line (the shareholders) which will take a hit anyway once the media gets a hold of it.
Mr. John Chambers, despite the security issues you’ve got great products, but get a clue about how to deal with these problems.
Popularity: 2% [?]
The Dark Tangent Says we are all DOOMED!!!
July 20, 2006
The Dark Tangent (Jeff Moss) president of the DEF CON hacker conventions is interviewed on CyberSpeak podcast and talks about the change in venue from Alexis Park to the Riviera Hotel and Casino. In response to the question, “who will protect our privacy from big business?”, he responds, “we are all doomed!”. Great interview!
Popularity: 2% [?]






