Found this site via del.icio.us. Pretty good post:
“SQL Injection” is subset of the an unverified/unsanitized user input vulnerability (“buffer overflows” are a different subset), and the idea is to convince the application to run SQL code that was not intended. If the application is creating SQL strings naively on the fly and then running them, it’s straightforward to create some real surprises.
SQL Injection @ unixwizÂ
The official Certified Ethical Hacking course material identifies three types of hackers:
Black Hats: criminal hackers
Grey Hats: hackers that find exploits because they want to (not for good or bad intentions)
White Hats: hired penetration testers
The media and many parts of the information security profession lumps all ‘hackers’ into one big box labeled “criminals”. I used to think this way as well until I went to Defcon. It was a real eye opener. I saw hackers who want to do something good for the consumners. I saw several government agencies attempting to hire the best and brightest hackers and of course, I saw hackers that may very well have been working on the darkside. The point is that “hacking” itself is the just a technique to find, and exploit weakness in a given system. It is not intrinsically evil. Hacking is just a method, the intent of the user determines whether or not there is a adverse effect on individuals, organizations or a given society.
Contrary to popular conservative/traditional beliefs the world is not black and white. There are cases in which hacking is legal. Just take a look at these legal hacking cases:
Ethical Hacking. Involves getting formal permission from the “target” prior to hacking.
Hackthissite. Hack this site is one of many sites that allow users to freely hack their way in.  This is done for fun, for learning or just for the heck of it. Typically, there are rules and guidelines that are create so that the user and the host can benefit from the learning experience.Â
Reverse Engineering is Legal. Cases of reverse engineering have been deemed as legal in the U.S. in many other industries. The legalities for reverse engineering software are still being shaped by a new breed of cases.Â
1999-2002: DVD Copy Control Association (DVD-CCA) vs. Bunner, et al. The DVD-CCA attempts to sue anyone distributing a descrambler software that was created by reverse engineering their product.  They even attempt to sue anyone linking to sites giving out the descrambler. initial case 2 | eef involvement |  Bunner and other won the case  *note: there were not even the ones who reverse engineered the product
The attempt to Legalize Intrusions for Corporations. In 2002, Rep. Howard Berman (D-Calif) tried to pass a law called the Peer to Peer Privacy Prevention Act (2002) which would have created section 514 of U.S.C 17 Chapt 5 allowing companies to legally hack into computers to find pirated software and intellectual property and use that information in a court of law against the assailant. Article on Peer to Peer Prevention Act
Â
Â
This hack uses sniffing on a network:
The attack is actually quite simple. First Graham needs to be able to sniff data packets and in our case the open Wi-Fi network at the convention fulfilled that requirement. He then ran Ferret to copy all the cookies flying through the air. Finally, Graham cloned those cookies into his browser – in easy point-and-click fashion – with a home-grown tool called Hamster.
The counter to this is to NEVER login at open networks (particularly the blackhat and for the love of all things holy and good NEVER login without encryption at the defcon)
It reminds me of Space Balls.  The evil Space Balls kidnap Princess Vespa and force King Roland into giving up his password that will allow them to suck all the precious air off of planet Druidia. That password it “12345” (which just happens be the same password Space Ball President Skroob has on his luggage).
 The Triton ATMs have two levels of password: an administrative passcode for routine daily operations, and a “master passcode” that also lets you change the cash machine’s basic configuration. Mastrorocco says he changed the administrative code when he got the machine three years ago, but Cardtronics never told him to change the master passcode, which he didn’t normally use.
http://blog.wired.com/27bstroke6/2007/07/atm-reprogrammi.html – ATM Reprogramming Caper Hits Pennsylvania
Â
While this is the first major infiltration to involve cellphones, the scheme did not depend on the wireless nature of the network. Basically, the hackers broke into a telephone network and subverted its built-in wiretapping features for their own purposes. That could have been done with any phone account, not just cellular ones. Nevertheless, there are some elements of the Vodafone Greece system that were unique and crucial to the way the crime was pulled off.
Basically, the hackers broke into a telephone network and subverted its built-in wiretapping features for their own purposes.
Interactive Time Line: http://www.spectrum.ieee.org/jul07/5280/time
— More on this article from Spectrum – ieee.org
Social Engineering a N00b Party
I had a level 11 Mage. My level 20 friend (who happened to be female) was teaching me how to play the game. Some level 43 guy started hitting on my escort. Feeling playful, I challenged him to a duel. He turned his back on me while I threw blows for like 10 minutes and had no effect.Â
One spell did work though, Polymorph (only for about 5 seconds though). I turned him into a sheep. This must have really pissed him off because what he did next was devious.
He finally finished me off and then quickly made friends with our two person party. He hung out with us for a little while, the whole time flirting with my friend. Then he told her that I was talking shit about her to him on whisper mode. Not true at all. But worked. She got really mad and disband from the party.
He tried to do other stuff to my character but I was just a trial account so all he had left to do was laugh at me: “Ha Ha I just scored with your friend.”
Here is a pretty good article addressing some cool hacks (cheats) that have been done on WoW. The article is on theRegister and its called, Hacking WoW and the pursuit of knowledge
change a character’s X, Y and Z coordinates to give the illusion of flying or move to a more advantageous location
Automated Spawn Camping – code to automate a character’s task of camping outside a cave in wait of monsters and stabbing them when they appear. A player who runs the bot shortly before going to bed can awake to find the character has pocketed plenty of gold left behind by the felled beasts.
Create bot characters that can send you IMs to your cell phone
Â
*atchung: some hacks such “spawn camping” will get you labeled a filthy cheater, a taboo as untouchable in the world of online gaming as a pedophile or 18th century horse thief. hack at your own filty risk.
WASHINGTON — The Homeland Security Department, the lead U.S. agency for fighting cyber threats, suffered more than 800 hacker break-ins, virus outbreaks and other computer security problems over two years, senior officials acknowledged to Congress.
In one instance, hacker tools for stealing passwords and other files were found on two internal Homeland Security computer systems. The agency’s headquarters sought forensic help from the department’s own Security Operations Center and the U.S. Computer Emergency Readiness Team it operates with Carnegie Mellon University.
more here
I’ve been getting into podcasts lately. I was put on to podcast novels by my buddy, Tre who told me about 7th Son, by J. C. Hutchins. I am not only entertained, I am inspired. The guy can write like nobodies business. The action reminds me of something you might find in a Dean Koontz novel.
Its so good I don’t want to give anything AT ALL away, but I will mention one of cool technologies he makes up in the novel. He talks about something called EGG. Its basically an encryption software that not only protects against those trying to gain unauthorized entry, it tracks them and then goes after them. It actually hacks the hackers.Â
This is something that a friend talked to me about creating as a part of his PHD. “Would that break some kind of law?” I asked. He was insistent that people should be able to protect themselves and I don’t totally disagree with that I’m just saying that I don’t think the law protects vigilantes.
Actually, a lawyer at Defcon 14 talked about that very issue when questioned. And if I’m pretty certain he said it was illegal to hack someone even if they have hacked you.Â
But in J. C. Hutchins’ world the PATRIOT ACT III allows the hack back feature of EGG to exist.
So anyway, all security geek stuff aside, its a really good story. Highly recommended.Â
Looking for a three column Blogger Beta template? Looking to remove the Blogger Navbar? Looking to add a picture to your header? Then look no further! This article explains step by step how to do it all. Includes download links to ready-made templates.
read more | digg story