Elamb Cybersecurity

Category: Main Digg

  • U.S. to Expand Domestic Use of Spy Satellites {response}

    Robert Block at bobby.block@wsj.com, wrote an article at the Wall Street Journal about US Defense spy satellites being turned toward the people of the United States. Perhaps this is not really a new phenomenon. I suspect that in the past it was done without asking and without anyone knowledge. Now unchecked spying by the government is legalized. There is a trend of legalizing misconduct that is justified by what a small elite believe is the greater good. If you think I am just a paranoid conspiracy theorist do your own reading, find out for your self don’t take my word for it. Start here: http://www.themoneymasters.com/order.htm#books

    If I am not mistaken abuse of government power is one of the reasons that the original 13 colonies in America rebeled against the British Empire. They were paying taxes but had NO say in what was going on in England or even on their own land: “Taxation without Representation.” The founding fathers were so serious about guarding against the unchecked power of government that they created the 2nd amendment, right to bear arms:

    “A well regulated militia being necessary to the security of a free State, the right of the People to keep and bear arms, shall not be infringed”

    Now we face abuse of power on an entirely different level, but abuse of power all the same.

    Liberties are given away wholesale with NO regard for the Constitution. As a security person, I appreciate national security, but NOT at the expense of liberty. At the very least programs that spy on the people should have checks and balances. But there are no organizations dedicated to protecting privacy and liberties with the same level of influence as the executive branch, CIA, and NSA.

    The neo-conservative view of going to war to “protect our freedoms” is only valid if there is freedoms left to protect. Make no mistake, I am no liberal who wants to create bigger government to help the poor and less fortunate. I just don’t trust the government enough to give them more power than they already have. Government should be small and managed by the people, not the other way around.

    I fear that humanity has created a very efficient system whose function (regardless of what it says) is to exact total control over its heard of consumner citizens.

    “Where liberty dwells, there is my country.”
    –Benjamin Franklin, letter to Benjamin Vaughn, March 14, 1783

  • Legal Hacking Cases

    The official Certified Ethical Hacking course material identifies three types of hackers:

    Black Hats: criminal hackers

    Grey Hats: hackers that find exploits because they want to (not for good or bad intentions)

    White Hats: hired penetration testers

    The media and many parts of the information security profession lumps all ‘hackers’ into one big box labeled “criminals”.  I used to think this way as well until I went to Defcon.  It was a real eye opener.  I saw hackers who want to do something good for the consumners.  I saw several government agencies attempting to hire the best and brightest hackers and of course, I saw hackers that may very well have been working on the darkside.  The point is that “hacking” itself is the just a technique to find, and exploit weakness in a given system.  It is not intrinsically evil.  Hacking is just a method, the intent of the user determines whether or not there is a adverse effect on individuals, organizations or a given society.

    Contrary to popular conservative/traditional beliefs the world is not black and white.  There are cases in which hacking is legal.  Just take a look at these legal hacking cases:

    Ethical Hacking.  Involves getting formal permission from the “target” prior to hacking.

    Hackthissite.  Hack this site is one of many sites that allow users to freely hack their way in.  This is done for fun, for learning or just for the heck of it.  Typically, there are rules and guidelines that are create so that the user and the host can benefit from the learning experience. 

    Reverse Engineering is Legal.  Cases of reverse engineering have been deemed as legal in the U.S. in many other industries.  The legalities for reverse engineering software are still being shaped by a new breed of cases. 

    1999-2002: DVD Copy Control Association (DVD-CCA) vs. Bunner, et al.  The DVD-CCA attempts to sue anyone distributing a descrambler software that was created by reverse engineering their product.  They even attempt to sue anyone linking to sites giving out the descrambler.  initial case 2 | eef involvement |  Bunner and other won the case  *note: there were not even the ones who reverse engineered the product

    The attempt to Legalize Intrusions for Corporations.  In 2002, Rep. Howard Berman (D-Calif) tried to pass a law called the Peer to Peer Privacy Prevention Act (2002) which would have created section 514 of U.S.C 17 Chapt 5 allowing companies to legally hack into computers to find pirated software and intellectual property and use that information in a court of law against the assailant.  Article on Peer to Peer Prevention Act

     

     

  • Quantum Key Distributions (part 1)

    The NIST has an page that talks about Quantum Key Distribution:

    Quantum encryption systems use lasers to generate individual pulses of light called photons. Each photon is sent in one of two modes, either vertical/horizontal, or plus 45 degrees/minus 45 degrees. Within each mode, one orientation represents the digital value 0, and the other represents the digital value 1. To visualize how this works, imagine that each photon is a tiny envelope moving perpendicular to the ground (vertical=1), parallel to the ground (horizontal=0), tilted at 45 degrees to the right (plus 45 degrees =1) or tilted 45 degrees to the left (minus 45 degrees=0). NIST 

    Its almost scary how much has been done in relatively so little time in the “Information Age” and its only just the beginning.  
     

    The possibilities are unimaginable.  I thought it was a bit extreme when I read an Author C. Clarke sci-fi novel called, Light of Other Days in which people can send messages directly from brain to brain (some sort of brain to brain Internet) via a device that sends messages on a subatomic level.  Now it doesn’t sound so strange anymore (well, ok, its still strange but it seem possible now).
     

    Here are some mind blowing articles about quantum entanglement:
     

    Quantum Teleportation of data (actually it’s the instantaneous transfer of quantum states, but teleportation sounds cooler)
          The thing is that it has already being done:
          http://news.nationalgeographic.com/news/2004/08/0818_040818_teleportation.html
          http://www.research.ibm.com/quantuminfo/teleportation/
          http://www.sciam.com/article.cfm?chanID=sa006&articleID=ABBA5449-E7F2-99DF-3ACFAC15B16FEC60&colID=30
          http://techreport.com/onearticle.x/12870
     

    Quantum Entanglement as an explanation for so called psychic phenomenon:
          Highly controversial as parapsychology is the “leprosy” of
          science.  Just a hypothesis but interesting:
          http://www.deanradin.com/NewWeb/EMblurbs.html

  • Michigan Security Expert

    Looking for Michigan Secuiryt Experts:

    Michigan Information Security Experts –
    Information System Security Association/Michigan

    Nearly every state has a local ISSA Chapter.  These chapters have pools to security experts ranging from forensics, to network security to system security engineering.  Lansing, Michigan Information System Security Association (ISSA) President MaryAnn MacIntosh [contact Michigan ISSA]

    InfraGard/Michigan

    Major cities usually have an InfraGard group consisting of FBI/DHS and public/private security experts and organizations who protect the infrastructure of critical organizations in U.S. cities.  

    ASIS Detroit, MI, ASIS Western Michigan, ASIS Flint, MI,

    ASIS is like a physical security version of the ISSA. 

    Small towns such as Tawas, Oscada, and Alpena in Michigan would be wise to start their own chapter of similar security experts or out source from Flint, MI or out of state with organizations such as Academic Security Innovations. 

  • Point and click Gmail hacking at Black Hat

    This hack uses sniffing on a network:
    The attack is actually quite simple. First Graham needs to be able to sniff data packets and in our case the open Wi-Fi network at the convention fulfilled that requirement. He then ran Ferret to copy all the cookies flying through the air. Finally, Graham cloned those cookies into his browser – in easy point-and-click fashion – with a home-grown tool called Hamster.

    The counter to this is to NEVER login at open networks (particularly the blackhat and for the love of all things holy and good NEVER login without encryption at the defcon)

    td daily – gmail hack @ blackhat

  • FCC Commissioner: US playing “Russian roulette with broadband and Internet”

     Micheal Copp of the FCC Commissioner made a great point at the YearlyKos convention. 

    Most American probably think that everything is fine with American broadband, but the truth is we are WAY behind.  And its is due to big business’ strangle hold on the growth and proserity of our access to the Internet.  There seems to be a “price collusion” between Verison, AT&T, Comcast and other major broadband/telecos in which they keep the prices at a certain level and block out smaller competition. 

    I wouldn’t call it a conspiracy, but I think they’ve gotten so powerful that they are able to sway federal, state and local government policy in their favor by sending their lobbyists with million dollar warchest.

    “In a speech at the YearlyKos convention, [Micheal] Copps spoke like a man with a fire in his guts. He’s proud of America but “worried” by the path that it has gone down with respect to broadband Internet and media consolidation, which he sees as ideas joined at the hip.

    In both cases, “a small number of corporate gatekeepers” now control the public’s access to information, an arrangement that threatens to “invert the democratic genius of the Internet.” When the Internet first exploded onto the scene, people hailed it as a revolutionary communications tool that would allow for the creation of a truly democratic media in which anyone with a message could get the word out to others. Now, Copps notes that most connections to the Internet are controlled by massive corporations who seem eager to prevent any neutrality safeguards from being placed on the networks they manage.”

  • FCC will Open the Air Waves

    The FCC is going to open up the 700MHz frequency to the wireless market.

    What does this mean to you and me? This:

      “The 700 MHz Band spectrum, which runs from 698-806 MHz, currently is occupied by
      television broadcasters and will be made available for other wireless services, including public
      safety and commercial services, as a result of the digital television (DTV) transition.”

      In implementing Congress’ directive to reallocate the airwaves, the Commission is
      focused on serving the public interest and the American people.

    –News Information #202

    We’ll see what that REALLY means in a short time.

    Google proposed that the FCC force a completely leveled playing ground like the Internet: open applications, open devices, open services and open networks. AT&T lobbyists were violently opposed to this proposition. The FCC agreed to open applications & devices but denied the others.

    I hope this isn’t another way of saying that AT&T/Verison will divy up the spectrum and force their proprietary BS down our collective throats. I hope “open devices/applications” means that I can use something like a Skype cell phone (or google iphone – if they ever decide to create it).

    I’m bitter about the telecos.

    It is because of the American Telecos and the FCC that we are so far behind Asia and Europe. I’ve been to parts of Korea and Italy and I’ve got to say that it is a damn shame its easier to get on the net there than here.

    techcrunch on fcc – http://www.techcrunch.com/2007/07/31/fcc-fails-to-mark-their-place-in-history/

  • Hacking Chuckie Cheese Robots

    Someone modified a flipping Chuckie Cheese Robot…

  • Ethical Hacking Official Course Material (Book)

    As of July 2007, the official course material book on Ethical Hacking is going for $5 on Amazon.  The cover price is $70 in the US and over $100 in Canada.  This should tell you a lot about what people feel about this book.

    The hate for this book is so profound that it makes me laugh.

    Here are a few comments:

    “I know this has been said but it really needs emphasis. This is perhaps the most poorly written and presented compilation of misinformation I have seen since the 5th grade.”

    “If the author of this book isn’t going to take the time to correct the misspellings and grammar issues, that speaks volumes about the quality of the content.”

    ” The EC-Council has a great CUT and Paste method of publishing a book, they don’t even list the Author.”

    “I agree with all the negative comments. This book is poorly written.”

    It touches on all of the modules of the test, its just that there are so many issues with the way it is put together.  Its almost as if the EC Council had a week to put something together so they gathered all there slides and copied and pasted them in this book then expanded on each slide.

    One of the Amazon readers put it well:

    Here are a few notable indicators of the quality of the book:

    * There is no reference section or bibliography and there are only a couple references made to outside works. Most of which is the legislation they quote and a couple quotes from notable manufacturers.
    * They do not cite any of their quotes correctly. The closest they get is, “A quote from the Internet says…” or “(Reference: Cryptography FAQs published on the World Wide Web)” No web site, date or proper credit is ever given. I’m suprised they actually listed the URLs for the tools they discuss.
    * The table of contents is very high level, there is no table of figures, or table of tables. There is also no index or list of terms.
    * They attempt to redefine established industry terms in their own style, often incorrectly or in contradiction to earlier statements.
    * As noted in previous reviews, grammar, spelling and typos are prevalent throughout the book. Most notably is the pres ence of sp aces in the midd le of wo rds.

    When course material is this bad, it is very hard to take the certification seriously.

  • Certified Ethical Hacker Exam Prep (amazon review)

    Found a good review of Mike Greggs book, Certified Ethical Hacker Exam Prep from Amazon reviewer, N. Rossino (NY) : 

     

    		    

    The previous poster did bring up a good point: this book will not teach you how to hack. It WILL help you pass the CEH exam. It lays a very good foundation, and the only reason I give it 4 stars was because it was lacking the detail and depth to be fully comprehensive.

    Keep in mind, that this book is meant for people who do have an administration background and who happen to be pretty familiar with Linux and Windows. The book is written for that group of people because without that experience, you probably won’t have the experience necessary to be a CEH.

    I happen to read all 3 books for the CEH that are listed on Amazon. The Sybex book, the EC-council book, and this book. By far, this book was the best out of the 3. The Sybex book was a waste of money as it wasn’t as good as this book and it had even less depth. The EC-council book had a bit more detail in some topics, although it lacked cohesion and was poor at presenting the thought behind it. I think this book and the EC-council book compliment each other, and give you a pretty good idea of what you actually need to know. I would start with this book and finish up with the EC-council book and/or courseware. My reasoning is that you should set the foundation first and this book does that.

    Also, as with hacking, google is an excellent resource. These two books won’t be enough to fill all the holes, but the internet is a damned good filler.

    In conclusion this book provides for pretty good preparation for the actual test, and is a comfortable read.

    ABOUT THE TEST:

    150 questions, you have 4 hours. I took only 2 and scored an 86%. 70% is passing. I studied for only two weeks, but have extensive background in the subject area.

    The test is very specific, and you are expected to know the material in detail – NOT just concepts. The test is geared towards people with security experience, and the test questions are true to that purpose. It will be very difficult to pass if you:
    1) Don’t know linux
    2) Don’t understand Microsoft’s OS and operations
    3) never actually used any of the hacking tools

    Linux is not a MAJOR part of the test, but there are enough questions on linux command line operations to make a difference.

    Keep in mind, just reading alone will not let you pass this test. It is very important that you try out the most popular and important tools (firsthand!). You will be asked about specific commands, and be expected to know them. Know nmap, snort, hping2, tracert and tcpdump down cold. Know the ICMP codes and types. The only way you learn this stuff is to actually practice it.