Category: security

  • Integral Hacking: Developing Jedi Mind Tricks at DEFCON

    “To the weak I became weak, that I might win the weak; I have become all things to all men that I may by all means save some.” 1 Corinthians 9:22

    How does a 60 year old former Episcopal priest manage to captivate a packed audience of tech savvy red teens, ambitiously orange “20-something” hackers, amber security professionals, and green information freedom hacktivists while speaking about nothing technical at DEFCON, the world largest hacker convention? Richard Thieme, author of Islands in the Click Stream, has been able to do this since DEFCON 4, 1996 (1).

    There is a body of knowledge growing like a fungus in the cracks of the burgeoning technological super fortress that is the information age. Hacking is that fungi and the DEFCON hacker convention is the petri dish where this new organism is cultivated. Like penicillin, this mold can be used for good. This culture is growing tendrils beyond cyberspace and into the human mind. Complex systems and technologies are synergizing toward an integral hacking solution now pushing humanity into new levels of communication by slipping passed the psychological firewalls to communicate on a deeper level with kick ass Jedi mind tricks. Prepare for psychological nudity!

    At DEFCON 14, Richard Thieme’s subject was “Beyond Social Engineering: Tools for Reinventing Yourself” in which he discussed how to “manage multiple modular identities” then link them into a seamless life by leveraging them with an intimate knowing of the true inner self (2). The auditorium was crammed with wide-eyed technophiliacs at the edge of their seats.

    Even though Thieme freely admits to not having any discernable technical hacking skills he is able to successfully “hack” (a.k.a socially engineer) his way into a very elitist, and young and mostly apathetic counter-culture. He is an Integral Hacker.

    The same skills used naturally by Mr. Thieme are used by integral leaders like Brett Thomas, co-founder of the Stagen Leadership Institute, to recognize a person’s worldview, determine what stage of development they are likely to identify with and then communicated with them on that level (4). An integralist would call this “skillful means” but hackers call it a subtle form of social engineering. Social engineering has a slightly negative connotation as it is usually associated with manipulation rather than enhanced communication.

    As a complete method of hacking people, integral hacking goes way beyond mere social engineering and into Neuro-Linguistic Programming (NLP) techniques. This subject was also discussed at DEFCON 14. Brad Smith of Computer Institute of the Rockies discussed how law enforcement, FBI and other three letter agencies use NLP during interviews and interrogations (2). Full spectrum people hacking would include all of the NLP “physiological lock picking” techniques to get full access the root of ego.

    Past DEFCON speakers touching on the outer reaches of wetware and integral hacking have included Thieme’s, “Hacking a Trans-Planetary Net” which touched on the need for hacking to include “an artist’s imagination, an obsessive hunger for knowledge, and a deep understanding of cyborg humanity” (1). Former hacker Susan Thunder spoke on “Social Engineering and Psychological Subversion of Trusted Systems” which was about infiltrating a company without physical or digital access (3). People are the weakest part of any secure network.

    Hackers are the gun slingers of the Wild, Wild Web, living in a world of 20 year old millionaires who have already change the world and actual evil genius’ who are drifting ghosts pilfering the pockets of the ignorant weak. Whether their intentions are holistic or selfish all hackers view ignorance as the greatest sin. The DEFCON prides itself on a borderline dangerous freedom that is fertile ground of both immeasurable brilliance and debauchery of the filthiest sort. It’s the frothiest edge of technological mayhem and creativity. It is on the fringes of every digital-civilizations’ decomposing structures that you will find a culture of complex integral hackers of hardware, software or wetware growing and sending out spores.

    References

    1. DEFCON. (July 28, 1999). DEFCON 4 Archive. Retrieved November 18, 2006, from http://defcon.org

    2. DEFCON. (August 6, 2006). DEFCON 14. Retrieved November 18 2006,
    from http://defcon.org

    3. DEFCON. (July 28, 1999). DEFCON 3 Archive. Retrieved November 18, 2006, from http://defcon.org

    4. Integral Leadership Review. Biography of Brett Thomas. Retrieved November 18, 2006,

    http://www.integralleadershipreview.com

    Thieme Works. (2001). Keynotes, Workshops and Retreats. Retrieved November 18 2006,
    from
    http://www.thiemeworks.com

  • HP to hack customers' networks

    “The company plans to launch a penetration-testing service for businesses in October that will use the same techniques as hackers to gain access to its customers' machines. However, the exploit code it will use will be controlled and will not propagate itself as a worm would, HP said on Tuesday.”
    Sounds like a bunch of pentesting/ethical hacker type jobs are going to open up. I think that other corporations will follow suit. I know some guys who do forensics and pentesting on the side. As vulnerabilities are found quicker by criminals, pentesters/ethical hackers seem to be becoming more signifigant.

    read more | digg story

  • Malware Responses: What To Do Before, During, And After An Attack

    “Don't let a malware attack ruin your business. A little planning and the right responses can make it a minor annoyance instead of a major catastrophe.”
    This is a pretty good article. The mentions how to “prepare” for and attack but I would go a step further and submit how to “prevent” an attack from ever occuring. It is possible to avoid an attack:
    1) Get a firewall that used network address translation.. use network address translation
    2) Use firefox
    3) Don't surf shady sites: serial crack, pirated software, some porn sites, screen savers
    4) Watch out for dirty downloads. Some p2p application and the wares loaded on them are loaded with trojans, worms and other malware
    5) Don't surf the Internet with administrative privledeges.

    read more | digg story

  • Former Pentester of FBI, hacks the FBI

    This case is not the same as the Department of Veteran Affairs loss of records or the Department of Agricultures security failures.  In this case, a contracting consultant conducted a penetration test with out getting formal approval.  He expoited the FBI's vulnerabilities to gain elevated privledges.

    Joseph Thomas Colon, 28, is a former employee of BAE Systems.  His pentest allowed him to obtain the passwords of 38,000 employees, including that of FBI Director Robert S. Mueller III.  According to Colon, the FBI field office in Springfield, Ill., he was attached to gave him approval.

    However, every professional pentester and/or ethical hackers knows that you have to get formal approval from an authority. 

    Colon's lawyer said in a court filing that his client was hired to work on the FBI's “Trilogy” computer system but became frustrated over “bureaucratic” obstacles, such as obtaining written authorization from the FBI's Washington headquarters for “routine” matters such as adding a printer or moving a new computer onto the system. 

    As a result, Mr. Colon will likely serve about 18 months in prison. :(…

    Pentesting and ethical hacking tools and techniques must be dealt with responsibly.  The bureacracies that might allow pentesting must be respected at all costs.  The first thing in Pentesting and ethical hacking that is taught is to ALWAYs, ALWAYS, ALWAYS get writen consent to procede from the owners of the system.

     

  • Chinese Plan Tougher Rules On Cyberspace

    “Chinese authorities intend to police and control instant messaging, cell phones, blogs and search engines.”
    If they continue to apply more and more pressure the People Republic of China is going to break. It is an interesting experiment to see how long people will stand for having zero freedom of speak. Even though America is going the way of Chinese with privacy (as in no citizens having any) it is good to know there is still some freedom of speach left.

    read more | digg story

  • AT&T's new broadband privacy policy overreaches, lawyers say

    A recent change to AT&T's privacy policy for broadband and video users is overbroad and likely will leave the courts or Congress to decide whether the company's practices are standard or sinister, legal experts said this week.
    This is why I switched to Vonage. I am so sick of telco's abuse of power. As soon as I can I'd like to also get rid of my Cable service as well. I believe Vonage and other VoIP services are being preped to give all data to the NSA but AT&T and Verizon are going nuts.
    I hope WiMax opens up new small business to compete with the current telcos.

    read more | digg story

  • The 10 Most Destructive PC Viruses Of All Time

    Computer viruses are like real-life viruses: When they're flying around infecting every PC (or person) in sight, they're scary. But after the fact…well, they're rather interesting, albeit in a gory kind of way. With this in mind, we shamelessly present, in chronological order, the 10 most destructive viruses of all time.

    read more | digg story

  • HOWTO: Create Flash Video ( FLV ) – with Free Tools

    a start-to-finish how-to on creating Flash video for displaying embedded video on your website… Using freely available tools, you can create videos for your site that will be viewable by anyone who has a Flash enabled browser (which is just about everyone)…If done correctly, your FLV video should now be viewable on your site…

    read more | digg story

  • Windows account password cracks

    Ophcrack is the fastest Windows NT, 2000, XP and 2003 password cracker. Download and burn!! Ophrack 2.1 comes with a GTK+ Graphical User Interface and runs on Windows as well as on Linux.

    read more | digg story

  • IT Managers gluing up USB ports

    Network manageres are using tubes of super glue to protect their systems from data theft. Outfits are getting so hot and bothered at the loss of corporate data that they are removing writable drives and ordering network staff to pour superglue into USB ports. Nothing a little “cut and paste” won't fix!

    read more | digg story