Ancient-Chaos' Geekzone

1. Ancient-Chaos' Geekzone

   #1

   This forum thread is dedicated to the geeky musings of Chaosmark, Ancient Gamers and occasional geek admin passers by.
   
   Chaosmark's recent hacking posts on Facebook got me all riled up. Finally someone with a passion for the nefarious arts, like me.
   
   By the sound of his posts, young Chaosmark is evolving into quite the adept.
   
   LEt the fun begin!
   

2. Re: Ancient-Chaos' Geekzone

   #2

   So, Chaos: What fuels your interest these days?
   
   Necessity? Curiosity?
   
   Also, what is your main source of hacking knowledge? We can exchange twitter feeds and other stuff if you wanna.

3. Re: Ancient-Chaos' Geekzone

   #3

   Mostly curiosity. I've always been interested by security, and made a point to try to be as secure as possible in my dev work. PCI, HIPPA, and DOD RMF requirements on various projects all forced me to absorb a vast amount of knowledge, and also showed me that there's a wide world of troubles I really need to know more about. Since going independent, I've finally had the time and energy to devote to security research. And of course, the best way to learn how to protect against something is to learn how to do it in the first place.
   
   In terms of sources, aside from Google-Fu on topics I know keywords for, I've been mostly watching Defcon and Blackhat seminar recordings on Youtube, just to get a broader basis of information and ideas for what can truly be done by attackers.

4. Re: Ancient-Chaos' Geekzone

   #4

   Cool!
   
   I am going to bed, but there is this Persian chick you should know about. Her name is Binitam Shah, but she goes by binnishah on Twitter.
   
   She is an amazing font of knowledge securitywise, and her twitter feed is the most esoteric source of security knowledge you could ever wish for.
   
   There are tons of others too, but she is a one man army.
   
   Check her out!
   
   https://twitter.com/binitamshah

5. Re: Ancient-Chaos' Geekzone

   #5

   Holy crap! You weren't kidding about her having all the hacks.

6. Re: Ancient-Chaos' Geekzone

   #6

   I truly did not.
   
   Whenever I feel invincible, I head over to Binni's page for a lesson in humility.
   
   It is cool to witness her genius.

7. Re: Ancient-Chaos' Geekzone

   #7

   Quite the info.

8. Re: Ancient-Chaos' Geekzone

   #8

   Chaos: Are you reading articles about doable hacks, or are you practising them tools yourself? If you are into tools: Which tools, and do you write your own custom tools? Fuzzers?

9. Re: Ancient-Chaos' Geekzone

   #9

   Perhaps in the spirit of this thread:
   
   https://jonathan.porta.codes/2015/07/30/windows-10-seems-to-have-some-scary-privacy-defaults/
   
   TLDR - when installing windows 10 - do not go with the defaults....
   
   

10. Re: Ancient-Chaos' Geekzone

    #10

    
    Perhaps in the spirit of this thread:
    
    https://jonathan.porta.codes/2015/07/30/windows-10-seems-to-have-some-scary-privacy-defaults/
    
    TLDR - when installing windows 10 - do not go with the defaults....
    
    
    

    
    
    Quite useful, val!
    
    Thanks.

11. Re: Ancient-Chaos' Geekzone

    #11

    I am also interested in fuzzers. If you guys have fuzzers that you use to discover zerodays, I'd love to debate them.
    
    I have met most of the gurus of the trade, so if you need any pointers, I can gladly show you the way.

12. Re: Ancient-Chaos' Geekzone

    #12

    I have not yet ventured into actually practicing any hacks. However, when I do, I fully intend to be writing my own tools (after all, a hacker without the ability to customize a toolkit is just a script-kiddie).
    
    When I get the chance, I really want to setup a pwnphone for thrashing on the go. The lowest-hanging fruit would be IPv6 network bombing on a LAN, and then it's branching out from there. Something of a pipe-dream would be to port Metasploit to Android native, to take advantage of all those lovely automated exploits.

13. Re: Ancient-Chaos' Geekzone

    #13

    A tip from Michele Orru: If you want to get caught, use Metasploit.
    
    Metasploit is great if you are a pentester and don't care whether you get caught, but for an actual hacker it is risky to use.

14. Re: Ancient-Chaos' Geekzone

    #14

    Somewhat, but if you're not doing a full vulnerability sweep, you're less likely to get caught. Broad attacks against any vulnerable target are not my thing. My goals are targeted, precise attacks on specific organizations or individuals (though I will admit, having a botnet does have its own kind of appeal).
    
    Also, if working from mobile, it's much easier to avoid getting caught, thanks to wardriving, device anonymisation, and Tor. And of course, in the optimum world you'd be launching your actual attacks through subverted servers, and using a burner-device. But that's par for the course when dealing with major players.

15. Re: Ancient-Chaos' Geekzone

    #15

    I'd stay the heck away from Tor.
    
    The US government compromised that a long time ago.
    
    Other than that, your logic is sound.
    
    I have been using the tools for a long time. Metasploit is pretty amazing, and when you get a meterpreter shell on the foreign host it feels so good.
    
    I attend a number of conferences, and here in Norway the national security authority has acknowledged that keeping a trojan on cybercriminals computers is hard.
    
    The latest trend goes towards installing hardware on the criminal's computer. Dedicated hardware to keep permanent tabs on the cybercriminal.
    
    The scene is evolving rapidly, and nation states have some pretty terrifying operators.
    
    By the sound of it, you will probably be NSA purty soon my friend.
    
    Good luck!

16. Re: Ancient-Chaos' Geekzone

    #16

    I'd very much appreciate a link to the Tor compromisation claim. People have been saying it for years, but I've never seen any evidence thereof.

17. Re: Ancient-Chaos' Geekzone

    #17

    I'd have to link you to real life talks with Tor head honchos then.
    
    There was a number of industry headlines a while ago when the FBI shut down a number of Tor servers. Later they also took down the Silk Road 1 and 2.
    
    I have been to a number of conferences with Tor researchers and devs, and during the Q&A they made it obviously clear that they won't bother to hinder law enforcement in any way. They are pretty pissed about non-legitimate usage of Tor.
    
    But by all means. If you don't believe me, feel free not to. :p

18. Re: Ancient-Chaos' Geekzone

    #18

    It's less about not believing you and more about "that doesn't make sense based on all the other information I have". Specifically, how the system is setup (which yes, it does have some vulnerabilities when you're operating on the ISP or nation-state level), as well as its intent and purpose.
    
    While I understand frustration with child porn and other reprehensible things being hosted on .onion sites, as well as anonymised botnet attacks, the entire point of Tor is to allow people to browse and communicate free of government restrictions. ANY government. For them to say, "Eh, we won't stand in the FBI's way if they want to compromise the Tor network" completely goes against everything the project says it stands for. Hell, last year they tossed out a number of servers that were adding identifying headers to the packets, because it was compromising the anonymity of the network.
    
    Of course, as I said earlier, if you're doing anything sketchy, you should definitely be encrypting your data and using burner devices. Tor may have some vulnerabilities, but it's a lot harder to track you if you're using mobile devices from random wifi hotspots.
    
    Along those lines, and mixed with concerns about the NSA being known to intercept actual hardware and install their own spyware hardware in it, I'm thinking some sort of one-time-use device built from parts would be handy. Then you have a known-safe device that you can jack into and do your stuff, then disassemble and repackage into other equipment (or just slag with thermite, depending on what you did with it).

19. Re: Ancient-Chaos' Geekzone

    #19

    Yes, they have architected their damndest to make Tor and its 3 bounce onion architecture stealthy.
    
    But the recent busts of darknet servers only reachable by onion addresses proves my point.
    
    Any hardware or software can be exploited, if you know where to look. Back in 2013-14 the feds used bugs in Firefox.

20. Re: Ancient-Chaos' Geekzone

    #20

    Oh, absolutely. You should never rely on a sole piece of software or hardware for your protection. Defense in depth is the only way to go. On that note, though, I should point out that pretty much every darknet takedown we've seen has either used a software bug that was subsequently fixed (such as the Firefox bug), taken advantage of misconfigured setups, or idiots violating OpSec. Mostly the latter. Near as I can tell, the fundamental network is sound, and worth using (if only to make their lives much more difficult to get at your data). You just shouldn't rely on it as your only form of protection, especially if you're doing anything with the risk of prosecution.

21. Re: Ancient-Chaos' Geekzone

    #21

    Just be careful, Chaos.
    
    http://www.wired.com/2014/11/operation-onymous-dark-web-arrests/

22. Re: Ancient-Chaos' Geekzone

    #22

    Some good tidbits in there.
    
    Other tech-ery! I'm liking the idea of this, even if it is a smidge oversized. http://kotaku.com/portable-pc-inspired-by-shadowruns-cyberdecks-1720331736 I think the key is to use the extra space effectively. You need some reason to haul around something significantly larger than a laptop.

23. Re: Ancient-Chaos' Geekzone

    #23

    Did you get your copy yet AG...for research?
    
    

    You may remember that in July, anonymous hackers threatened to reveal stolen personal information of some 40 million users of the controversial dating website AshleyMadison.com. (Ashley Madison's tagline: "Life is short. Have an affair.") The hackers, who call themselves Impact Team, said they would post the stolen user data publicly unless Avid Life Media, Ashley Madison's parent company, took the site and another, EstablishedMen.com, permanently offline.
    
    Avid Life Media did not take its sites offline, and on Tuesday, those hackers appeared to make good on their threat. Ars Technica reporters downloaded a 10-gigabyte file via BitTorrent that "appeared to contain a trove of details taken from a clandestine dating site." The file contained personal e-mail addresses, profile descriptions, and addresses, as well as users' weights and heights, Ars Technica reported.

24. Re: Ancient-Chaos' Geekzone

    #24

    http://blog.erratasec.com/2015/08/notes-on-ashley-madison-dump.html#.VdTmIbQyAmA
    
    This is the blog of a renowned security researched, Robert David Graham.
    
    Anyone seriously interested in security should know about him, *cough* Chaosmark *cough* as he is in the forefront of researching all newly published hacks.
    
    THE LINK: Click the link above and read. David R. G. points you to the right torrent to download to get all the data.
    
    Personally I don't bother downloading it... Or perhaps I will....
    
    

25. Re: Ancient-Chaos' Geekzone

    #25

    Ah yes, the Ashley Madison hack. I've been debating downloading the dataset myself, but haven't decided if I want 10 gigs of data on my machine that I might or might not find a decent use for.
    
    Normally, I frown pretty heavily on doxing people. But in this case? Fuck'em all. Cheating on your partner is one of the few things I have precisely zero respect or sympathy for.

26. Re: Ancient-Chaos' Geekzone

    #26

    It is information, and I love information.
    
    Currently in the process on amassing dossiers on people of interest. This hack is an excellent contribution to those dossiers.
    
    Also: Further analysis of the files indicate that the majority of users were male, the female users had a lot of fake users in there, and prostitutes were the main category of real female users.
    
    Ergo: AM was a prostitution website.

27. Re: Ancient-Chaos' Geekzone

    #27

    The BitTorrent file containing e-mail for Noel Biderman, the CEO of Ashley Madison parent company Avid Life Media, was originally uploaded by someone using a server operated by Ecatel Ltd., an ISP headquartered in the Netherlands

    
    
    AG?
    
    LOL
    
    http://arstechnica.co.uk/security/2015/08/ashley-madison-hackers-leave-footprints-that-may-help-investigators/
    
    

28. Re: Ancient-Chaos' Geekzone

    #28

    Nah, I don't indulge nor condone criminal behavior.
    
    Lots and lots of hackers in the Netherlands, though, given the nature of the web physical location is of no essence.
    
    ISPs get pwned all the time.

29. Re: Ancient-Chaos' Geekzone

    #29

    This was an interesting read.
    
    http://arstechnica.com/security/2015/08/how-security-flaws-work-the-buffer-overflow/

Administrators · All categories · Guildhall