Insider Sentiments around L.A's Traffic Light System

Rember how the Hollywood Hackers were winning time while heading straight to Grand Central Station in NYC to outsmart the Plague's plan to cause a worldwide ecological disaster and cash in between? In pretty much the same fashion -- without the randomization of traffic lights -- two engineers in between their union's strike seems to have watched the movie too :

"They didn't shut the lights off, city transportation sources said. Rather, the engineers allegedly programmed them so that red lights would be extremely long on the most congested approaches to the intersections, causing gridlock for several days starting Aug. 21, they said."

Whether overal paranoia due to the sensitive nature of the workers' positions and the publicly stated intentions, insider sentiments prevail from my point of view. Continue reading →

Iran Bans Purchase of Foreign Satellite Data

Re-inventing the wheel :

"According to the bill, a copy of which has been sent to all ministries, organizations, state and revolutionary institutions, the purchase of information from foreign sources is deemed against the law. Specialists of the Defense Ministry have currently succeeded in initiating a project for obtaining satellite information online. For the first time in Iran, it is now possible to produce topographic maps, on a scale of 1/10,000, of a specific area for municipal and developmental projects, with the satellite images of very high resolution."

Guess they don't want others to know which locations of their country are still unknown to themselves, but with the bill definitely implemented as a national security measure, and to improve the nation's self-esteem, drop a line if they ever get close to producing such high-resolution image of their Natanz facility on their own. Continue reading →

Russia's Lawful Interception of Internet Communications

Don't fool yourself, they've been doing it for the time being, now they're legalizing it -- working for anything like the EFF in Russia means having the bugs in your place bugged. Citing Cyber-Terrorism Threat, Russia Explores Internet Controls :

"An estimated 20 percent of the Russian population now has access to the Internet. Whereas the Putin administration exerts tight control over the major domestic broadcast and print media, it does not currently restrict the content of Internet sites on a wide scale. Web sites such as Gazeta.ru and Lenta.ru provide many of the articles and commentary that would normally otherwise appear in an opposition press. Several wealthy Russians living in political exile, including Boris Berezovsky and Vladimir Gusinsky, own Russian-language websites that publicize their anti-Putin views to Russian audiences. In August 2006, Russian right-wing extremists used the Internet to coordinate a bomb attack against illegal migrants from Asia."

Give me an excuse for data retention? No, give me another one besides the infamous "if you don't have anything to hide then why worry"? We all have things to hide, and things we don't want others to know, that's still called my privacy, and since when does this became a terrorist activity, or someone's just piggybacking on the overall paranoia created by the thought to be acting as government watchdog, media -- don't be a reporter, be a journalist! Winning the public support in different countries largely relies on the local attitudes towards the key buzzwords - terrorists are using the Net as a "safe heaven", and child pornographers are operating online, while people are unemployed and primitive deceases which should been dealth with years are a second economic priority, next to your first one - fighting your (political campaign) demons, or the (upcoming budget allocation) demons you put so much efforts into making me believe in. Start from the basics, why retain everyone's data, and intercept everyone's communications while forgetting that information is all about interpretation? How come you're assuming -- if you're even considering it -- that such a neatly centralized databases of private information would be protected from insiders, even outsiders which will inevitably be tempted to having access to such a database? A country's intelligence is the government's tool for protecting the national security or beyond, but over-empowering the watchers is so shortsighted, you'd better break through your black'n'white world only and start considering all other colours as equal. Don't slip on your values.

If you sacrifice privacy for security, you don't deserve both of them, and the utopian idea of having a 100% successful law enforcement as the panacea of dealing of crime reminds of a quote I recently find myself repeating very often - make sure what you wish for, so it doesn't actually happen. Continue reading →

Visits to the White House Now Top Secret Information

Informative - White House visitor logs declared top secret :

"The five-page document dated May 17 declares that all entry and exit data on White House visitors belongs to the White House as presidential records rather than to the Secret Service as agency records. Therefore, the agreement states, the material is not subject to public disclosure under the Freedom of Information Act.

In the past, Secret Service logs have revealed the comings and goings of various White House visitors, including Monica Lewinsky during the Clinton administration."

I thought that's always been the case anyway, but it closes a loophole that could result in potentially embarrassing future developments -- or less accountability. Time will show. More info.

Continue reading →

Sunday's Portion of Hahaha

While patiently waiting for the future adventures of Monica Furious, I came across a nice collection of cartoons. I'm sure you'll find these two very entertaining - "The Disabled Cookies" and "The Spam Prison". Continue reading →

Web Economy Buzz Words Generator

Whether looking for VC cash, or having a quota to meet being a salesman, some of these may come handy or pretty much make someone's morning.

Here are my favorite:
e-enable integrated mindshare
empower impactful infomediaries
architect compelling ROI
productize 24/7 e-services
recontextualize compelling ROI

Doesn't matter how well you project your success, if you don't have an elevator pitch worth someone's attention span, than you don't know what you're doing, but marely relying on the web economy's state of buzziness -- this is another one. Try some copywriting exercises too. Continue reading →

Four Years of Application Pen Testing Statistics

Invaluable :

"The article presents a unique opportunity to take a peek into the usually secluded data regarding the actual risk posed to Web applications. It shows a constant increase in risk level over the four years and an overwhelming overall percentage of applications susceptible to information theft (over 57%), direct financial damage (over 22%), denial of service (11%) and execution of arbitrary code (over 8%). The article analyzes results of first time penetration tests as well as repeat tests (retests) in order to evaluate the evolution of application security within Web applications over time."

Lots of figures respecting your busy schedule, and the authors' data pointing out how the lack of repeated testing, and the "security as a one time purchase" mentality, actually means a false sense of security. Having a secured web application doesn't mean the end user won't be susceptible to a client side attack, and having a secured end user doesn't mean the web application itself will be secured, ironic, isn't it? Perhaps prioritizing the platforms to be audited, namely the major web properties, could protect the always unaware end user to a certain extend -- from himself. Related comments.

Continue reading →

Foreign Intelligence Services and U.S Technology Espionage

Talking about globalization, like it or not, perceive it as a threat to national security or a key economic benefit, it's happening and you cannot stop it. Nothing else will add more long-term value to a business or a military force than innovation, and when it comes to the U.S military's self-efficiency in R&D, it's pretty evident they've managed to achieve the balance and still dictate the rhythm.

The methods used aren't nothing new :

"The report says that foreign spies use a wide variety of techniques, ranging from setting up front companies that make phony business proposals to hacking computers containing information on lasers, missiles and other systems. But the most popular methods of attempting to obtain information was a simple “informational request” (34.2%) and attempts to purchase the information (32.2%). Attempts were also made using personal relationships, searching the Internet, making contacts at conferences and seminars, cultural exchanges."

What's new is the actual report in question - "Technology Collection Trends in the U.S. Defense Industry". OSINT is also an important trends gathering factor, and so is corporate espionage through old-fashioned malware approaches or direct intrusions, and it's great the report is considering the ease of execution on these and the possible network vulnerabilities in the contractors :

"DSS also anticipates an increase in suspicious internet activity against cleared defense contractors. The potential gain from even one successful computer intrusion makes it an attractive, relatively lowrisk, option for any country seeking access to sensitive information stored on U.S. computer networks. The risk to sensitive information on U.S. computer systems will increase as more countries develop capabilities to exploit those systems."

Then again, what's produced by the U.S but cannot be obtained from there, will be from other much more insecure third-party purchasers -- how did Hezbollah got hold of night vision gear? Or even worse, by obtaining the leftovers from a battle conflict for further clues.

The bottom line question - is the illegal transfer of U.S technology threat higher than the indirect leakage of U.S educated students taking their IQ back home, while feeling offended by their inability to make an impact were they a U.S citizen? Continue reading →

Technical Analysis of the Skype Trojan

During December yet another trojan started making rounds, this time dubbed the Skype trojan -- SEO conspiracy. Was the trojan exploiting a zero day vulnerability in the Skype protocol? Absolutely not, as it was basically using Skype's messaging service as a propagation vector, thus, the gullible and in a Christmas mood end user was still supposed to interact with the malware by clicking on the link. And with required end user's interaction, the possibilities for major outbreaks were very limited. Perhaps the only development worth mentioning is the malware author's use of commercial anti-cracking software -- NTKrnl Secure Suite -- to make the unpacking harder, or at least theoretically improve the time needed to do so compared to using publicly obtainable, and much more easily detectable packers.

Two days ago, Nicolas Brulez from Websense Security Labs released a technical analysis of the trojan itself, and here's your proof for the logical possiblities of specific copy'n'paste malware modules :

"The main protection scheme I faced was the copy pasted from my Honeynet Scan of The month 33 Challenge. The breakpoint detection was 100% identical, even the numbers I had generated randomly. More importantly, the technique I had written based on SEH + cpuid/rdtsc was also copied. The only difference was that they used the EDX register to compare the timing.

Copy pasting protection code without even changing it a little, provides no security at all and allowed me to unpack it even quicker. (gotta love looking at code you wrote 2 years ago)

It apparently included some other tricks, that made it a little harder to unpack, and the file looked like it was corrupted at some point. In order to debug it and comment my disassembly in a readable way, I opted to use a userland debugger, and thus had to write a little shellcode for injection into the packed malware. Basically, it entailed abusing Windows Exception Handling (using a hook), to get past every check. After that, one could attach his favorite userland debugger to the malware and eventually find the Original Entry Point. Although the imports rebuilding for this protector isn't hard at all, it wasn't mandatory in this executable as it only imported one function: ExitProcess"

And while the average malware coder is using commercial tools to make his releases harder to analyze, the almighty jihadist is still living in the Hacker Defender world. Continue reading →

Were you Tracking Santa's Location?

As usual, NORAD were, but there's one minor issue to keep in mind and that's how during the Christmas and New Year holidays Santa Claus is the most successfully targeted victim of identity theft. Hopefully they were tracking the real Santa through the real Rudolph as the weakest link :

"The satellites have infrared sensors, meaning they can detect heat. When a rocket or missile is launched, a tremendous amount of heat is produced - enough for the satellites to detect. Rudolph's nose gives off an infrared signature similar to a missile launch. The satellites can detect Rudolph's bright red nose with practically no problem. With so many years of experience, NORAD has become good at tracking aircraft entering North America, detecting worldwide missile launches and tracking the progress of Santa, thanks to Rudolph."

All rest is a commodity but attitude.

Continue reading →

Phishing Domains Hosting Multiple Phishing Sites

Well, well, well. What do we got here? Couple of interesting domains hosting phishing sites of multiple banks for you to take a look at, or at the cached versions to be precise. What's worth mentioning is the rise of phishing sites using the much more easily and anonymously registered .biz ; .info ; .name domains. However, the first part of these is related to 211.137.13.131 :

baldwindy.name
leqwas.biz
noosfo.biz
rsytarai.biz, another one

Multiple hosting:
201.195.156.13
lugers.biz
loreta.biz
tuker.info

Now, try searching the entire .biz space for "Bank Austria Creditanstalt". The good news is that even the average anti-phishing toolbar is capable of detecting these. The bad news is that customers aren't currently using such toolbars as much as they should. And with phishing toolkits lowering the entry barriers in this space by making it easy for wannabe phishers to "make an impact", we've got an efficient problem to deal with. Continue reading →

Google and Yahoo's Shareholders Against Censorship

Collective bargaining tends to achieve the necessary echo effect :

"The New York City Pension Fund wants shareholders to force Google and Yahoo to refuse Internet censorship requests by governments. The fund, which owns nearly $280 million worth of Google shares and $110 million in Yahoo shares, filed resolutions for shareholders at the two Internet companies to vote on at the next shareholder meetings. The resolution states that U.S.-based technology companies "that operate in countries controlled by authoritarian governments have an obligation to comply with the principles of the United Nations Declaration of Human Rights."

Go, go, go, shareholders. So that by the time censorship ends up where it's most aggressive for the time being, we can feel proud of ourselves living in a World 2.0, a world in which we all have universal access to the collective wisdom of everyone. Wait, that used to be part of both, Google's and Yahoo's mission statements once. From another perspective, the companies themselves have their hands tied by the overal Western world's revenues generation greed, and outsourcing inspirations in China's booming economy. But pretending it isn't happening is like ignoring the existence of the thought police these days.

Continue reading →

Le Cyber Jihad

It's very nice to see that Marc Olanié is still keeping track of my articles. Here are several more worth Babelfishing. Continue reading →

Top Ten Scams of 2006

ConsumerAffairs.com did a great job in summarizing the top 10 scams of 2006 "from the roughly 50,000 consumer complaints we've processed in the past year". Here's what the gullible consumer complains about :

01. Fake Lottery Scam

ConsumerAffairs.com reported on one case in which an elderly Kansas man lost over $300,000. You should have Asked Merrill to point you to the "tickets" with the highest probability of success, but it's too late for you now. Baby booming gullibility in action.

02. Phishing-Vishing Scams

I'm very surprised it's the second and not the first complain, but how come? Consumers aren't even aware they got scammed at the first place. Do yourself a favour, and don't discuss your financial details with automated systems. Think before you act, it's like deciding whether to enter a singles bar or not.

03. Phony Job Scam

"Any employment offered online without a formal interview, no matter where it originates, should be treated with skepticism," said Arkansas Attorney General Mike Beebe, who investigated one of these scams in 2006. Thank you, you've just ruined the entire virtual telecommuting concept. I'm aware of another type of scam where fake job postings seek to harvest as much personal information from applications as possible. Other practices are also used.

04. Negative Option Scams

Look for the ASTERISKS, it should be somewhere around the FREE proposal.

05. Nigerian 419 Scams

People falling into this one, are the type of people suffering from the "rich-uncle complex". You don't know his exact wealth, but you secretly hope that on a sunny day a handsome, and of course charging by the minute laywer will bring the news you've been subconsciously expecting your entire life. Think for real and forget about the Internet. Would a complete stranger offer you millions of dollars because he has no one else to give the money to, or cannot open up a bank account for themselves?

06. Pump & Dump Scam
Rainer Böhme and Thorsten Holz evaluated the situation.

07. Bogus Fuel Saving Devices
Make an analogy with washing powder/tablets/liquid who's actively advertised as an "energy saver" due to its sophisticated technology that doesn't require hot water, when it happens to be a commodity and if you're going to be saving energy from it, then you've either watched a movie about the Third World, or are very desperate.

08. Grandparents Scam
An elderly person is targeted by the scammer who calls and says something like, "It's me, grandpa." The elderly person will respond, thinking it's one of their grandchildren. Unbelieavable, and perhaps another reason to keep in touch with your grand-parents more often, so they could at least recognize your voice.

09. Oprah Ticket Scam

In case you fall victim into this one, you're not just bored to the bottom of your brain, but a potential guest at Oprah's show with the unique ability to explain how this scam ruined your life, but later on helped your meet the person of your life, where else if not in an online scam discussion group. I feel you.

10. craigslist Scam

It's like the Yellow Pages, some postings are so automatically generated that they happen to be a waste of time, but hopefully not money, so be aware. Continue reading →

Terrorism Cartoon Contest

Why is it that even with my extemely well developed sense of black humour, I'm still not laughting? Here's another contest collection, again hosted by Iran, this time on the denial of the Holocaust. Thankfully, my history teacher taught me otherwise, and the No Such Agency folks have the complete coverage in their indispensable "Eavesdropping on Hell : Historical Guide to Western Communications Intelligence and the Holocaust 1939-1945". Continue reading →

Busy Wednesday

Wednesday, Wednesday, so good to blog. Continue reading →

BuzZzZ Generation

Just a few of the sites/blogs that have recently featured my posts exposing the low lifes :

- Linuxsecurity.com - "Analysis of the Technical Mujahid - Issue One" ; "Current State of Internet Jihad"
- Informit.com - "How do terrorists spell rootkit in Farsi?"
- Defensetech.org - "Rapid fire 1" ; "Rapid fire 2"
- Net-security.org - "Analysis of the Technical Mujahid - Issue One"
- Cyberia.org.il

Interested in knowing how was Al Qaeda using the Internet before 9/11 with all the multimedia released back then? Moreover, have you ever wanted to take a peek at some of the most recent tools-of-the-trade malware authors use on a daily basis? Stay tuned for the Christmas Full Disclosure Series summarizing some of my recent findings, and beyond!

Share your knowledge. It's a way to achieve immortality. Dalai Lama Continue reading →

Google Translate Hack

Google seems to have fixed this one already, but trying it the other way around you can still feel what BETA is all about. My guess is that translations of unknown words or combinations better return a clustered result from the Web, than no result at all, which is exactly what is happening in this case. Continue reading →

Analysis of the Technical Mujahid - Issue One

An OSINT conducted, a tax payer's buck saved somewhere.

Last week, the mainstream media was abuzz with the release of the first jihadist e-zine discussing hacking, information hiding, of course in between the lines of radical propaganda, whereas no one was providing more information on the exact nature of the articles, but the SITE institute. So I decided to take a peek at the Technical Mujahid for myself, in order to break through the FUD, or not see the "threat sliced on pieces" by different news sources.

According to the official release, the magazine's download locations seem to be slowly becoming useless, besides the Rapidshare link which seems to be still fully working -- the Internet Haganah reasonably points out that owning a copy of it might get you in trouble in some countries, so don't.

Despite that I don't speak any Arabic languages, and I pressume neither do you, the e-zine is rich on visual materials and you can pretty much grasp the big picture. Namely, that it's practical compared to theoretical source of information, it's targeting mixed audiences, and it's keeping it very simple. So I've decided to compile a summary of the key sections and topics in the articles covered for future references. In one sentence - its simplicity is not to be feared, but its practicality.

The release of the magazine is an indication of the ongoing use of the Internet for mass-education -- economies of scale -- through videos and visual howto's, but much more advanced information related to information security could be obtained from public sources. The cellphone triangulation in Iraq, and the demonstration of Hacker Defender are worth mentioning, but overall, concepts such as information warfare or online PSYOPS remain unstructured and abstract ideas to the average jihadist - for now. Notice the multimedia file used as an example for the alternate data stream as well and draw up the conclusions on your own.

Don't exclude the logical possibility of on purposely disinforming the general public and various intel folks across the world on a relatively primitive inforwar practices such as using PGP and alternate data streams.

Here are the articles themselves :

01. Article One - Alternate Data Streams - steganography example given, rootkits - hacker defender covered, examples provided, abomosab.jpg used as an example

02. Article Two - Satellite Communications and the importance of GPS, handheld GPS, explains triangulation, mentions satellite imagery's power, and satellite transfer speeds, mentions 1575 and 1227 as carrier frequencies and Digital Sequence Spread Specturm - DSSS, mentions handheld GPS receiver, includes photos of 3G data card, laptop. It then discusses a locked device with a "WARNING" sign on it

03. Article Three - Visual HOWTO on Install VMware

04. Article Four - Article on digital media players, the different formats, subtitles, and the NTSC and PAL systems, recording basics as it looks like

05. Article Five - Introduction to PGP - Zimmerman is quoted, explanation of the RSA algorithm, recommending the use of PGP Whole Disk, features warning message that trial versions of PGP Whole Disk will self-decrypt

And SITE Institute's comments on the propaganda side in the introduction and conclusion :

"For future issues, the editors urge members of the jihadist Internet community to submit articles in the field of technology for publishing. They write: “My kind, technical Mujahid brother, the magnitude of responsibility which is placed upon you is equal to what you know in the regard of information. Do not underestimate anything that you know; perhaps a small article that you write and publish can benefit one Mujahid in the Cause of Allah or can protect a brother of yours in Allah. This way you will gain the great reward with the permission of Allah."

If you perceive the Technical Mujahid magazine as a threat to the national security of any country, old issues of Phrack magazine must be giving you the nightmares.

Have a productive week everyone, and stay informed!

Continue reading →

Analysis of the Technical Mujahid - Issue One

An OSINT conducted, a tax payer's buck saved somewhere.

Last week, the mainstream media was abuzz with the release of the first jihadist e-zine discussing hacking, information hiding, of course in between the lines of radical propaganda, whereas no one was providing more information on the exact nature of the articles, but the SITE institute. So I decided to take a peek at the Technical Mujahid for myself, in order to break through the FUD, or not see the "threat sliced on pieces" by different news sources.

According to the official release, the magazine's download locations seem to be slowly becoming useless, besides the Rapidshare link which seems to be still fully working -- the Internet Haganah reasonably points out that owning a copy of it might get you in trouble in some countries, so don't.

Despite that I don't speak any Arabic languages, and I pressume neither do you, the e-zine is rich on visual materials and you can pretty much grasp the big picture. Namely, that it's practical compared to theoretical source of information, it's targeting mixed audiences, and it's keeping it very simple. So I've decided to compile a summary of the key sections and topics in the articles covered for future references. In one sentence - its simplicity is not to be feared, but its practicality.

The release of the magazine is an indication of the ongoing use of the Internet for mass-education -- economies of scale -- through videos and visual howto's, but much more advanced information related to information security could be obtained from public sources. The cellphone triangulation in Iraq, and the demonstration of Hacker Defender are worth mentioning, but overall, concepts such as information warfare or online PSYOPS remain unstructured and abstract ideas to the average jihadist - for now. Notice the multimedia file used as an example for the alternate data stream as well and draw up the conclusions on your own.

Don't exclude the logical possibility of on purposely disinforming the general public and various intel folks across the world on a relatively primitive inforwar practices such as using PGP and alternate data streams.

Here are the articles themselves :

01. Article One - Alternate Data Streams - steganography example given, rootkits - hacker defender covered, examples provided, abomosab.jpg used as an example

02. Article Two - Satellite Communications and the importance of GPS, handheld GPS, explains triangulation, mentions satellite imagery's power, and satellite transfer speeds, mentions 1575 and 1227 as carrier frequencies and Digital Sequence Spread Specturm - DSSS, mentions handheld GPS receiver, includes photos of 3G data card, laptop. It then discusses a locked device with a "WARNING" sign on it

03. Article Three - Visual HOWTO on Install VMware

04. Article Four - Article on digital media players, the different formats, subtitles, and the NTSC and PAL systems, recording basics as it looks like

05. Article Five - Introduction to PGP - Zimmerman is quoted, explanation of the RSA algorithm, recommending the use of PGP Whole Disk, features warning message that trial versions of PGP Whole Disk will self-decrypt

And SITE Institute's comments on the propaganda side in the introduction and conclusion :

"For future issues, the editors urge members of the jihadist Internet community to submit articles in the field of technology for publishing. They write: “My kind, technical Mujahid brother, the magnitude of responsibility which is placed upon you is equal to what you know in the regard of information. Do not underestimate anything that you know; perhaps a small article that you write and publish can benefit one Mujahid in the Cause of Allah or can protect a brother of yours in Allah. This way you will gain the great reward with the permission of Allah."

If you perceive the Technical Mujahid magazine as a threat to the national security of any country, old issues of Phrack magazine must be giving you the nightmares.

Have a productive week everyone, and stay informed!

Continue reading →