Home » Posts tagged 'hacker' (Page 2)
Tag Archives: hacker
Cyber Cold War
I try to write on cyber conflict without getting into the politics of why someone is hacking someone else. I always get beaten by someone in the comments thread when I write on politics.
But recent events have forced me to update my usual “how-to” cyber conflict to “why” cyber conflict. This is because of a terrorist attack in my hometown Delhi.
(updated-
Iran allegedly tried (as per Israel) to assassinate the wife of Israeli Defence Attache in Delhi using a magnetic bomb, India as she went to school to pick up her kids, somebody else put a grenade in Israeli embassy car in Georgia which was found in time.
Based on reports , initial work suggests the bomb was much more sophisticated than local terrorists, but the terrorists seemed to have some local recce work done.
India has 0 history of antisemitism but this is the second time Israelis have been targeted since 26/11 Mumbai attacks. India buys 12 % of oil annually from Iran (and refuses to join the oil embargo called by US and Europe)
Cyber Conflict is less painful than conflict, which is inevitable as long as mankind exists. Also the Western hemisphere needs a moon shot (cyber conflict could be the Sputnik like moment) and with declining and aging populations but better technology, Western Hemisphere govts need cyber conflict as they are running out of humans to fight their wars. Eastern govt. are even more obnoxious in using children for conflict propaganda, and corruption.
Last week CIA.gov website went down
This week Iranian govt is allegedly blocking https traffic on eve of Annual Revolution Day (what a coincidence!)
Some resources to help Internet users in Iran (or maybe this could be a dummy test for the big one – hacking the great firewall of China)
News from Hacker News-
http://news.ycombinator.com/item?id=3575029
I’m writing this to report the serious troubles we have regarding accessing Internet in Iran at the moment. Since Thursday Iranian government has shutted down the https protocol which has caused almost all google services (gmail, and google.com itself) to become inaccessible. Almost all websites that reply on Google APIs (like wolfram alpha) won’t work. Accessing to any website that replies on https (just imaging how many websites use this protocol, from Arch Wiki to bank websites). Also accessing many proxies is also impossible. There are almost no official reports on this and with many websites and my email accounts restricted I can just confirm this based on my own and friends experience. I have just found one report here:
http://kabirnews.com/iran-shut-down-gmail-google-yahoo-and-sites-using-https-protocol/202/
The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.
I just wanted to let you guys know about this. If you have any solution regarding bypassing this restriction please help!
The boys at Tor think they can help-
but its not so elegant, as I prefer creating a batch file rather than explain coding to newbies.
this is still getting to better and easier interfaces
https://www.torproject.org/projects/obfsproxy-instructions.html.en
Obfsproxy Instructions
Step 1: Install dependencies, obfsproxy, and Tor
You will need a C compiler (gcc), the autoconf and autotools build system, the git revision control system, pkg-config andlibtool, libevent-2 and its headers, and the development headers of OpenSSL.
On Debian testing or Ubuntu oneiric, you could do:
# apt-get install autoconf autotools-dev gcc git pkg-config libtool libevent-2.0-5 libevent-dev libevent-openssl-2.0-5 libssl-dev
If you’re on a more stable Linux, you can either try our experimental backport libevent2 debs or build libevent2 from source.
Clone obfsproxy from its git repository:
$ git clone https://git.torproject.org/obfsproxy.git
The above command should create and populate a directory named ‘obfsproxy’ in your current directory.
Compile obfsproxy:
$ cd obfsproxy
$ ./autogen.sh && ./configure && make
Optionally, as root install obfsproxy in your system:
# make install
If you prefer not to install obfsproxy as root, you can instead just modify the Transport lines in your torrc file (explained below) to point to your obfsproxy binary.
You will need Tor 0.2.3.11-alpha or later.
Step 2a: If you’re the client…
First, you need to learn the address of a bridge that supports obfsproxy. If you don’t know any, try asking a friend to set one up for you. Then the appropriate lines to your tor configuration file:
UseBridges 1
Bridge obfs2 128.31.0.34:1051
ClientTransportPlugin obfs2 exec /usr/local/bin/obfsproxy --managed
Don’t forget to replace 128.31.0.34:1051 with the IP address and port that the bridge’s obfsproxy is listening on.
Congratulations! Your traffic should now be obfuscated by obfsproxy. You are done! You can now start using Tor.
For old fashioned tunnel creation under Seas of English Channel-
http://dag.wieers.com/howto/ssh-http-tunneling/
- You can proxy to anywhere (see the Proxy directive in Apache) based on names
- You can proxy to any port you like (see the AllowCONNECT directive in Apache)
- It works even when there is a layer-7 protocol firewall
- If you enable proxytunnel ssl support, it is indistinguishable from real SSL traffic
- You can come up with nice hostnames like ‘downloads.yourdomain.com’ and ‘pictures.yourdomain.com’ and for normal users these will look like normal websites when visited.
- There are many possibilities for doing authentication further along the path
- You can do proxy-bouncing to the n-th degree to mask where you’re coming from or going to (however this requires more changes to proxytunnel, currently I only added support for one remote proxy)
- You do not have to dedicate an IP-address for sshd, you can still run an HTTPS site
Related-
http://opensourceandhackystuff.blogspot.in/2012/02/captive-portal-security-part-1.html
and some crypto for young people
http://users.telenet.be/d.rijmenants/en/onetimepad.htm
Me- What am I doing about it? I am just writing poems on hacking at http://poemsforkush.com
How to learn to be a hacker easily
1) Are you sure. It is tough to be a hacker. And football players get all the attention.
2) Really? Read on
3) Read Hacker’s Code
http://muq.org/~cynbe/hackers-code.html
The Hacker’s Code
“A hacker of the Old Code.”
- Hackers come and go, but a great hack is forever.
- Public goods belong to the public.*
- Software hoarding is evil.
Software does the greatest good given to the greatest number. - Don’t be evil.
- Sourceless software sucks.
- People have rights.
Organizations live on sufferance. - Governments are organizations.
- If it is wrong when citizens do it,
it is wrong when governments do it. - Information wants to be free.
Information deserves to be free. - Being legal doesn’t make it right.
- Being illegal doesn’t make it wrong.
- Subverting tyranny is the highest duty.
- Trust your technolust!
4) Read How to be a hacker by
Eric Steven Raymond
http://www.catb.org/~esr/faqs/hacker-howto.html
or just get the Hacker Attitude
The Hacker Attitude
- 1. The world is full of fascinating problems waiting to be solved.
- 2. No problem should ever have to be solved twice.
- 3. Boredom and drudgery are evil.
- 4. Freedom is good.
- 5. Attitude is no substitute for competence.
- 5) If you are tired of reading English, maybe I should move on to technical stuff
- 6) Create your hacking space, a virtual disk on your machine.
- You will need to learn a bit of Linux. If you are a Windows user, I recommend creating a VMWare partition with Ubuntu
- If you like Mac, I recommend the more aesthetic Linux Mint.
- How to create your virtual disk-
- read here-
- Download VM Player here
- http://www.vmware.com/support/product-support/player/
- Down iso image of operating system here
- http://ubuntu.com
- Downloading is the longest thing in this exercise
- Now just do what is written here
- http://www.vmware.com/pdf/vmware_player40.pdf
- or if you want to try and experiment with other ways to use Windows and Linux just read this
- http://www.decisionstats.com/ways-to-use-both-windows-and-linux-together/
- Moving data back and forth between your new virtual disk and your old real disk
- http://www.decisionstats.com/moving-data-between-windows-and-ubuntu-vmware-partition/
- 7) Get Tor to hide your IP address when on internet
- https://www.torproject.org/docs/tor-doc-windows.html.en
- 8a ) Block Ads using Ad-block plugin when surfing the internet (like 14.95 million other users)
- https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/
- 8b) and use Mafiafire to get elusive websites
- https://addons.mozilla.org/en-US/firefox/addon/mafiaafire-redirector/
- 9) Get a Bit Torrent Client at http://www.utorrent.com/
- This will help you download stuff
- 10) Hacker Culture Alert-
- This instruction is purely for sharing the culture but not the techie work of being a hacker
- The website Pirate bay acts like a search engine for Bit torrents
- http://thepiratebay.se/
- Visiting it is considered bad since you can get lots of music, videos, movies etc for free, without paying copyright fees.
- The website 4chan is considered a meeting place to meet other hackers. The site can be visually shocking
- http://boards.4chan.org/b/
- You need to do atleast set up these systems, read the websites and come back in N month time for second part in this series on how to learn to be a hacker. That will be the coding part.
- END OF PART 1
- Updated – sorry been a bit delayed on next part. Will post soon.
C4ISTAR for Hacking and Cyber Conflict
As per http://en.wikipedia.org/wiki/C4ISTAR
C2I stands for command, control, and intelligence.
C3I stands for command, control, communications, and intelligence.
C4I stands for command, control, communications, computers, and (military) intelligence.
C4ISTAR is the British acronym used to represent the group of the military functions designated by C4 (command, control, communications, computers), I (military intelligence), and STAR (surveillance, target acquisition, and reconnaissance) in order to enable the coordination of operations
I increasingly believe that cyber conflict will develop its own terminology and theory and paradigms in due time. In the meantime, it will adopt paradigms from existing military literature and adapt it to the unique sub culture of cyber conflict for both offensive, defensive as well as pre-emptive actions. Here I am theorizing for a case of targeted hacking attacks rather than massive attacks that bring down a website for a few hours and achieve nothing but a few press headlines . I would also theorize on countering such attacks.
So what would be the C4ISTAR for -
1) Media company supporting SOPA/PIPA/Take down Mega Upload-
Command and Control refers to the ability of commanders to direct forces-
This will be the senior executives including the members of board, legal officers, and public relationship/marketing people. Their name is available from corporate websites, and social media scraping can ensure both a list of contact addresses (online) as well as biases for phishing /malware attacks. This could also include phone (flooding or voicemail hacking ) attacks , and attacks against the email server of the company rather than the corporate website.
Communications- This will include all online and social media channels including websites of the media company , but also those of the press relations firms handling communications , phones,websites- anything which the target is likely to communicate externally (and if possible internal communication)
Timing is everything- coordinating attacks immediately is juevenile, but it might be more mature to attack on vulnerable days like product launches or just before a board of directors meeting
Intelligence-
Most corporates have an in-house research team, they can be easily targeted using social media channels, but also offline research and digging deep. Targeting intelligence corps of the target corporate is likely to produce a much better disruption. Eventually they can be persuaded to stop working for that corporate.
Computers- Anything that runs on electricity and can be disabled – should be disabled. This might require much more creativity than just flooding.
surveillance- This can be both online as well as offline, and would be of electronic assets, likely responses for the attack, and the key people who are to be disrupted.
target acquisition- at least ten people within each corporate can and should be ideally disrupted, rather than just the website. this would call for social media scraping, and prior planning. even email in-boxes can be disrupted (if all else fails)
and reconnaissance-
study your target companies, target employees, and their strategies.
Then segment and prioritize in a list of matrix of 10 to 10, who is more vulnerable and who is more valuable to attack.
the C4ISTAR for -a hacker activist organization is much more complicated but forensics reveal that most hackers tend to leave a signature style (in terms of computers,operating systems,machine ids,communication, tools, or even port numbers used)
the best defense for a media rich company to prevent hacking attacks is to first identify its own C4ISTAR structure for its digital content strategy and then fortify as well as scrub vulnerabilities (including from online information regarding its own employees)
(to be continued)
http://www.catb.org/~esr/faqs/hacker-howto.html
The Hacker Attitude
Some Ways Anonymous Could Disrupt the Internet if SOPA is passed
This is a piece of science fiction. I wrote while reading Isaac Assimov’s advice to writers in GOLD, while on a beach in Anjuna.
1) Identify senators, lobbyists, senior executives of companies advocating for SOPA. Go for selective targeting of these people than massive Denial of Service Attacks.
This could also include election fund raising websites in the United States.
2) Create hacking tools with simple interfaces to probe commonly known software errors, to enable wider audience including the Occupy Movement students to participate in hacking. thus making hacking more democratic. What are the top 25 errors as per http://cwe.mitre.org/cwss/
-http://www.decisionstats.com/top-25-most-dangerous-software-errors/ ?
Easy interface tools to check vulnerabilities would be the next generation to flooding tools like HOIC, LOIC – Massive DDOS atttacks make good press coverage but not so good technically
3) Disrupt digital payment mechanisms for selected targets (in step1) using tools developed in Step 2, and introduce random noise errors in payment transfers.
4) Help create a better secure internet by embedding Tor within Chromium with all tools for anonymity embedded for easy usage – a more secure peer to peer browser (like a mashup of Opera , tor and chromium).
or maybe embed bit torrents within a browser.
5) Disrupt media companies and cloud computing based companies like iTunes, Spotify or Google Music, just like virus, ant i viruses disrupted the desktop model of computing. After that offer solutions to the problems like companies of anti virus software did for decades.
6) Hacking websites is fine fun, but hacking internet databases and massively parallel data scrapers can help disrupt some of the status quo.
This applies to databases that offer data for sale, like credit bureaus etc. Making this kind of data public will eliminate data middlemen.
7) Use cross border, cross country regulatory arbitrage for better risk control of hacker attacks.
8) recruiting among universities using easy to use hacking tools to expand the pool of dedicated hacker armies.
9) using operations like those targeting child pornography to increase political acceptability of the hacker sub culture. Refrain from overtly negative and unimaginative bad Press Relations
10) If you cant convince them to pass SOPA, confuse them 
Use bots for random clicks on ads to confuse internet commerce.
Secure Browsing from Mobile and PC ( Tor ,PeerNet, WasteAgain)
While Tor remains the tool of choice with pseudo-techie hacker wannabes , there is enough juice and smoke and mirrors on the market to confuse your average Joe.
For a secure browsing experience on Mobile – do NOT use either Apple or Windows OS
Use Android and this app called Orbot in particular
Installing Tor with a QR code
Orbot is easy to install by simply scanning the following QR code with your Android Barcode scanner.
Installing Tor from the Android Market
Orbot is available in the Android Market.
ENTER PEERNET
If you have a Dell PC, well just use PeerNet to configure and set up your own network around the neighbourhood. This is particularly applicable if you are in country that is both repressive and not so technologically advanced. Wont work in China or USA.
http://support.dell.com/support/edocs/network/p70008/EN/vista_7/peernet.htm
What is a peer network?
A peer network is a network in which one computer can connect directly to another computer. This capability is accomplished by enabling access point (AP) functionality on one of the computers. Other computers can then connect to this computer in the same way that they would connect to a physical AP. If Internet Connection Sharing is enabled on the computer that has the AP functionality, computers that connect to that computer have Internet connectivity as well.
A basic peer network, which requires no networking knowledge or experience to set up, should meet the needs of most home users and small businesses. By default, a basic peer network is configured with the strongest available security (see How do I set up a basic peer network?).
For users who are familiar with wireless networking technology, advanced configuration features are available to do the following:
• Change security settings (see How do I configure my peer network?)
• Choose which method (push button or PIN) computers with Wi-Fi Protected Setup™ capability can join your peer network (see How do I allow peer devices to join my peer network using Wi-Fi Protected Setup technology?)
• Change the DHCP Server IP address (see How do I configure my peer network?).
• Change the channel on which to operate your peer network (see How do I configure my peer network?)
If you are really really in a need for secure browsing (like you are maybe a big hot shot in the tech world), I suggest go over to VMWare
http://www.vmware.com/products/player/
create a seperate Linux (Ubuntu for ease) virtual disc, then download the Tor Browser Bundle from
https://www.torproject.org/projects/torbrowser.html.en for surfing and a Peernet (above) or a prepaid one time use disposable mobile pre-paid wireless card. It is also quite easy to delete your virtual disc in times of emergencies (but it is best to use encryption even when in Ubuntu https://help.ubuntu.com/community/EncryptedHome)
IRC chat is less secure than you think it is thanks to BOT Trawlers- so I am hoping someone in the open source community updates Waste Again for encrypted chats http://wasteagain.sourceforge.net/
What is “WASTE again”?
“WASTE again” enables you to create a decentralized and secure private mesh network using an unsecure network, such as the internet. Once the public encryption keys are exchanged, sending messages, creating groupchats and transferring files is easy and secure.
Creating a mesh
To create a mesh you need at least two computers with “WASTE again” installed. During installation, a unique pair of public and private keys for each computer is being generated. Before the first connection can be established, you need to exchange these public keys. These keys enable “WASTE again” to authenticate every connection to other “WASTE again” clients.
After exchanging the keys, you simply type in the computers IP address to connect to. If that computer is located behind a firewall or a NAT-router, you have to create a portmap first to enable incoming connections.
At least one computer in your mesh has to be able to accept incoming connections, making it a “public node”. If no direct connection between two firewalled computers can be made, “WASTE again” automatically routes your traffic through one or more of the available public nodes.
Every new node simply has to exchange keys with one of the connected nodes and then connect to it. All the other nodes will exchange their keys automatically over the mesh.
Hacking Google
Google has a funny web page if you want to go into hacker mode
Just go to
http://www.google.com/webhp?hl=xx-hacker
and see this-
Ah! The Internet.
On the Internet I am not brown or black or white. I am Anonymous and yet myself. I am free to choose whatever identity I wish to choose, free to drink from whatever pools of knowledge my local government wishes to forbid. The Internet does not care about how rich or poor I may be. It has ways to track exactly where I am, but it has tools to disguise that as well. On the internet the strongest government, the richest corporation and the deepest pockets can tremble before the bits and bytes of a talented and motivated hacker working from his basement in his parents house.
There are no losers on the Internet: only winners. Except for those who seek to covet and control the uncontrollable- the human desire to seek knowledge beyond the confines of whatever cave they may find themselves borne in.
There are no countries to wage war on the Internet: there is nothing to kill and die for. The Internet allowed a million writers to write and publish without the interference of brokers and intermediaries. It allowed a billion people to download a trillion songs that were locked away in some rich man’s virtual vault. It allowed a dozen countries to overthrow their dictators without wasting a billion worth of goods and treasure.
On the Internet, everyone is equal, free and true to the own nature they choose, not the fate that is chosen by corporation, country or circumstance.
Ah! The Internet- it will set you free.
