Slashdot Mirror

The link on attrition's site

Defacements by OS

Wow. That has to be one of the lamest things I've read for a long, long time.

Check this out.

Take that Tux

Use a fixed font, not variable width. Magazines are usually text, "l33t" instead of "elite" came out of ascii art. </trivia>

L0pht Heavy Industries
Cult of the dead cow
Happyhacker.org
Infiltration.org
hackers.com
Hacker news
attrition.org
AntiOnline
AntiCode
phrack
2600
Many of these pages contain arhives that have documents on cracking networks and such.
Vast documents on cracking NT servers.
A few of these are not really related but fun any how.
And the archives also contain many documents on system defence.
-----
If my facts are wrong then tell me. I don't mind.

This is actually very old and has probably nothing to do with this particular AC - apart from the fact that he copied and pasted it.

It's from an old 31337 H4X0R group called BoW (Brotherhood of Warez)

You can find that particular newsletter here.

http://www.attrition.org/gallery/m s/win2k-kbd.jpg

This obligitory Microsoft slam brough to you by attrition.org.

• any

Try securing your systems BEFORE they get cracked. A good few places to start:

Insecure.org, especially this top 50 security tools page.
SecurityFocus the disseminators of the BUGTRAQ list among others.
Attrition.org, especially their security page.
And of course 2600, the l0pht, and Phrack for the latest tasty street info....

#include "disclaim.h"
"All the best people in life seem to like LINUX." - Steve Wozniak

Try securing your systems BEFORE they get cracked. A good few places to start:

Insecure.org, especially this top 50 security tools page.
SecurityFocus the disseminators of the BUGTRAQ list among others.
Attrition.org, especially their security page.
And of course 2600, the l0pht, and Phrack for the latest tasty street info....

#include "disclaim.h"
"All the best people in life seem to like LINUX." - Steve Wozniak

Does Vice President Al Gore have an unfair advantage in the online campaign of the presidency since he invented the Internet? Will the FEC step in to level the playing field for G.W. Bush so he can compete online against Al Gore?

Absolutely. Since Gore wrote the specs on TCP/IP and was the main instigator of all the RFC's in existance he has a major advantage. Bush is probably going out and secretly hiring all the "SkR1p7 K1DDi3z" once he has them on their side he will have a more level playing field.

Bush probably wants the L0pht on his side as well being as they are top notch, and of course they wrote the one book that prevents the one father of the internet from sleeping at night.

;)

Most Linux/*NIX holes aren't so glaringly stupid, and are a hell of a lot harder to exploit. Why should arbitrary script code be able to affect the registry (only one of the most important files on a Windows 9x system), overwrite files, and e-mail itself without telling the user? And why in hell is the Office "assistant" usable in resetting security permissions?

"But, but, but, someone could write a script for Linux too! Ha, got ya there!"

No, you don't. If a user sets up sh to run scripts automatically in Netscape, or downloads and sets the executable bit, it would still only affect that user's files unless they were dumb enough to run Netscape or the script as root. The user would lose the files they own, but binaries and pretty much anything outside /home/$USER would remain unaffected. This is assuming the user didn't bother to at least read through the script first, or find out what the heck it actually is.

"But, but, but, there are bugs in Linux! And some can lead to a root compromise!"

No denying that; they still require some level of actual skill, either in programming or ingenuity, to take advantage. Once again; arbitrary code should not be able to affect anything; it should be contained (like the Java sandbox), and never run as an administrator. NT at least takes steps in this direction, though a cursory look through the Attrition page crack archives should show how much NT is like Swiss cheese.

The point: Windows 9x, and to a lesser extent NT, is inherently insecure, allowing arbitrary code and even scripts to affect important system files and take actions without the user's knowledge. The Morris Worm forced *NIX to shape up; perhaps dragging Windows into the light will force Microsoft to do the right thing for once.

Attrition hosts the defaced web page archive seen on HNN, in addition to having zillions of text files. They also have a huge movie archive which includes every funny/disturbing movie that ever landed in your inbox.

Check it out, its a great resource.

peas,
-Nick

Attrition hosts the defaced web page archive seen on HNN, in addition to having zillions of text files. They also have a huge movie archive which includes every funny/disturbing movie that ever landed in your inbox.

Check it out, its a great resource.

peas,
-Nick

Anyone who regularly looks at attrition's defaced mirror knows that a dominating portion of the blackhat crackers out there are using well known bugs and exploiting lazy (or overburdened, or unqualified) administrators instead. Most crackers are looking for noteriety first and everything else second. That's why web pages are defaced, credit card numbers are posted, etc. etc. How many blackhats do you think are looking for the bugs and keeping their mouths shut about it? I'm not saying it never happens, but certainly having open-source does more good than harm.

And another thing, if its so easy to grep for strcpy then why hasn't it been done to the code in the first place? Why isn't it automatic?

See for yourself -- looks like someone decided to counterattack.

Another interesting info point: with such small marketshare, IIS consistently accounts for 50-70% of reported defacements on attrition.org OS Statistics

http://www.cryptome.org
http://jya.com/crypto-free.htm
Learning About Cryptography
Ritter's Crypto Glossary and
Dictionary of Technical Cryptography
Encryption & Security Tutorial
N.A. Crypto Archives
International PGP site
NSA National Cryptologic Museum
EFF
attrition.org crypto archive
Bruce Schneier's Crypto-Gram

and last, but not least (the archive i developed) ....

PacketStorm Crypto Archives

there are lots and lots of excellent tutorials, docs, glossaries, and links to many of the great crypto sites in the world at all of the URLs above.

for the best info on NSA, ECHELON, misc paranoia, you should first check out Cryptome/JYA. i archived quite a bit of stuff related to your questions at the packetstorm site too - packetstorm.securify.com/crypt/nsa/.

feel free to email me directly if you like too. over the years, i have had some interesting experiences with the NSA, BXA, etc - primarily regarding my hosting of crypto archives, and personal investigations of NSA, ECHELON. if you want to discuss these things, get the pgp key for ken.williams@ey.com from www.keyserver.net, and send your key(s) and crypted msgs to tattooman@genocide2600.com

The URL's are....

bsdgirl

linuxchiq

The URL's are....

bsdgirl

linuxchiq

• Tables? Look at the source of Attrition's main page - it is one big table.
• perl & cgi? - Shame on you.

• Tables? Look at the source of Attrition's main page - it is one big table.
• perl & cgi? - Shame on you.

The real question is ... how much more impressive is an article about potatoes with images tables javascripts php perl cgi and whatever ... compared to the simple bare-minimum html page with nothing other than black text on a white background. The article doesn't change ... The potato still grows ... so what's the need for extra space? People like eye candy ... just look at microsoft.

From one of the many 2600 FAQs:

Alt.2600 is a Usenet newsgroup for discussion of material relating to 2600 Magazine, the hacker quarterly. It is NOT for the Atari 2600 game machine.

It doesn't say it, but the inference is that neither is the magazine.

--

Basically, the German recording industry is selling the idea that they should have carte blanche to block any incoming packets they see fit, at the router.

Don't forget the other following security references:

Cert: http://www.cert.org/

Packetstorm: http://packetstorm.securify.com/index.s html

and Attrition has some stuff too http://www.attrition.org/

Every corporate website would employ the olfactory equivalent of Muzak -- some superficial focus grouped scent of productivity and profit, mixed with some twinge of dynamism and excitement. Evil h4x0rs would break in and replace these smell files with the smell of pot (doubt that? Check the attrition hacked-sites archive and count the pot references).

We would receive spam offering us the usual "free pics delivered daily to your email box," augmented with "wee wiff of quim in the morning" offerings no discriminating connosieur (sp) could resist. [Rob Roy reference]

Mailbombs would become messier affairs.

Valentine's day (easy). cron jobs that produce the smell of toast and coffee (or other apropriate cues) at the right times of day.

Rather than spraying an aerosol about whilst cleaning a bathroom, you'd send mail to the e-toilet.

I pity those who got their moderator points on this one. :)

it's hard to use this list to compare linux vs. NT, because lots of the bugs listed for the operating systems are in add-ons and third-party products.

the nearest statistical comparison of openrating-system-security is on attritions web-defacement-counter. in the overall OS-count from august 1999 to present Win-NT is leading clearly with 55%, followed by linux with 19% and solaris with 13%. source: http://www.attrition.org/mirror/att rition/os.html

these total number of defacements should also take into account, that there are more webservers running on linux than on NT, as can be seen here.

open source brings a security-problem which is not as big in closed source: it's far easier to write trojans. but this risk is small compared to backdoors intentionally implemented by clodes-source software manufactures. a good example is the international version of lotus notes where the NSA knows 24bit of the 64bit-key.

it's hard to use this list to compare linux vs. NT, because lots of the bugs listed for the operating systems are in add-ons and third-party products.

the nearest statistical comparison of openrating-system-security is on attritions web-defacement-counter. in the overall OS-count from august 1999 to present Win-NT is leading clearly with 55%, followed by linux with 19% and solaris with 13%. source: http://www.attrition.org/mirror/att rition/os.html

these total number of defacements should also take into account, that there are more webservers running on linux than on NT, as can be seen here.

open source brings a security-problem which is not as big in closed source: it's far easier to write trojans. but this risk is small compared to backdoors intentionally implemented by clodes-source software manufactures. a good example is the international version of lotus notes where the NSA knows 24bit of the 64bit-key.

CTRL-ALT-DEL must be a real pain for those little guys, what with their fingers all stuck together! They must have to work as a team to do it!

No, it doesn't take a whole team, when you have the proper tool to do it.

Hmm... of course, it also would be quite cool to use this Bill figure as some sort of voodoo doll with needles and that kind of stuff... (OK, that was quite sick)

I like that! A Bill Gates Stick Pin Action Figure!

Here is a case being used as /dev/null, the bit bucket, the recyclotron, the idea bin . . .

Finals are over: Dan gets started.

Dan sucessfully cracks the Machine. Increments Number of Cracks, adds name to Credits, and waits to see how long it takes for someone to notice. Leaves self back door in form of open port to telnet to.

I notice the change of the website to what is currently hosted here, and emailed Dan about it. (on a side note, I'm not trying to take credit for notifying him first. I'm just stating what I saw)

Dan resecured the site.

meta name="GENERATOR" content="Microsoft FrontPage Express 2.0"

I wonder if this is how Attrition.org created the page, or if the hacker but up the "I won" message with it. That would be awful, wouldn't it, a version of Linux hacked on a Microsoft machine? And posted via FrontPage, arguably the worst HTML program available? Just give me pico :)

The problem that exists is that these people, often under 21, see big giant gaping holes in the security systems and this bothers them. If they report it, nothing happens because no one has, or ever will, listen to them. (Some sites have been defaced repeatedly, without ever having fixed the holes, even after the fix was placed in the HTML!)

So they make a mistake. They try to draw atttention to the fact before someone less kind, (for example a rival organization) uses the same holes to download actual sensitive information. (Warning, this kind of thought process can occurr to you when you've read too much cyberpunk.)

I'm older and wiser now. I realize that people REALLY DON'T care about security. Normally they just want something to rant about. The status quo is to lock your car door for security but if you lock the keys in your car you expect a locksmith to get them out in under a minute.

Think about it. If the locksmith can do it in under a minute, so can I.

They may not be adults, they may be fools, and they may annoy the computer professionals that are responsible for security but let's look at it this way.
If some kids can take down whitehouse.com, why couldn't Zhirinovsky hire someone to do the same, only with a lot more creativity and subtleness. (Wouldn't the media just love it if someone found a collection of porn jpegs on whitehouse.gov?)

They're criminals. They view themselves as unsung heros. In short, they're the Chicago Seven of a new generation. Even Richard Daley's famous quote could still apply:

"Gentlemen, let's get something straight. The police aren't in the streets to create disorder; they are in the streets to preserve disorder." -- Mayor Richard Daley

The problem that exists is that these people, often under 21, see big giant gaping holes in the security systems and this bothers them. If they report it, nothing happens because no one has, or ever will, listen to them. (Some sites have been defaced repeatedly, without ever having fixed the holes, even after the fix was placed in the HTML!)

So they make a mistake. They try to draw atttention to the fact before someone less kind, (for example a rival organization) uses the same holes to download actual sensitive information. (Warning, this kind of thought process can occurr to you when you've read too much cyberpunk.)

I'm older and wiser now. I realize that people REALLY DON'T care about security. Normally they just want something to rant about. The status quo is to lock your car door for security but if you lock the keys in your car you expect a locksmith to get them out in under a minute.

Think about it. If the locksmith can do it in under a minute, so can I.

They may not be adults, they may be fools, and they may annoy the computer professionals that are responsible for security but let's look at it this way.
If some kids can take down whitehouse.com, why couldn't Zhirinovsky hire someone to do the same, only with a lot more creativity and subtleness. (Wouldn't the media just love it if someone found a collection of porn jpegs on whitehouse.gov?)

They're criminals. They view themselves as unsung heros. In short, they're the Chicago Seven of a new generation. Even Richard Daley's famous quote could still apply:

"Gentlemen, let's get something straight. The police aren't in the streets to create disorder; they are in the streets to preserve disorder." -- Mayor Richard Daley

It takes ONE mailing list to find out about these problems in advance most of the time. If their sites are worth so much money to them why can't the invest the 2-45mins each day to check this stuff out!!??

I think that's one of the crackers' points. If you browse through the attrition mirrors you notice a lot of the defacements actually leave a hotmail address telling the admin to email them for what is wrong, or stating the address of where they left the original index.


mcrandello@my-deja.com
rschaar{at}pegasus.cc.ucf.edu if it's important.

Taking down the internet in 30 minutes for DUMMIES. (insert rimshot)

Just take Attrition with a grain of salt. They're a good site, but there is at least one site on their defacement mirror which was NOT hacked, and Attrition has refused to take it down, and has no good evidence to claim that it was hacked.

[99.12.01] NT [ ] TFC News (tfcnews.com)
Hateinc.com is a gaming-team's site, which also owns TFCnews.com.

Just take Attrition with a grain of salt. They're a good site, but there is at least one site on their defacement mirror which was NOT hacked, and Attrition has refused to take it down, and has no good evidence to claim that it was hacked.

[99.12.01] NT [ ] TFC News (tfcnews.com)
Hateinc.com is a gaming-team's site, which also owns TFCnews.com.

Just take Attrition with a grain of salt. They're a good site, but there is at least one site on their defacement mirror which was NOT hacked, and Attrition has refused to take it down, and has no good evidence to claim that it was hacked.

[99.12.01] NT [ ] TFC News (tfcnews.com)
Hateinc.com is a gaming-team's site, which also owns TFCnews.com.

That's not flamebait, it's what the defaced page said. Check out the mirror on attrition .org if you can't || won't believe him (or me). It's at the bottom of the page...

Attrition mirror of the site.

Also, an article on this incident from Australia ZDNet.

Of course, the numbers tell a different story...

Oops. The article was in P55-16 and is available here.

I expect to see a rash of exploits after this.

Here's the problem with the NSA:

What do they do? attrition.org has some interesting ideas, not to mention a few facts. One thing is for certian hey sure spend a lot of money and generate a lot of international bad press.

Who do they protect? Do they protect the people, or the government? If they protect the government and that's it then they are unethical, immoral, and most importantly illegal. This puts the government in a dictatory position over the people. According to the US Constution we are to have a "representative " and "republican" form of government.

Getting back to the money: Echelon, which Australia supposedly says exsists - the EU and China sure hate the NSA - gee that's most of the world. The United States is gaining a lot of enemies because of the NSA - I wonder why... Essentially constutional rights can be usurped if the NSA says it is to "protect national security" or in laymans terms "usurp the governments power over the people". This is utter bullshit.

The US Fed. Government is crap in my opinion. They have alienated the states, and local governments. Tied up the busines owner and tax the hell out of the end person. For instance if my friend Mark was to make 2 thousand dollars more a YEAR he would be pushed into such a high tax bracket that he would _literally_ be paying 43 percent of his income to the IRS alone.

Are we going to let the Government be seperate of the people forever? Career politicians that make deals with commercial lobbists in order to have the funds for their next campaign? Hell everything is so commercialized anymore it's disgusting. The problem here is that the government does not need to make a profit, or spend money on crap programs such as "The study of the flow rate of Catsup" OR the NSA.

But then again, that's my opinion... what's yours?

The sad state of affairs is that there aren't that many good hacks anymore. The people who break into computers nowadays tend to be too stupid to realize what a good hack would be. Creativity and the script kid tend to be an Xor situation.

If you take a look at Attrition.org's mirror of web page defacements you'll notice that both the Senate's Teleconferencing Server( Mirror ) and Michigan Public Sexual Offender Query ( Mirror )were broken into in the past week or so. Imagine the fun that could be had with the two servers. Imagine the damage. But these geniuses (rackmount and ieet respectivly) decided the best use of access to these systems was to replace the homepages.

I hope that there will be hacks worth hearing about, instead of what seems to be the standard defacement. I guess actually programming is too hard for these script kids.

--

The sad state of affairs is that there aren't that many good hacks anymore. The people who break into computers nowadays tend to be too stupid to realize what a good hack would be. Creativity and the script kid tend to be an Xor situation.

If you take a look at Attrition.org's mirror of web page defacements you'll notice that both the Senate's Teleconferencing Server( Mirror ) and Michigan Public Sexual Offender Query ( Mirror )were broken into in the past week or so. Imagine the fun that could be had with the two servers. Imagine the damage. But these geniuses (rackmount and ieet respectivly) decided the best use of access to these systems was to replace the homepages.

I hope that there will be hacks worth hearing about, instead of what seems to be the standard defacement. I guess actually programming is too hard for these script kids.

--