Fyodor Answers Your Network Security Questions

You asked nmap creator Fyodor many excellent questions, and his answers (below) are just as excellent. You'll want to set aside significant time to read and digest this interview, because Fyodor didn't just toss off a few words, but put some real time and energy into his answers.

1) Interesting stories involving nmap?
by Neologic

Nmap has obviously become a huge success in the *nix world. I would wager that practically all sysadmins and security folk use nmap. With this sort of use by such creative and lazy people, there must have been some interesting stories involving nmap, perhaps unusual uses of it, or funny anecdotes. Are there any you would like to share?

Fyodor

The coolest use ever was undoubtedly when Trinity used it to try and save the human race :). But the use I find most gratifying are the Chinese students and residents who have written me about how they use Nmap to locate open proxies. These proxies allow for surfing the uncensored Internet, including the news, educational, pornographic, religious, open source software, government, political, search engine, and human rights sites that are blocked by the Great Firewall of China.

Many of the best features in Nmap came from the user community in ideas if not implementation. For example, the protocol scan (-sO) determines what IP protocols (TCP, UDP, GRE, etc.) a host is listening for. I had not thought of this, but the idea and patch came out of the blue one day in an email from Gerhard Rieger. On another day, a guy named Saurik sent a patch called Nmap+V that allows Nmap to do basic service/version fingerprinting against open ports. It has attracted a cult following, and I plan to add similar functionality to Nmap this year. The initial Windows port by eEye arrived similarly. Despite all these great suggestions, certain other user-contributed ideas are not on the agenda.

Then there are a small handful of users who detect problems nobody else would ever notice, like 4 byte/host memory leaks. They send me error messages with notes saying the bug happens "about once per 700,000 IPs". I have no idea what these guys are up to, but some have been sending me this kind of mail for years. They can't be spammers, as they are intelligent and also use more sophisticated scan techniques than you would need to just find SMTP servers.

2) Recent increases in anal-retentiveness...?
by Zeriel

There's been a marked increase in system administrators thinking that anything even remotely resembling a network scan is eeeeevil (case in point, last year I almost got kicked out of college for scanning port 80 on my dorm subnet looking for interesting websites to read)...

What do you think can be done to make scanning IP addresses/ports have less of a negative stigma? This is in the same sort of category as legit vs. illegit uses of anything else (P2P, whatever)--what's the rationale for punishing something that could maybe lead to criminal activity, and how can we make network scanning tools have practical uses again?

Fyodor

That is an excellent question, and one that concerns me as well. But first, I think your final statement is too extreme. I would guess 90% of network scanning is non-controversial. You will rarely be badgered for scanning your own machine or the networks you administer. The controversy comes when scanning other networks. There are a lot of (good and bad) reasons for doing this sort of network exploration. Perhaps you are scanning the other systems in your {dorm, department, cable LAN, conference LAN} to look for publicly shared files (FTP, SMB, WWW, etc.). Or perhaps your just trying to find the IP of a certain printer. Maybe you scanned your favorite web site to see if they are offering any other services, or because you are curious what OS they run. Perhaps you are just trying to test connectivity, or maybe you wanted to do a quick security sanity-check before handing off your credit card details to that ecommerce company. You might be conducting Internet research, or be bored on a rainy afternoon. Or are you conducting reconnaissance in preparation for a breakin attempt?

The remote administrators rarely know your true intentions, and do sometimes get suspicious. The best approach is to get permission first. I've seen a few people with non-administrative roles land in hot water after deciding to "prove" network insecurity by launching an intrusive scan of the entire company or campus. Admins tend to be more cooperative when asked in advance than when woken up at 3AM by an IDS alarm claiming they are under massive attack.

You compared Nmap to P2P tools in having a "negative stigma". In both cases, one effective way to fight the stigma is to limit your own use to "legitimate" purposes. Use BitTorrent to download RedHat ISOs, but not Matrix Reloaded. Use Nmap to secure and monitor your computers, but not to attack other networks. And if you decide to attack other networks anyway, please be courteous and set the evil bit.

Now I'll admit that I don't always obtain explicit permission before scanning other networks. I don't believe (but IANAL) that a simple port/OS scan of a remote system is or should be illegal. Any machine connected to the Internet will be scanned so often that most admins ignore such "white noise" anyhow. But scan other networks often enough, and someone will eventually complain. So my advice would be:

1. Don't do anything controversial from your work or school connections. Even though your intentions may be good, you have too much to lose if someone in power (boss, dean) decides you are a malicious cracker. Do you really want to explain your actions to someone who may not even understand the terms "port scanner" or "packet"? Spend $10 bucks a month for a dialup or shell account. You didn't really violate this rule, as scanning your dorm subnet for just port 80 should not even be remotely controversial!
2. Target your scan as tightly as possible. If you are only looking for web servers, specify -p80 rather than scanning all 65,535 TCP ports on each machine. If you are only trying to find available hosts, do an Nmap ping scan. Don't scan a /16 when a /24 will suffice. The random scan mode now takes an argument specifying the number of hosts, rather than running forever. So consider -iR 1000 rather than -iR 10000 if the former is sufficient. Use the default timing (or even "-T Polite") rather than "-T Insane".
3. Nmap offers many options for stealthy scans, including source-IP spoofing, decoy scanning, and the more recent Idle Scan technique. But remember there is always a trade-off. You will be harder to detect if you launch scans from an open WAP far from your house, with 17 decoys, while doing followup probes through a chain of 9 open proxies. But if anyone (such as Tsutomu Shimomura) does track you down, they will be mighty suspicious of your intentions.

I occasionally consider adding some sort of "notification packet" prior to a scan that would give hosts the chance to respond and opt-out. This would be like the /robots.txt directives currently used to control polite Web robots. Perhaps the format could even include a text string that IDS systems could log, like: nmap -sS -p- -O -m "Direct questions about this scan to ops at x3512" 192.168.0.0/16 nmap -sS -p- -O -m "mY n4m3 iZ Zer0 |<00L and I'll 0wn j0o%#@" targetcompany.com/24 Of course Nmap would have an option to omit the notification or to send it and ignore any negative responses. Some scanners, such as ISS Internet Scanner already send out NetBIOS popup messages to scanned hosts by default, and other scanners use syslog. I won't be adding any features like this to Nmap unless I see substantial demand and the obvious issues are worked out.

3) OS fingerprinting
by neoThoth

What are the latest advances in fingerprinting networked devices that seem most promising to you? I have started reading papers on HTTP fingerprinting and such and wonder how these will figure into the NMAP architecture. What are the most elusive OS's that aren't on the NMAP OS fingerprint database?

Fyodor

There are a number of OS detection techniques I hope to add this year. One is to guess (or calculate) the initial TTL of response packets, since this varies by OS. Some operating systems also "reflect" your own chosen TTL under various circumstances. Then there are some newer TCP options, such as selective ack that I might test for. Explicit Congestion Notification (RFC 2481/3168) also shows promise. I'll probably add all of these at once later this year, after discussions with the Nmap-dev list. If you wish to participate, you can join that list by sending a blank email to nmap-dev-subscribe@insecure.org. There is also a low volume, moderated list for announcements about Nmap, Insecure.org, and related projects. You can join the 15,000 current members by mailing nmap-hackers-subscribe@insecure.org [archives].

While adding new fingerprinting techniques is fun and exciting, improving the signature database often ads more value. The DB now contains more than 850 signatures, from the Acorn RISC OS and Aironet wireless LAN bridge to the ZoomAir wireless gateway and Zyxel Prestige routers. We're talking gaming consoles, phones, PBX systems, PDAs, webcams, networked power switches, you name it! New fingerprints are submitted daily.

Application level fingerprinting (including HTTP) is coming. I usually regret stating dates, but I hope to develop this functionality within the next 3 months.

4) Stepping into a network security career
by Anonymous Coward

I'll be graduating this month with a shiny new BS in Computer Science. I've done plenty of Unix sysadmin work throughout college and even deployed some high-interaction honeynets. I'm very interested in network security and systems programming. Do you have any advice for people in my situation who want to head into a career in network security?

Fyodor

Congratulations on your graduation! Unfortunately (for newcomers), the security field is one that often expects substantial experience and references. This is partly because these jobs require extraordinary trust, and also because of an aversion to mistakes. Everyone makes mistakes, but they can be extraordinarily costly in security and neophytes tend to make more of them. But don't lose hope! Talented security minds are still in very high demand, just be aware that you will have to work even harder to prove yourself.

Here are my suggestions for anyone starting out in network security, whether for fun or profit:

Step 1: Learn everything you can

1. You may wish to start with reading a general overview of security, such as Practical Unix and Internet Security 3rd Edition.
2. Reading alone won't teach you much. Hands-on experience is critical, so I would set up at least a basic test network. At the very minimum you should have a Unix box or two and a Windows machine (because these are very common in the real world). You can use very cheap machines, or even emulate a large network with virtualization software such as VMWare.
3. Next you should learn more about how attacks are performed. Take a look at the excellent and free Open Source Security Testing Methodology Manual (OSSTMM). This document aims to provide a comprehensive framework for security testing. But it mostly lists tasks to perform, without specifying how to do so. You will gain a lot from this manual if you research the tasks you don't know how to complete, and if you actually try performing the tasks on your test network. If this manual is too curt or hard to follow, you could try a more verbose book on vulnerability assessment, such as Hacking Exposed 4th Edition.
4. Now that you understand many of the general security ideas, it is time to get current. This is one area that has actually become easier in the last decade. The thinking used to be that vulnerability information should only be distributed to well-known and trusted administrators and security researchers through private digests such as Zardoz. This was a disaster for many reasons, and the full disclosure movement was born. In the last couple of years things have started to shift toward more limited ("responsible") disclosure and there is also a disturbing pay-money-for-early-disclosure trend. But information is still much more available than it used to be. Most of the news is carried on mailing lists, and I archive the ones I consider the best at Lists.Insecure.Org. You must subscribe to Bugtraq, and I would also highly recommend pen-test, vuln-dev, and security-basics. Read at least the last 6-12 months of archives. Choose other lists that correspond to your interests. SecurityFocus also offers a security-jobs list which is an excellent resource for finding jobs or just understanding what employers desire.

   There are two major reasons for reading Bugtraq. One is that you must react quickly to new vulnerabilities by patching your servers, notifying your clients, etc. You can get this by simply scanning the subject lines or advisory summaries for bugs that directly apply to you. But then you will miss out on another crucial purpose of Bugtraq. Actually understanding a vulnerability helps you defend against it, exploit it, and identify/prevent similar bugs in the future. When you are lucky, the advisory itself will provide full details on the bug. Check out this excellent recent advisory by Core Security Technologies. Note how they describe exactly how the Snort TCP Stream Reassembly vulnerability works in detail and even include a proof-of-concept demonstration. Unfortunately, not all advisories are so forthcoming. For bugs in Open Source software, you can understand the problem by reading the diff. The next step is to actually write and test an exploit. I would recommend writing at least one for each general class of bug (buffer overflow, format string, SQL injection, etc.) or whenever a bug is particularly interesting.

   Be sure to read the latest issues of Phrack and the research papers posted to the mailing lists. Send your comments and questions to the authors and you may start interesting discussions. Read well-regarded books on the security topics that interest you most.

   I can't emphasize enough that you should intersperse hands-on work with all of this reading. Install unpatched RedHat 8 (or whatever) and run Nmap and Nessus against it. Then compromise it remotely, maybe via the latest Samba hole. Start out with a prewritten exploit from Bugtraq, which isn't quite as easy as it sounds. You may have to modify the 'sploit to compile, brute force the proper offset, etc. Then break in again using a different technique, and your own exploit. Install Ethereal and/or tcpdump and ensure you understand the traffic on your network during both your exploitation and normal network activity. Install Snort on an Internet-facing machine and watch the attacks and probes you'll experience. Wander around your neighborhood with Kismet, Netstumbler, or Wellenreiter on your Laptop or PDA to look for open WAPs. Install DSniff and execute an active MITM attack on an SSH or SSL connection between two of your computers. Take a look at my Top 75 Tools List and ensure you understand what each does and when it would be useful. Try out as many as you can.

5. Take a vacation, or at least a weekend camping! You deserve it! The steps above would probably take at least 3-12 months full-time, depending on your motivation level and the depth and breadth of your research.

Step 2: Now apply your newfound knowledge

Now you have learned enough to be dangerous. At this point, you would have little trouble obtaining most certifications, after studying the specifics of each topic. If your main goal is to find a job quickly, perhaps adding these extra feathers to your cap might be worthwhile. But I think your best bet is to prove your knowledge by joining and contributing to the security community. While this does indeed help others, it isn't an entirely selfless act. It improves your skills, leads to important contacts, and demonstrates your knowledge and ability in a constructive way. The latter is important if securing a career is one of your goals. These steps should also be fun! If not, perhaps you should keep looking at other fields. Here are some ideas:

Start participating with insightful comment and answers on the mailing lists. This is very easy and serves as a great learning experience, way to meet people, and garners some name recognition. If a security manager with a stack of 60 resumes recognizes your name, that is a huge win!

When a new worm or a big new vulnerability comes out, everyone wants to know the details. If you stay up all night disassembling the worm/patch and write the first comprehensive analysis, many folks will find that valuable. And you will learn a lot. Let your first priority be quality - if someone beats you to it, just compare your results with theirs to see if you (or they) missed (or misinterpreted) anything. You can also post your own exploits, although that is more of a political hot potato.

Attending security conferences is a great way to learn, party with fellow hackers, and network (in every sense of the word). Much better is to speak at these conferences. This field changes rapidly so there are always new topics and technologies to discuss. You don't have to be a well-known expert with a long history - just learn your topic well and put in the effort for a quality presentation. You could present at Defcon, at one of the more commercial events, or at a smaller regional con like ToorCon, CodeCon, Hivercon, etc. Among other advantages (often free admission/travel/hotel), this is a great way to meet people with similar interests. I spoke at the latest CanSecWest and have submitted a proposal for the next Defcon.

Now that you've seen and understand a wide variety of software vulnerabilities from your Bugtraq research, start finding your own. You can start by downloading any PHP app from Sourceforge. Most of those are hopelessly vulnerable to Cross-Site-Scripting, SQL injection, and/or remote code execution by "remote include" directives. Many (if not most) Windows shareware daemons are also vulnerable to simple buffer overflows and format-string bugs. Notify the authors and then write an advisory. After a few of these "easy targets", try breaking some more widely deployed programs.

Write a security tool! I could list some suggestions, but by this point you will have many of your own ideas as to what is needed. Scratch an itch.

I hope this helps. If you want more suggestions, Ask Slashdot. From that story, I found this post particularly insightful, especially the emphasis on "people skills". I don't claim to have any, but understand the value :).

5) Have you ever been tempted to use your gifts...
by Tim_F

...in a negative manner?

Have you ever hacked into someone else's computer? Have you ever considered it? What would cause you to think of doing this? Would your tools (nmap, etc.) be enough to allow you to do this?

And if you haven't, why is that the case?

Fyodor

I never do script-kiddie style "hack any random vulnerable box on the Internet" cracking. But sometimes I will launch targeted attacks at specific companies. I'll usually start with just a web browser and various search engines to learn everything I can about my target. I need to understand what the company does, who it partners with, and whether it has any corporate siblings, subsidiaries, or parents. Beyond that, posts by individual employees can be a gold mine. Besides providing names and titles for social engineering and brute force password attacks, the IPs in the mail/news routing headers can be very valuable. One of the reasons I run my own mailing list archive is to maintain access to the raw mail folders which contain the routing info and X-no-archive posts that web archives strip out. Another advantage to locating employees is that you can send them trojan executable attachments, which can be a very effective way into the network.

Next I'll gather known IP network information on the companies via DNS, whois, regional registries like ARIN, routing info, Netcraft, etc. Then comes the scanning (I tend to use Nmap), application-probing, vulnerability discovery, and exploitation stages.

Of course, I only do this when the company is paying me to do so. Performing these pen-tests offers several advantages over blackhat activity:

1. You don't go to jail (If you've worded your contract carefully.)
2. Instead of having to keep your übertechniques secret to avoid prosecution, you get to demonstrate them to management.
3. They actually pay you for this! And you are helping to protect them and the privacy of their customers.

Now some people might ask how you gain these skills without practicing on other networks first. Cheap hardware and the evolution of free UNIX operating systems have made this much easier than in the past. See the previous answer for some suggestions. And remember that you can always work together with friends, or participate in hacking contests like Defcon's Capture the Flag.

6) You'll have seen a lot of breakins.
by Hulver

During your time running Honeypots, you'll have seen a lot of compromised systems. Is there any incident that's really stuck in your mind because of the audacity of the attempt, or the stupidity of the person attempting the breakin.

Fyodor

On the humorous front, one attacker was was running a public webcam during his exploits, so we were able to watch him crack into our boxes in real time :). I will resist the urge to link a screenshot. His rough location was determined when we noticed Mrs. Doubtfire playing on his TV and correlated that with public schedule listings. He was working with a Pakistani group, but was actually on the US East Coast.

In the "disturbing audacity" front, this year we found that a group of crackers had broken into an ecommerce site and actually programmed an automated billing-sytem-to-IRC gateway. They could obtain or validate credit card numbers by simply querying the channel bot! Expect a more detailed writeup soon.

7) What makes a honey net enticing?
by cornice

It seems that many of the honey nets that the average hobbyist would run are built to attract a lesser cracker. What I mean is that ports are left open that normally would not be left open. Services are running that normally should not, etc. I think that a really smart fish would see this as nothing but a cheap lure and refuse the bait. Do you think it's possible to fool the really smart fish? Is is possible to bait with something enticing enough without tipping off the big fish? Does publication of your work make this task more difficult?

Fyodor

Excellent question, and I had many of the same concerns upon joining the project. Then I remembered that most of the attacks and real-world compromises are committed by these marginally skilled script kiddies. So there is still a lot of value in understanding their tools, tactics, and motives. Despite this apparent limitation, I have been surprised by some of the sophisticated things we have found. For example, the first known "in the wild" attack using the Solaris dtspcd vulnerability was caught by one of our honeynets and resulted in this CERT advisory. Then one of our Honeynet Alliance members had their Win2K honeypot compromised and joined into a botnet with 18,000 machines! Attackers on such a grand scale won't even know all of the companies they have compromised, much less whether any of the systems are honeynets.

I do believe baiting the "smart fish" might be possible, but I have never done this. Is not legally entrapment, as we aren't any sort of police force, but I am not very comfortable with the idea. If someone attacks my box that is just unobtrusively sitting on the network, I believe the attacker should have no expectation of privacy for his activities on the system. Things become more complex if I try to lure the attacker.

8) IPv6
by caluml

Do you think that with the very large address space of IPv6 that random scanning for a certain port will die off? (I notice nmap doesn't support random IPv6 address scanning - maybe you've already come to the same conclusion?) Simply put, the chances of finding a machine if it's not advertised anywhere will be very much reduced. Will this make people lazy and complacent, trusting on the large numbers involved to protect them?

Fyodor

Finding a machine by by pinging a completely random 128-bit address will probably never be effective. Fortunately, we won't have to! Nmap does not even do that for 32-bit IPv4 addresses - it is smart enough to skip huge blocks of address space that are unallocated or used for private (RFC1918, localhost) addresses. We will also see patterns emerge for IPv6. For example, they may often be allocated sequentially so that finding one leads to many others. I am waiting until adoption rises and we start seeing these patterns emerge before I can implement them appropriately in Nmap. Certain new DNS features may also prove useful for locating IPv6 machines and networks.

9) standalones and small home nets
by zogger

it seems like most of the emphasis is on enterprise networks, but that still leaves millions and millions of home machines and small home networks just stuck. What do you see as some of the trends and solutions for those people? Their data and system integrity is just as important to them as any corporations is, and usually not having the appropriate skill set, is even harder to implement.

Fyodor

I am afraid the focus by security companies on enterprise networks will continue, as that is where the money is. The good news is that securing small home networks is far easier. But that doesn't make it simple, nor mean that many people will bother. I would categorize the risks into 3 categories:

Traditional network server vulnerabilities: Your average home user doesn't need to run any network daemons or have any TCP/UDP ports open to the Internet. Most of the time they only have 1 IP, used either by a standalone PC or a NAT device (e.g. "broadband router") in front of their small network. This is a good configuration, as it limits what attackers can reach directly. But you need to be sure that the IP doesn't have any unnecessary ports open. You can verify this by running 'netstat' on the Windows or UNIX machine using the IP. I would also recommend confirming using a port scanner such as Nmap. Here are example commands:

nmap -p- -sS -T4 -v -O [your IP]
nmap -p- -sU -v [ your IP ]

The TCP and UDP scans could be combined into one execution, but are listed separately since the TCP scan may go much faster. Remote UDP scans are also less reliable against some heavily filtered hosts. You may have to rely on the netstat info or configuration details in this case.

Any open ports found should be evaluated with extreme prejudice. Unless clearly necessary, close Windows file sharing, external NAT device admin ports, and everything else found.

Don't forget the wireless backdoor! Blocking the Internet link from your private machines is insufficient if anyone can hop on your open WLAN and attack your machines. WEP isn't perfect, but the 104-bit (so-called 128-bit) version should at least keep people from accidentally connecting to your network or sniffing your data. Be sure to set a good password and upgrade to recent firmware for your WAP and other network devices.

Subscribe to the security advisory lists for all the operating systems (and devices, if available) you run. Major vendors such as RedHat, Debian, FreeBSD, Mandrake, and Microsoft all offer these. Most even offer automatic updates if you desire that.

Client vulnerabilities: Once you close the services you don't need (ideally all of them), client vulnerabilities must be addressed. Keeping your web browser and mail reader up-to-date is particularly crucial. Also harden them as much as possible. For example, IE is full of holes but at least has a good interface for site-by-site security policies (Tools -> Internet Options -> Security). Go through and neuter the "Internet zone" settings by disabling ActiveX and Java. In the rare case that sites need this, find an alternative site or add them to the trusted zone. If your are really serious about security, neuter "trusted sites" and "local intranet" privileges as well. Many recent IE vulnerabilities trick the browser into using the wrong zones. Consider using a different browser. Also configure your mailer to disregard HTML and JavaScript.

Remember to pay careful attention to security warnings, whether they come from IE, Mozilla, your ssh client, or anything else. Don't just click OK. And don't shoot yourself in the foot when configuring your apps. It is hard to entirely blame the vendor when users tell P2P apps or Windows filesharing to share their whole drive without any password. Failing to change default passwords or enable basic restrictions on X Window or FTP servers is only slightly more forgivable. All of these errors happen frequently! The apps/devices should be secure by default, but you have the ultimate responsibility for protecting your data.

Malware: This is what I consider the biggest problem on desktops: people running applications they can't trust. Email borne viruses, worms and trojans are an obvious example. Be very careful what you click on. Unfortunately, it is very difficult to know what to trust. Mail is trivial to forge, and even the "proper" installers for many P2P applications infest your computer with loads of invasive spyware. Even Intuit TurboTax was caught writing to customers' boot information track.

What can you do? My honest suggestion is to run peer-reviewed open source applications on a free OS such as Linux or FreeBSD. You still have to be careful, but these problems are far less prevalent on UNIX platforms, which also have better tools and procedures to deal with them.

What if dumping Windows is not an option? Run NT/2K/XP instead of Win9X/ME, and try to run everything you can as an unprivileged (non-administrator) user. Be extraordinarily careful about what you install and run, and make frequent backups. You might also want to look into a personal firewall such as Zone Alarm (limited free version.

10) What is your favourite tool?
by Noryungi

I have just read your top 75 security tools list. Thank you for posting all this information, which I am going to study very carefully.

One question though: in all these tools, which one is your personal favourite? (This excludes Nmap, of course).

Fyodor

I have far too many favorites among this great group to choose just one! But here are a few developers and tools that are particularly worthy of mention:

One of the people I most admire in the security field is Solar Designer. He is a guru in networking, security, and low level kernel/assembly/architecture details. He has also created many tools that security professionals use daily. Yet he never exhibits the arrogance, elitism, and egotism that sadly characterizes so many "stars" of the security community.

Among SD's tools is John the Ripper, my longtime favorite local password hash cracker. It has been around forever, but was written with a flexible and powerful interface while keeping extensibility in mind. So it is still as useful in these days of shadowed password files and MD5/Blowfish hashes as it was back in the days of crypt() and unprotected /etc/passwd. Lately SD has been working on the Owl secure GNU/Linux distribution, which can be installed on disk for hardened systems like firewalls, or booted and run from CD as an easy way to run security tools such as John and Nmap.

Another of those "brilliant yet still nice" security developers is Dug Song. Even after the seminal "Insertion, Evasion, and Denial of Service" paper by Ptacek and Newsham, many IDS vendors continued to ignore the problem. When Doug released Fragrouter (now fragroute), which implements some of these attacks, vendors finally took notice! He has also written the excellent libdnet library, but my favorite of his tools is DSniff, a suite of tools for advanced network sniffing and "monkey-in-the-middle" attacks. It even handles ARP poisoning and other techniques for sniffing hosts on a switched LAN.

While I'm on this topic, let me also give "mad props" to the Hping2 packet prober, Kismet wireless stumbler, Ethereal packet decoder, Netcat, recent THC releases, Snort IDS, the Nessus vulnerability scanner, and all the other great Open Source tools out there!

I would also like to thank Slashdot for granting me this interview and to everyone who asked such excellent questions. I only wish I had time to answer more of them. Then again, I have probably rambled on enough. Now it is your turn to ramble in the comments :).

Cheers,
Fyodor

Comments

how long?

[scubacuda]

about once per 700,000 IPs

Just curious. Anyone know how long that would take?

I've used just about everyone scanning tool out there, but they've always been a relatively few addresses. (And I never really timed them)

Re:how long?

[grub]

That depends a lot on what options you use. For instance using

--max_parallelism <foo>

can really increase your scan speed.

man nmap

is your friend. :)

Re:how long?

[SavingPrivateNawak]

My question would have been more like "So, does this '1 in 700000' bug exist or not? Tell us WHO ARE YOU TRYING TO COVER, Mr Fyodor!!"

Maybe I wouldn't say the last part after all...

Re:how long?

[gazbo]

Another question is how long it would take to realise that one of the questions modded to +5 and authored by a certain Egg Troll, is mysteriously missing.

It is worth mentioning how much interest the question generated, how on-topic it was, and how significant it was.

Oh, but it wasn't sycophantic enough, I guess. Jesus, why bother throwing the interview questions out to the users at all if they're going to be stripped of all but the most anodyne.

Re:how long?

[Anonymous Coward]

under 10 seconds....
http://www.doxpara.com/read.php/code/ paketto.html

Re:how long?

[vladkrupin]

If you don't know where to scan, it would take a while. On the other hand, how often do you just scan things totally at random? If they guy scans 700K IPs, he probably know where they are, or at least has a very good idea where to search.

Re:how long?

[Anonymous Coward]

I would think the NSA might be behind those scans??? CIA?? Echelon??

Re:how long?

[glwtta]

Um, maybe because it has nothing to do with security? The incident itself makes for a great read, but that info is already available, I really don't see why you would want him to waste space (and his time) talking about his morals and ethics - I was under the impression that the interview was about network security and associated tools.

Re:how long?

[gazbo]

What, so they wouldn't, for example, accept a question about whether or not he's been tempted to use his skills in a negative manner? Oh, wait, they did.

Yet strangely in his answer he claims he's never used them in that way, and that he only uses them when paid to do so by the company whose servers he is to attack. In other words, not only was the topic considered vlid, but Fydor lied through his teeth. Immediately you must ask what else he's used his m4d ski11z for.

Re:how long?

[glwtta]

What, so they wouldn't, for example, accept a question about whether or not he's been tempted to use his skills in a negative manner?

So you think that question should've been accepted twice?

Immediately you must ask what else he's used his m4d ski11z for.

Must I? I personally don't care in the least, that's just me of course, but I am sure I am not alone here; just because some people seem obsessed with digging up every single minor transgression a person could'be made (what did he do really? posted a few screenshots to embarras the guy? shocking!), but it's just not all that interesting.

Re:how long?

[Ryan Amos]

Do you honestly think he would reply to such a question? He would more than likely deny the incident ever happened, get pissed off at slashdot readers, and generally get nowhere. Besides, bringing up every mistake this guy has made in the past gets nobody anywhere. I personally am glad slashdot didn't post said question. This is a tech site, not a gossip column. To post such a question would be irresponsible, pointless and plain wrong. Just because it's scandalous doesn't mean anyone cares.

Re:how long?

[Anonymous Coward]

It wasn't a question though. It was a carefully worded accusation. Not to mention the whole mod-bombing scandal associated with the post. The slashdot editors dislike trolls, and they just don't pay attention to them.

Re:how long?

[Anonymous Coward]

See, here's the thing I think that you just don't get:

Breaking into some troll's machine just to fuck with him is a time-honored tradition.

I know I've done it, and I know a lot of others who have as well. Hell I even remember back in the BBS days leaving a directory full of files infected with assorted viruses on a server, and making sure that when a certain troll logged on, those were the files he saw. No one else saw them, just him. Eventually, he went away. I laughed at his stupid troll ass!

You act as though people were under some ethical obligation to not do such things, but that's just your stupid and false assumption. I personally reserve the right to fuck with any troll I please, in any manner I please. You don't wanna get fucked with then that's A-OK. Don't fuck with me and you don't have to worry about it.

The only thing is that you musn't leave any way to prove that it was you. You might or might not want the dumbass troll to know you did it, but under no circumstances do you want him to be able to prove that you did it.

Other than that, I say FEEL FREE TO CRACK THE TROLL'S MACHINE. CRACK ONE TODAY! What are they gonna do about it? Nothing. Jack Shit is what.

Oh wait, they might whine about it on some blog somewhere...if they are even smart enough to figure out that they just got fucked in the ass without even the courtesy of a reacharound.

Re:how long?

[Anonymous Coward]

Totally Irrelevant troll boy. Fyodor ( or any slashdot interviewee) isn't OBLIGATED to answer any specific questions.

Re:how long?

[evilviper]

Ahem, I believe it would have been left out for the utter lack of any evidence that the story is true.

The only references ever posted are links to other slashdot posts that make the same claims... Of course, all of these /. posts are made by KNOWN TROLLS, and many even with "troll" in their username, just to make it clear.

One post said the screenshots were posted to insecure.org. Why don't you hop on over to archive.org and find the archive of these screenshots? That would at least give you a shred of evidence to stand on.

The only thing interesting about this is simply the fact that the comment got modded-up. A big troll conspiracy perhaps...

Besides, if CmdrTaco wanted to be sneaky, he could easilly have silently moderated the post into oblivion with his unlimited mod points. The fact he didn't, shows that he isn't hiding anything.

Re:how long?

[Anonymous Coward]

This is a tech site, not a gossip column.

Where have YOU been past few years?

Re:how long?

[Anonymous Coward]

Don't forget to flip random bits in the stolen files.

Wow

[PaulGrimshaw]

Thats one of the best interviews Ive read on /. and thats with only a passing interest in this area. Cool!

Re:Wow

[Salamanders]

Agreed... I know beans about security, and that was a damn fun read.

Re:Wow

[ramzak2k]

no kidding, but then thats what you get from someone so interested in the subject i guess.

Re:Wow

[Mannerism]

I try to avoid posting "me, too" comments, but: me, too. This is the first /. article that I've actually hardcopied. Thanks to Fyodor for taking the time to prepare such great responses.

Re:Wow

[Brad Cossette]

Ditto to that comment.

I think one of the best parts of this interview was his detailed explanation of how to get experience and "break in" to this industry - I'm tempted to get started (there's a relevant course I may take in the last year of my degree concerning sysadmin & network programming, and this'd be a great primer).

I'm impressed that this guy gave us that much of his time, and his thoughts. That's certainly the longest interview I've read here.

Re:Wow

[Anonymous Coward]

It was a good interview. However I would have liked to know why the nmap source is so frickin schizophrenic. On first inspection it's hard to tell whether it's written in C or C++. On further inspection it appears that at some point it was decided to transition the C code to C++. However, it looks like this was never fully carried out. For exmple there is no use of iterators or other STL components whereas there is an attempt at using export templates.

Re:Wow

[RevDobbs]

Wow, me too! Are we all using AOL?

Re:Wow

[beowulf_26]

Hey guys, I'm not bashing the original poster, or even the "me too" people. Frankly, I agree with your sentiments. It's fine and dandy to give your opinion on an article, in fact it *was* a great interview.

But the fsking moderator who gives modpoints for a "I liked this" post is off their rocker. There's far more quality posts that need to get bumped up for people to read.

Re:Wow

[Demerara]

one of the best interviews Ive read on /.

Absolutely. Full marks - great questions and WONDERFUL answers!

I'm off now to clear my schedule for 12 months so I can implement all his suggestions.

Re:Wow

[Lours]

Well, it's probably going to cost me a negative score but why was this post modded up to +5 ?
Isn't this a obvious abuse of the scoring system used on slashdot ?

It looks awfully so...

Slashdot News Flash: Fyodor is a black-hat

[krog]

There's a good writeup here, but the gist is that Fyodor is not above r00ting the Windows box of someone who fooled him into thinking they were a linux chick.

Don't mess with a black-hat's untapped sex drive, I guess. Still seems weird that we're looking at small-time black-hat scum as Intervew material.

Re:Slashdot News Flash: Fyodor is a black-hat

[Flabby Boohoo]

Interesting... and he flat out denies that he would use his powers for evil.

So who is lying here?

Re:Slashdot News Flash: Fyodor is a black-hat

[realdpk]

What? When did he deny that? Did you miss the answer to question 5?

Re:Slashdot News Flash: Fyodor is a black-hat

[glwtta]

From this point, he launched nmap against Sdem's box (he didn't have the money for a more effective port scanner) and was greeted with the holy grail of sorts for BlackHats

I'm sorry, but a combination of overly grandiloquent (for lack of a better word) language and irrelevant cheap-shots is just the sort of thing that makes me not take a post seriously.

Oh, and what exactly do you need to do to be "Interview material" for slashdot? Over and over I am amazed at these comments that seem to equate slashdot with some sort of relevant news-source - it's a bloody blog for geeks for gods sake. The interview was interesting, far more so than most of the stuff we see here (I am sure Marcelo Tosatti's character is far above that of this "black-hat scum" - anyone remember his fascinating interview?), and quite frankly that's enough for me.

Re:Slashdot News Flash: Fyodor is a black-hat

[death to hanzosan]

Who said hacking a troll's computer is evil? Certainly not Fyodor!

Hack em all, I say!

Re:Slashdot News Flash: Fyodor is a black-hat

[DNS-and-BIND]

I'm still waiting for Captain Crunch's interview responses to the fact that he likes to get raver boys stoned out of their gourds and then fuck them in the ass.

Aaah, who am I kidding. The raverbois enjoyed every minute of it.

Re:Slashdot News Flash: Fyodor is a black-hat

[BigBadBri]

Haha - so he fucked a troll. So what?

How is a widely respected writer of one of the best network scanning tools 'small-time balck-hat scum'?

Sounds to me like Fyodor had a lot of fun getting the asshole back for trolling him, and just made the troll look like a wanker in front of his troll friends.

You're probably just sorry that you couldn't think up such an imaginative response to being trolled.

How the fuck your post is modded up to 5 I'll never figure out.

Re:Slashdot News Flash: Fyodor is a black-hat

[Steven Blanchley]

The victim has commented on this happening elsewhere in the discussion (currently at -1). It's true that sdem was not exactly the smartest of trolls, and trolls can be annoying, but to suggest that as a justification of Fyodor's criminal acts is simply ludicrous.

Re:Slashdot News Flash: Fyodor is a black-hat

[GoatPigSheep]

This is all true.

Fyodor used his network tools to "hack" into stanford university and then went on to spy on sdem for 6 hours.

A truly illegal and immoral activity.

Re:Slashdot News Flash: Fyodor is a black-hat

[TCM]

Did you miss the answer to question 5?

Did you miss it?

Of course, I only do this when the company is paying me to do so.

Just correcting facts.

Re:Slashdot News Flash: Fyodor is a black-hat

[TCM]

s/facts//

"correcting facts", wonder where I was there.

Re:Slashdot News Flash: Fyodor is a black-hat

[realdpk]

I am lame. Mod me down.

Re:Slashdot News Flash: Fyodor is a black-hat

[Anonymous Coward]

There's a good writeup here, but the gist is that Fyodor is not above r00ting the Windows box of someone who fooled him into thinking they were a linux chick.

But did he set the evil bit?

Re:Slashdot News Flash: Fyodor is a black-hat

[Anonymous Coward]

Dear Lameass,

I'm an atheist, but a few religious sentences have got stuck in my brain, like "Let he who is without sin throw the first rock".

Re:Slashdot News Flash: Fyodor is a black-hat

[Roto-Rooter Man]

Both accusations were very on topic I thought. Captain Crunch's interview was based on his reputation, and that's what he uses to lure teenagers. Fyodor's interview was about security, and illegally violating the security of another's computer is exactly what he is accused of.

Hopefully Slashdot readers saw enough evidence in both cases to realize that these aren't mere trolls. It's true that many trolls get involved in pushing these stories (after all, it's a guaranteed response), but that doesn't mean that there isn't some truth to what is being said.

no answers

[Anonymous Coward]

about the documented hacking of a fellow slashdotter's computer? What a shock. How long till the site nazi's delete this post like they have the others.

The Real answer to question 7

[stanmann]

The smart fish have either gone straight, or choose their targets so carefully that even if/when caught, the target is too humiliated or vulnerable to the information acquired that no charges can be filed.

Legit Uses of BitTorrent

[scubacuda]

You compared Nmap to P2P tools in having a "negative stigma". In both cases, one effective way to fight the stigma is to limit your own use to "legitimate" purposes. Use BitTorrent to download RedHat ISOs, but not Matrix Reloaded. Use Nmap to secure and monitor your computers, but not to attack other networks. And if you decide to attack other networks anyway, please be courteous and set the evil bit.

Yeah...I'm sure that all the people who submitted pics of Trinity's use of nmap did so without using BitTorrent to pirate Matrix Reloaded.

Re:Legit Uses of BitTorrent

[mattyohe]

funny but.. *bitting*

Those screens were actually someone in the theatre taking a picture of the screen...

Notice the keystone effect in the original image?

Re:Legit Uses of BitTorrent

[Microsofts slave]

Nmap is probably a god send to low budgeted network admins, who have little idea about why they are contiuously being hacked. Instead of having to go to their superior to funding to buy an expensive commercial product, they can easily download and install a free and well written alternative.

Re:Legit Uses of BitTorrent

[Planesdragon]

Funny, a small sample for news-reporting purposes is part of the original fair use provision...

Re:Legit Uses of BitTorrent

[Apotsy]

The "real-proper" SVCD version of Matrix Reloaded that everyone was BTing at that time also has keystoning. Just look at the opening titles: the matrix code is falling in diagonal lines, when they should be exactly vertical.

Re:Legit Uses of BitTorrent

[srvivn21]

If the images were taken by someone watching the movie at their leisure, they would have realized that TRINITY DID NOT CRACK THE COMPUTER!

She arrived after the first crew had died (due to mitigating circumstances in the "real" world) and sat down at a computer that was already logged in.

Watch it again, and you'll see that I'm right. Give credit where it's due. The first crew cracked the box. Trinity just ran the shutdown command.

Re:Legit Uses of BitTorrent

[Anonymous Coward]

The VCD I've seen of Reloaded also had some trapezoidal geometric distortion.

Whatever the case, it is apparent that all of these pictures (whether or not they are moving pictures) were taken, at some point, with a camera.

NEVA does any 'black hat' activity?!?!?

[Bold Marauder]

I think that anyone who is interested in the truth of these claims should look here for a summary of fyodor's attacks against an underaged slashdot user who played a pratical joke on.

For further reading, here is an archive of trolltalk, where fyodor brags about what he's done.

Re:NEVA does any 'black hat' activity?!?!?

[Anonymous Coward]

"..who played a practical joke on him."
Sorry!

Re:NEVA does any 'black hat' activity?!?!?

[Anonymous Coward]

this is the correct link to sllort's expose.

Re:NEVA does any 'black hat' activity?!?!?

[Bold Marauder]

this is the correct link to sllort's expose

I stand humbled and corrected. Thanks!

never mind the mod abuse -- read parent link

[Anonymous Coward]

I guess it's clear that certain editors and usermods don't want this issue creeping into the discussion, but it's important. Would Consumer Reports let a car thief review cars?

Re:never mind the mod abuse -- read parent link

[Anonymous Coward]

Would Consumer Reports let a car thief review cars?

Following that logic...

Re:never mind the mod abuse -- read parent link

[Grax]

A thief would be the ideal reviewer of how easy a car is to steal. If they wanted to publish an article on how secure your car is then a talented thief would make a good consultant.

I wouldn't want the thief checking my own car's security though. I don't trust him.

MOD PARENT UP

[Anonymous Coward]

Legitimate conversation piece.

Please mod this up

[Anonymous Coward]

It's clear that this will probably be another one of those "touchy" issues that the editors want to keep under wraps, but I think it puts this guy and his activities into perspective. Toss a couple of mod points krog's way; hopefully a few readers will see this before it's modded down to oblivion.

My Question

[rwiedower]

One of the people I most admire in the security field is Solar Designer. He is a guru in networking, security, and low level kernel/assembly/architecture details. He has also created many tools that security professionals use daily. Yet he never exhibits the arrogance, elitism, and egotism that sadly characterizes so many "stars" of the security community.

Who exactly are the "stars" of the security community? Clearly, I'm not geeky enough to know...but I'd be interested if someone actually does know the "top 10 cool security stars".

Re:My Question

[SuperDuG]

The Top 10 Security Stars ...

10. Kevin (you know ... Free Kevin)
9. Trinity & Crash Override(fictional, but hot)
8. Attrition Group
7. L0pth/@Stake (I think they're corperate now)
6. cDc (Cult of the Dead Cow)
5. eEye (should see some of the things they do)
4. Publishers of Bug Traq
3. OpenBSD
2. The guy no one knows because he's that good
1. Go to DefCon and find out for yourself.

I know some of these are a bit "old skool" but when I think security, this is what I think.

Re:My Question

[Kong the Medium]

I can tell you, but then I have to kill you on reasons of National Security A-Somethings ...

Damn, already said to much.

Re:My Question

[pbemfun]

Ummm...crash override was the guy. Acid Burn was Angelina Jolie.

Re:My Question

[platypus]

Maybe I'd add
rainforest puppy and
goobles (they are fruckin funny).

Re:My Question

[Anonymous Coward]

rainforest puppy yes, but gobbles hasn't quite proven top ten worthiness (yet) imo

Re:My Question

[glwtta]

Since they were talking about "start" I suppose Theo de Raadt should be on the list instead of OpenBSD... Come to think of it, he is a "security guy" I've heard a lot about even though I don't have much dealings in the particular field.

Re:My Question

[graf0z]

Fyodor: Yet he never exhibits the arrogance, elitism, and egotism that sadly characterizes so many "stars" of the security community

rwiedower: Who exactly are the "stars" of the security community?

Some of them (in random order) are (most of them have achieved _much_ more than the supplied example):

• Solar Designer (eg. OpenWall)
• Dug Song (eg. dsniff)
• Bruce Schneier (eg. couterpane), Niels Ferguson (eg. twofish)
• Rivest, Shamir, Aldeman (RSA), Diffie, Rabin and all the other grandfathers of crypto
• Niels Provos (eg openssh)
• Theo DeRaadt & the OpenBSD-team
• Wietse Venema (eg postfix, satan)
• Daniel J. Bernstein ("DJB") (eg qmail, djbdns)
• Ian Goldberg, Ross Anderson (eg. GSM-hack)
• bugtraq & the masters of full disclosure (eg. aleph1)
• Cypherpunks, cDc, team-teso, l0hpt, CCC, packetstorm, contributers of phrack-mag...
• Neal Stevenson ;-)

... and all those i've forgotten. Some of these guru's are quite unpleasent in discussions. Google for postings of Theo or DJB for examples.

Re:My Question

[irc.goatse.cx troll]

" rainforest puppy yes, but gobbles hasn't quite proven top ten worthiness (yet) imo"

Everyones entitled to their own oppinion, But I think gobbles' ability to stand up to the egotistical OpenBSD/SSH developers 'our shit dosnt stink' attitude earns him a good spot on the list.

And he knows how to speak, which is a plus. Search around for the video of him at defcon, it's really funny.

Re:My Question

[evilviper]

A good security guy he is, but I don't think he would be on the top-10 alone. Much of the security in OpenBSD is due to other primary members of the OpenBSD team. PF, Systrace, etc. Neither were written by him, but by other members of the OpenBSD team. Each has a few pieces of his code, but not a lot.

To a lesser extent, the same is true of OpenSSH. Hey does code some of it, but the large majority is done by others.

Re:My Question

[evilviper]

goobles (they are fruckin funny).

True, but that would put them (probably as #1) on the top 10 computer security 'jesters', not this list.

Re:My Question

[Anonymous Coward]

Dug Song (eg. dsniff)

little known fact: dug song and slashdot editor timothy went to the same high school, graduated the same year also.

Re:My Question

[unvrno]

Dude, something must be jacked up in your PRSSCG's entropy pool cause Carolyn Meinel should always come up before Bruce Schneier! Anyone got the MD5SUM for the UnixWare binary?

Re:My Question

[Anonymous Coward]

L0pth/@Stake are fakes and rats for the feds. Sure they made pocsag decoders, but they acted as informants in the past...

Re:My Question

[platypus]

Yeah, I should have written "btw. they are fuckin funny". Oh, and that I mistyped the name doesn't add to the sense of my post.

how to stay out of trouble

[mblase]

The remote administrators rarely know your true intentions, and do sometimes get suspicious. The best approach is to get permission first.

This is so obvious, I can't believe it needed to be said. And yet it does, because Geeks Like Us usually assume that other people Just Wouldn't Understand. The difference between extortion and contracting for services is that one does the job before asking for money, the other asks for money and then does the job. And this isn't very different.

There are a zillion dangerous uses of a detectable port scan, and a zillion legitimate ones. The best way to make sure your legitimate uses are understood is to tell people what you're doing before you do it. Incidentally, this also goes for copying someone else's original works, buying dangerous substances at the hardware store, and the like. Yet I'm surprised at how few people bother (er, myself included).

It's just courtesy, really. Keep it in mind.

Re:how to stay out of trouble

[Telastyn]

Ahem. So assume a nice guy is going to port scan you; he calls up: "hey, I'm going to portscan your network, I'm so and so from such and such."

What would a bad guy do?
"hey, I'm going to portscan your network, I'm so and so from such and such" [lie]

The sys admin on the other end of the phone isn't going to know the difference, or behave any differently.

Re:how to stay out of trouble

[realdpk]

I find it far easier to just accept that hey, I'm on the Internet, and someone from China can scan my ports. Even if they did warn me, I do not speak Chinese of any form.

I can take steps to protect my servers (like, say, not putting them on the Internet, except for a few secured front-ends), so it's not a big deal.

Re:how to stay out of trouble

[br0ck]

The nice guy isn't going to just call. They're going to meet with management, sign contracts and agreements, define the scope of their investigations and then keep management in the loop. I would hope that most admins would not just blindly ignore an attack just because some random person called saying they were going to do some scanning.

Re:how to stay out of trouble

[Strange Ranger]

Get permission before I do something suspicious?

I disagree. I should only have to get permission before doing something that would otherwise be illicit. Suspicious is a far cry from illicit. If I'm sneaking through the forest on public ground with a gun do I need to carry a banner that says "I'm here to shoot deer, not people"? That would be ridiculous. Unless you actually break in somewhere the internet is a public place. Port scanning is a walk through the neighborhood. If I'm driving a candy apple red ferrari (suspicious) do I need get permission to take it on the road first and promise that I won't speed? Innocent until proven guilty is more than just a legal convention. It's common courtesy, and it's convenient. Getting permission to do every single benign yet possibly suspicious activity is inconvenient to the point of being debilitating.

Not to mention that whole attitude scares me to no end. I already have to "Get Permission" and prove I'm not a terrorist every damn morning before I'm allowed to go up the elevator to do the job they pay me for. What next? Checkpoints at major intersections to prove we're not carrying bombs? Next thing you know they'll be violating people's rights, holding suspicious people in prison without trial without pressing charges. Oh wait, they're already doing that.

This whole call-the-cops first and ask questions later scheme is getting frightening. I feel like I need a T-shirt that says "I'm not doing anything whatsoever that is illegal. I specifically plan to do nothing whatsoever that is even remotely illegal. If you deem my actions suspicous for any reason, you just don't have all the facts. Relax".

Or maybe it's more practical if we all just spend an hour every morning getting permission for every single thing we're going to do that day?

Hogwash. Just because someone stops to check out your fancy place, window shop, or see if your roof needs work (maybe leave you a flyer) doesn't mean they're casing the joint. When your security system involves hunting down (and usually trying to prosecute) those who merely seem suspicious, then you are the intrusive one who has stepped over the line. This is true whether you're a sysadmin or Uncle Sam.

Re:how to stay out of trouble

[Zork the Almighty]

I couldn't agree more, especially with the last paragraph.

Re:how to stay out of trouble

[salmo]

The remote administrators rarely know your true intentions, and do sometimes get suspicious. The best approach is to get permission first.

Honestly, I'd say the safest thing to do is not perform the scan at all. Yes you "should be able to" and no you're "not doing anything wrong", but such is life. If it's not your machine don't scan it. And sometimes, even if it is your machine and its not your network don't scan it across the network, get off your ass and go to the other building/room/whatever. This comes from one of those "character building" experiences I had in college.

Here's the long precursor story. There was a kid in the school who thought it was real funny sending around a trojanned "Whack-a-mole" game to hapless (and clueless) students looking for the next great little game to use for procrastination purposes. He shared the file on the network and soon tons of kids had netbus or backorrifice or whatever the point-and-click trojan du jour was for winders.

I found out that he was using it against (mostly female) students because I kept getting phone calls from friends and the students I supported (I worked for the college I attended doing support in the dorms). I was having to clean these up one by one when people noticed odd error messages, type being inserted, etc. One day after I had become very tired of having to clean up after the little fsck, I got a call from a girl who was currently being messed with. Before she hung up, he shut down her machine remotely. So I threw netcat on a floppy, brought her machine up off the network, removed the trojan, set netcat to listen on the port, brought the machine on to the net, and bang, caught the little punk. Sidenote: also with a quick nmap scan found he had installed the trojan on himself passwordless, so I took the liberty to replace the client he was using with a little .exe that popped up a message that said "quit screwing with other people's machines" in not so few words. Then had the trojan remove itself from his box.

Anywho, after he was caught, I was still carrying the burden of having to look at machines every time I had to turn on someone's printer or find a lost word file. I thought, wouldn't it be a lot easier to just scan the school's subnet for the trojan and find the machines that were listening on whatever port the thing ran on and then either visit them or email them with directions. My boss in the IT department also thought this was a good idea. I asked permission and got it. But then the next morning I got an angry call from the IT department. They threatened to kick me off campus because they said I didn't ask the right IT person (I think my boss should have been in trouble for telling me it was ok, then). But luckily I also told one of the network guys who they put on the "right IT people list" and had an email from him (which he denied sending me) still hanging around. Remeber when it comes to security related activities or hell, business in general, document everything!

So yeah. Now, rather than taking a "save the world", "help hapless users" approach I've grown jaded and take more of the apathetic approach. This was also the moment in time I stopped doing unpaid overtime out of the kindness of my heart ;-).

Maybe you shouldn't have said that...

[ryanvm]

They send me error messages with notes saying the bug happens "about once per 700,000 IPs". I have no idea what these guys are up to, but some have been sending me this kind of mail for years.

Hmmm - I can't help but think that maybe you shouldn't have mentioned that. Statements like that are exactly the kind of thing that people wanting to make security tools illegal are going to look for.

Re:Maybe you shouldn't have said that...

[jjeffries]

I disagree; maybe these reports are coming from MIT or Xerox or Apple... it must take a long time to scan an entire class A network.

Re:Maybe you shouldn't have said that...

[univgeek]

It doesn't mean that the person scanned 700K IP's. It might mean that it is a possibility based on the code, or a possible code flow causes a memory leak.

Re:Maybe you shouldn't have said that...

[Politburo]

Great "insightful" comment, but your wild speculation has no actual argument behind it. Why exactly is him saying that someone reported a bug every 700,000 IPs going to change anything? Do you seriously think that the people who want to make port-scanning illegal didn't already know you could scan massively large blocks of IPs? What makes the statement so dangerous that he "shouldn't have mentioned" it?

Yep, good thing Fyodor's not a wanker.

[Anonymous Coward]

And how!

Re:Check out this picture!

[bigjnsa500]

I find it funny that most of hax0r pics like "evil inside" "evil gates" are hosted on MSN and your screenshots are [gulp] windows. Uh, are you really a moron?

Welcome to the thread of doom, part two!!!

[Bold Marauder]

the parent asked:

There's a good writeup here, but the gist is that Fyodor is not above r00ting the Windows box of someone who fooled him into thinking they were a linux chick.

Don't mess with a black-hat's untapped sex drive, I guess. Still seems weird that we're looking at small-time black-hat scum as Intervew material.

But now, at this point, it sits at zero--despite being a relevent comment which raises disturbing issues surrounding fyodor's legitimacy.

I would like to ask all those with mod points and a sense of fair play to mod the parent up. Thank you! [ps, if you dont' have mod points, but can use a karma bonus--quoting the parent as I have done would work too. Thanks!]

Re:Welcome to the thread of doom, part two!!!

[Xzzy]

> disturbing issues surrounding fyodor's legitimacy.

Legitimacy? What are you talking about. His interview didn't claim at all that he was a "good guy", in fact he admitted quite bluntly that he's broken into people's machines in the past, and even detailed some of the methods he used.

No one here is "exposing" anything, because it was already out in the open.

No one who read that interview would have finished it thinking fyodor is completely blameless and one of the "good guys".

Re:Welcome to the thread of doom, part two!!!

[Anonymous Coward]

You mean this?

Now I'll admit that I don't always obtain explicit permission before scanning other networks. I don't believe (but IANAL) that a simple port/OS scan of a remote system is or should be illegal

Admitting he's scanned networks is a far cry from admitting he's just another script kiddy r00t exploit dipshit.

Fuck him. He's still a wanker and he knows it.

Re:Welcome to the thread of doom, part two!!!

[Anonymous Coward]

no, Fyodor stated that 1) he doesn't do script-kiddie style attacks and 2) he only roots boxes when he's being paid to do a security audit.

I had never heard of the SDem issue before today, but, if it's true, it means Fyodor was cracking/hacking boxes of people he doesn't like (which is quite malicious).

Re:Welcome to the thread of doom, part two!!!

[Anonymous Coward]

Actually, it should be modded down to the total shit it is.

A troll got owned. Big fucking deal. Stop the presses.

A security expert is a lonely guy, well shit, there's news.

Fuck all of you dumb asses that keep heralding this non-story as if it proves anything other than Fydor is quite knowledgable about what it is he does.

Black-hat. How about pissed off, egotistical white hat? Seems more appropriate to me.

Was he wrong to do what he did? Hell no. A black hat would have taken a much different approach, that could have landed Ole' Trolly in some hot water.

Of course, all you trolls are the essence of hypocrisy and irony. Crying out like the little bitches that you are. Keep crying, girls. Waa.

Re:Welcome to the thread of doom, part two!!!

[Eazy-N]

A troll got owned. Big fucking deal. Stop the presses.

A pirate got busted. Big deal. Stop the presses.

Same argument innit...,/P>

Fyodor: Thoughts on a Small-Time Criminal

[SumDeusExMachina]

Or "World's biggest biter bites back."

Some people would leave it at "YHBT" and walk away. This is S.O.P. on Slashdot. So when I posed as a hot LinuxWorld booth babe in a Slashdot poll (if you'll read that comment, you'll see that it wasn't even remotely credible-sounding) and left an email address, I got quite a few messages from lonely Lunix geeks hoping to hook up. Wanting pictures, naked pictures, etc., the kind of tactless crap you'd expect from someone who's still alone in their mid-30s.

And so I recieve the email from Fyodor, out looking for love. I emailed him back, letting him know he'd been trolled. "Don't feel bad, it happens to the best of us." So he emails me back telling me, among other things, that he regularly trolls mailing lists for women and that chances are, sooner or later, he'll find a willing warm body. So, like, the odds are in his favor. So he tells me. Anyway, he sounded none too happy.

So I mentioned him as one of the respondents on Trolltalk, with something like "look at the bunch of wankers I got who actually believed me enough to email me!". Apparently, this is enough to justify hacking my computer and invading my privacy for 9 hours, according to him. This happens a week or two down the road from the original posting in Trolltalk. So I load Trolltalk one day to find out he's made an entire webpage filled with screenshots from my computer and lots of personally identifying information (my full name, home address, everything) while telling me that I'd better change all my passwords quick, because he stole those too.

All this for getting suckered in by an obvious troll and getting called a wanker as a result. Earth to Fyodor: grow the fuck up. Sheesh, what a sociopathic crybaby.

For reference, you can see an archive of Trolltalk from the period here. Scroll down a little to find Fyodor's posts and the subsequent responses.

Re:Fyodor: Thoughts on a Small-Time Criminal

[Graspee_Leemoor]

Now I am fucked off. Nothing is worse than waking up one day and finding out that your favourite unix tool is written by an immature wanker with no more right to live on God's clean Earth than a weasel.

graspee

Re:Fyodor: Thoughts on a Small-Time Criminal

[Anonymous Coward]

i caught the Blackadder line sir. unless that line came from elsewhere and got picked up in blackadder.

-t

Re:Fyodor: Thoughts on a Small-Time Criminal

[krumms]

Hehe I almost find that funny :)

News flash: Fyodor is a hacker!

(in the politically-incorrect sense for those of you who just can't let go ;))

Re:Fyodor: Thoughts on a Small-Time Criminal

[schaotix]

Soooo...pretending to be a woman online to lure people in is what, mature?

Re:Fyodor: Thoughts on a Small-Time Criminal

[Anonymous Coward]

I respect someone more who pretends to be a woman to lure people than I do the person who was lured, and the person who was lured and then responded aggressively is just waaay down at the bottom of the list.

Re:Fyodor: Thoughts on a Small-Time Criminal

[Anonymous Coward]

Earth to Fyodor: grow the fuck up.

Earth to SDEM: grow the fuck up

Seriously. What kind of loser do you have to be to troll for dates posing as a woman and then post the responses you get on the internet? And then you are shocked that the author of one of those responses got pissed and got back at you?

Two wrongs don't make a right. None the less, stop trying to take the moral high ground - you have none to stand on. Fydor's response might have been juvenile, but so was your whole scheme in the first place. Get a life.

Re:Fyodor: Thoughts on a Small-Time Criminal

[rainer_d]

All this for getting suckered in by an obvious troll and getting called a wanker as a result. Earth to Fyodor: grow the fuck up. Sheesh, what a sociopathic crybaby.

I've not seen the pictures he's taken of your desktop but I don't think you've got much to complain (at least morally, and the legal side has allready been covered: not punishable)

You had no right to reveal the private mail(s) he sent to you in the assumption that you are a girl. Doing so (even more so with a highly skilled security-professional...) just asked for trouble.
And trouble you got. And now, you're envious that he got a front-page story and a big interview (a very good interview with good questions and good answers).
All that babbling about "professionalism" and the security of the tools because he might have "crossed the line" is just bullshit with which you want to conceal your envy.

If you were really concerned about such things, you wouldn't waste time here as a FTT (full time troll).

Rainer

Re:Fyodor: Thoughts on a Small-Time Criminal

[SumDeusExMachina]

You had no right to reveal the private mail(s) he sent to you in the assumption that you are a girl.

You're talking about something I just didn't do. All I did was mention in a post that he was one of the people who had contacted me. See for yourself.

Re:Fyodor: Thoughts on a Small-Time Criminal

[Anonymous Coward]

Hahaha. No.

We really don't care. It's just another soap opera to us. Unimportant. Throwaway entertainment.

As long as Nmap is useful we'll use it. It really doesn't matter at all what transpired between some troll and some hacker.

No one really gives a shit except the two of them anyway. The rest of us could not care less.

Re:Fyodor: Thoughts on a Small-Time Criminal

[Anonymous Coward]

go back to your gay porn, faggot.

you got what you deserve.

Top 75 Tools Misses the Best Scanner

[Anonymous Coward]

QualysGuard has a bigger database than any of the competitors - More vulnerabilities than in Nessus and ISS combined - yet it doesn't make the top 75 list because it's more a service or appliance. It always seems to miss these lists since you can't buy it as a standalone software package.

Just in case there's a corporate CSO out there reading Slashdot.

I always thought...

[unixbugs]

...that if nmap had the functionality of, say, ethereal, built in, we'd all have a really good tool to audit every machine from here to Mars. True though how *nix has all of these tools for dealing with I/O between processes, it would still be nice to have the single ULTIMATE security auditing/IDS/educational user interface that could do some learning of its own and ask for input on-the-fly from the user as to enhance its ability to guess OS's and count boxen behind NAT, among other things. Or maybe I'll just add this post to my thinkgeek wishlist.

Re:I always thought...

[MasterOfMagic]

if nmap had the functionality of, say, ethereal, built in, we'd all have a really good tool to audit every machine from here to Mars.

You have the code, make it happen! :-) Or, start a SourceForge project to make it happen. I'd love to have something like that, and I know C, so count me in.

Re:I always thought...

[Anonymous Coward]

In general, integrating orthogonal functionality is pointless. A lot of people would like a "do everything I want" tool, but what people want varies, and the more assumptions the tool makes, the less flexible it is.

Nevertheless, combining ethereal-like functionality with nmap could perhaps be useful, since it would allow you to manually inspect details that nmap might not yet analyze automatically.

Best interview?

[gazbo]

Best pile of fucking lies:

'I never do script-kiddie style "hack any random vulnerable box on the Internet" cracking. But sometimes I will launch targeted attacks at specific companies'...'Of course, I only do this when the company is paying me to do so'

Oh really. So you didn't for example break into a certain SDEM's box because he'd exposed you to be a pathetic desperate loser?

not trinity

[akb]

Sorry to focus on this but after rewatching the nmap scene a few times after ... um obtaining Reloaded, it doesn't look to me like Trinity herself uses nmap. It looks to me like the woman before her (the one that was working on the computer, whose ship got blown up, and said "almost there") was the one that actually rooted the machine. It looked like Trinity just sat down, looked at the screen and typed in the password that the 'sploit had set.

Re:not trinity

[Malc]

Yah, that's what I thought. Only people who haven't used those tools will think she had enough time. She was just finishing the job off.

Re:not trinity

[rjamestaylor]

I saw the movie in the Theatre. That scene went by so fast -- and I already knew it was coming -- I couldn't believe anyone had noticed the details. Then I remembered Bittorrent and realized that the *only* people who could have noticed the detail would be those who could freeze-frame the movie.

Re:not trinity

[srvivn21]

Thank you. I noticed that myself on my second viewing. To me it looked like the computer was already logged in, and all that Trinity did was type in the shutdown command. Then again, I haven't "obtained" Reloaded, and have only my memory to go on. :o)

Re:not trinity

[meringuoid]

I only saw it once...

1) nmap - locate machine
2) sshnuke - exploit buggy ssh daemon
3) login and shutdown - save Neo's arse

I think the nmapping had already been done, but Trinity used the sshnuke program and then shut down the machine.

You'd think the Agents would have patched their server, really...

Re:not trinity

[Anonymous Coward]

What makes you think Agents run the power company?

Re:not trinity

[ptr2void]

(the one that was working on the computer, whose ship got blown up, and said "almost there")

I think you're referring to Niobe (Lock's girlfriend), but I'm not 100% positive (seen Reloaded only once). This must be the most popular urban legend about Matrix 2. Niobe's ship didn't get blown up. It was Morpheus' ship, the "Nebuchadnezzar". I agree with you on the rest of your post, though. Trinity had way too few time.

Re:not trinity

[akb]

Not Niobe. She was going to blowup the main power station and did so successfully. We have no reason to believe anything bad happened to her (indeed, she's in the next movie).

The woman I was referring to was working to shutdown the backup power system. While she and the rest of the crew are doing that, their ship gets blown up and they die, the woman slumps over the laptop she's working on to crack into the power system. This is the computer that Trinity sits down at.

Re:not trinity

[ptr2void]

Hmm you're probably right. I just don't remember a second ship blown up (besides the Neb)

GET OVER IT, FOR FUCK'S SAKE

[Anonymous Coward]

I, for one, applaud him. You got 0wned? You deserved it.

Holy ignoramus Batman!

[gosand]

What you call "students and residents finding open proxies to surf the web"(inspiring warm and fuzzy feelings), I call network abuse and inappropriate use of resources. It's like spam- you're hitting hundreds of thousands of systems in the hopes of hitting one proxy. ... Sorry, this is not the "coolest" use of nmap- it's probably, aside from scanning for vulnerable services, the most unethical use of nmap I can think of.

Holy crap. You are either a really bad troll, or you have never heard of China.

Pfft.

[Jetifi]

You're getting your panties in a twist about some asshat kid who was stupid enough to ''troll'' someone who knew how to get his own back.

To be honest, I don't care. Some trolls can be really, really funny (the Adequacy crowd comes to mind), but I really don't give a fig what happens to juvenile, antisocial idiots who use the anonymity of the ''net to piss in the communal pool.

stars

[Anonymous Coward]

Some famous or infamous people....Won't even bother trying to say who are black, white, or grey, or who is skilled or not

evil pete (the war driving guy)
fyodor
solar designer
Dug Song
Theo De Raat
mudge
hobbit
Weld Pond
Space Rouge
Kevin Mitnick
Kevin Poulsen
Deth Veggie
Dildog
Dan Farmer
Route
Nirva
Kewp - blackhat who founded a Internet Security Service and claims not to hire blackhats
Marty Roesch
Dragos Ruiu
Caesar
mnemonix
Knight Lightning
etc.....
Read some Phrack, look at some defcon pictures. You'll get the idea.

most of these people are going by their real names now, but that doesn't diminish their skills in any way

Why doesn't Fyodor answer?

[salon.com]

This question keeps being asked, and with all the cached content on the web that points to this being legitmate, why doesn't Fyodor just post a simple comment about it and either deny it or come clean? What about someone at Slashdot who may have witnessed it?

I'm really curious to know!

Re:Why doesn't Fyodor answer?

[Grax]

Someone modded up a message that links to a site called trollaxor.com? Come on! Squash the trolls. Mod them down.

Re:Why doesn't Fyodor answer?

[wheany]

Yeah! The truth needs to be suppressed!

Re:Why doesn't Fyodor answer?

[Grax]

Yes. and obviously we can trust a site called trollaxor to give us the truth.

Trolls have zero credibility with me (their own fault. the whole crying wolf idea).

What's next? A neat story about how George Bush is taking nude ballet class? with links to trollaxor showing how the story made it to cnn.com and everything before "they" suppressed it?

Re:Why doesn't Fyodor answer?

[wheany]

Well, if trollaxor.com had a cache of the CNN front page, and many people confirm seeing the story on CNN and George Bush admits to taking nude ballet classes, why not.

Thoughtful Responses?!

[jasondlee]

Fyoder didn't just toss off a few words, but put some real time and energy into his answers.

Obviously, Fyoder hasn't read the Captain Kirk book on /. interviews...

jason

Ha.

[Freston Youseff]

What does that say about somebody who will track down a kid and "own" his computer because he was pathetic enough to seek dates on Slashdot of all places, instead of oh...say...real life? Sounds like a complete twat and quite antisocial if you ask me.

Re:Ha.

[Anonymous Coward]

Look out Freston... Fyodora has you next on his list!

I remember when that happened!

[John Penix]

That was so funny, when Fyodor hacked that guy. I still have the screenshots he posted to insecure.org!

Stupid troll! Fyodor, keep up the good work, maybe if you hack all the trolls and wipe their hard drives, Slashdot won't have so many goat-gross out links and stuff!

Re:I remember when that happened!

[ConsumedByTV]

Could you post one?
I would Love to see it, it would make my day.

Re:I remember when that happened!

[John Penix]

I think that for reasons that should be obvious, I can't put something like that on my employer's hosting... cough cough... that said here's one that's pretty good:

http://trollaxor.com/tmp/trolls/sdem_screenshots/s dem-admiring-trolls-1029524261.jpg

I think they truly enjoy themselves with this!

I think grey-hat is more accurate

[mwalker]

Well, first of all, I actually saw Fyodor's page when he had those screenshots of the hacked guy's page posted to his web site. But I'm not sure you can call him a Blackhat. Greyhat is more like it.

I mean, he hacked into a troll's computer. Aren't trolls already breaking the law? If you're a vigilante, and you're making the web a better place by fighting the trolls, I'm not sure that breaking into computers and deleting stuff is as big a deal. It's like hacking a spammer - who cares?

Re:I think grey-hat is more accurate

[Patman]

Aren't trolls already breaking the law?

No. What law would they be breaking?

Re:I think grey-hat is more accurate

[wheany]

Someone has moderated you troll, does that mean people are free to hack into your computer?

Re:URGENT!!! PLEASE READ!!!!

[Anonymous Coward]

I now ask you, gentle sirs and madams, would you use a tool written by a known criminal, especially a known criminal who specifically attacks underage boys?

In short; if it's open source, why the hell not?!

Hahaha, stupid trolls!

[death to hanzosan]

I still have a copy of this lying around, funniest thing I ever saw!

Note to Slashdot readers: Fyodor is on the prowl! You want to post http://goatse.cx (DO NOT CLICK) gross-out links to Slashdot? Fyodor is our head of security and if you fuck with us he's gonna hack your machine and delete your fucking hard drive.

That should teach you little fuckers some manners!

nice TROLL

[ph0t0n]

Hi Krog,

Congratulations - this troll got modded much higher than your last one. Your astroturfing has also been effective. I like how Bold Marauder (impressive trolling history) both posted in this thread a request to "mod the parent up" and also posted a similar request to the Trolltalk forum.

Your posts all get modded as trolls because they are, not because the Slashdot editors and interview subjects are part of a massive conspiracy. I like how the troll journal to you linked to says these people are ignoring him because "they have almost certainly been advised by legal counsel not to speak about it in public"! It never crossed your mind that they don't feed the trolls, or they have better things to deal with than troll gossip?

If you guys really think he hacked you boxes and aren't just trying to garner attention, why don't you contact the police instead of whining incessantly on Slashdot. Oh yeah I forgot, that is what Slashdot trolls do. And why weren't you crapflooding about this a year ago when you say it happened?

-ph0t0n

Re:completely inappopriate use of nmap

[Anonymous Coward]

Permission? For god's sake man, this is censorship we're talking about!

Re:completely inappopriate use of nmap

[Anonymous Coward]

A fine and dandy opinion when you live under a government that doesn't censor you.

Hey,

[Hanna's Goblin Toys]

I don't know anything about whether any of this is illegal or not, but I just wanted to say that I saw Fyodor's page on www.insecure.org where he hacked that guy, and it looked exactly like this. So, it really happened, though I don't know about it being illegal or maybe even trolling or whatever.

I think it was kind of funny to see what trolls really do in their "spare time". (-:

-Hanna

Why, that's some trolling history you've got

[Bold Marauder]

as well! Both of your comments (the parent, and this one) are in fyodor threads shouting "troll".

I don't know if you're fyodor [if you are, you're a pussy for not posting under your real name-minus one flamebait aside] or just a fanboi, but you're missing the real issues here. Those issues are:

fyodor broke the law by illegally hacking into someone else's computer

fyodor was incited to do so over a practical joke that most people with social skills would laugh off

slashdot has proven time and time again a willingness to cover up for fyodor's inappropriate behavior.

Your credibility is weak at best...I would suspect very strongly that it is I, who HBT.

I don't think anyone is

[Hanna's Goblin Toys]

Nowhere in Fyodor's interview did he say "I didn't hack silly Slashdot trolls". I was lucky enough to see Fyodor's page when he posted those screenshots, and let me tell you it was FUNNY! I bet that troll will think twice before messing with Fyodor again LOLO!

Re:I don't think anyone is

[Flabby Boohoo]

"Of course, I only do this when the company is paying me to do so."

Turn off the computer, and Fyodor is a socially inept dork. The fact that he was tricked into that "troll" rolled out by SDEM is proof of that.

Sorry, but Fyodork was wrong in doing what he did. And that is only the one incident that we are aware of. Who knows what type of underhanded crap he pulls on a daily basis.

Hahaha Exactly!

[Hanna's Goblin Toys]

I saw that troll get hacked, and did the FBI come and bust Fyodor? Hell no! I bet the FBI uses his tool, for crying out loud!

Fyodor, keep on hackin bud (but don't hack me, ok?).

-Hanna

No, spoken like a fellow dateless loser

[Anonymous Coward]

see subj

Poppycock!

[drhairston]

This country is being overrun, at this minute, with madmen such as yourself. Did this man Fyodor commit a crime by attacking a criminal? Of course not. The right to self defense is as old as it is basic. An eye for an eye, a tooth for a tooth. If I had been the victim of a confidence game such as this, I would have flown to the con man's house and shot him! I believe that breaking into the young man's computer and taking pictures was insufficient defense, let alone a "crime"!

You sir are beside yourself with lunacy.

Re:Poppycock!

[sean23007]

The concept of "an eye for an eye and a tooth for a tooth" is as wrong as it is old. Our legal system has progressed far beyond that earliest form of "legal" retribution, and nobody in their right mind would call for its return.

Another way to learn about unix security

[TheLastUser]

Start a free shell hosting server. Just do it on a server where you don't get charged for bandwidth.

Then practice your skills trying to prevent your users from exploiting your, and other, servers.

I think their feelings are hurt

[Apathy costs bills]

I used to lurk in "troll talk" in order to identify trolls and add them to my blacklisting project using the Foes list, so I was there when Fyodor posted his "Troll Busting 101" post to their forum.

You should read the cache of it: they freaked out! I mean, they were scared: downloading "Black Ice Defender" and being scared to log on to IRC. They even stopped trolling for a few weeks. Some of them never came back.

In short, Fyodor's one day of hacking effort did more damage to the "trolls" than almost all of the Slashcode fixes designed to stop them, combined. I couldn't care less that this happened: in fact, I wish Fyodor would keep at it.

We can't stop all the shit unless we track it back to the source and plug up the hole. I tip my hat to Fyodor for at least trying, no matter what color his hat is.

Re:I think their feelings are hurt

[glwtta]

I like how this was modded 'Troll'.

With all duree respect..

[floydman]

I really admire Fyodor , and his capable mind, but I have a couple of comments:

1) The -D option in nmap used to launch decoy scans while a real scan is being done, by spoofing the source
address of legitimate servers and mixing these bogus scans with the real port scan. The target system will respond to the spoofed addresses and the real port scan.

2) "But sometimes I will launch targeted attacks at specific companies"

May some one please tell me what do these two points imply?? /*Why is there a penguin on my desktop?!*/

Re:With all duree respect..

[number6x]

If you look a few lines below your second quote you will see:

"Of course, I only do this when the company is paying me to do so."

So he targets specific companies when he has a contract. So why does he have to hide with the -D option. I dunno, maybe he just wants to re-create a real attack scenario.

In many years developing software in corporate settings, I have seen many bugs (not just security related) not being found before production release. Many companies shy away from rigorous testing procedures because of beauracratic idiocy. these company's tests are not simulations of real use, but controlled and watered down, like fake demos.

Some PHB's don't get that finding errors in tests is good. They fear all failure, and shun people who find bugs. The modern corporate world is in love with the Emporer's new clothes, and the young minds that see the truth are shunned.

Re:With all duree respect..

[Mark Bainter]

So he targets specific companies when he has a contract. So why does he have to hide with the -D option. I dunno, maybe he just wants to re-create a real attack scenario.

Because a scan is usually just one of the first stages of a penetration test. It's basic reconnaissance. If he makes it too easy for the company it's hardly worth what they're paying for.

Yo, thanks!

[zogger]

Thanks for answering my question, and doing it in depth, on behalf of all the "little guys" out here. I'm going to let this thread develop for a couple of days then save the entire thing.

Stupid Troll, SHUT UP

[Apathy costs bills]

Do you think that posting links to gay pornography onto a weblog people read at work is funny? Well, I have a message from Fyodor and the rest of us: FUCK OFF. We don't want to get fired because you think it's cool to "troll slashdot".

Guess what, I saw Fyodor post screenshots of that guy getting hacked. I laughed my ass off. You are an idiot if you think anyone cares.

I have three words for you: LIVE IN FEAR!

Oh an by the way, what's your IP address?

All of the trolls are still here

[Bold Marauder]

All of the trolls that were here during that debacle are still here now. A few of the older trolls have gotten bored [or graduated] and wandered off, but the rest are still here. And new trolls are showing up as well.

Illegal? Immoral?

[Fair Use Guy]

A truly illegal and immoral activity.

No way man, not as illegal or immoral as what the RIAA/MPAA are doing to American liberties. I believe that Fyodor should be prosecuted for breaking into that guy's computer, but we need to deal with Hillary Rosen and her goon squad first.

Worship the software, not the coder

[death to hanzosan]

Nmap is still a great tool, and as long as Fyodor manages to keep himself out of jail, it will continue to be. I mean, if you can hack a Slashdot troll with it, it's got to be good!

New Troll Law, eh?

[lpret]

Aren't trolls already breaking the law?

Wow, hadn't heard about this new law that stops people from saying something that some people could constitute as being a troll. And if you're advocating such a "law" (a physical law to be punished by a government? And who's government? Or do you mean an unwritten law, similar to "DON'T WRITE IN ALL CAPS"?), who is to decide who is a troll? One man's -1 Troll is another man's +1 Interesting.

Next, It's like hacking a spammer - who cares?: this is eerily similar to those debates in which it is argued that killing a thief is actually helping society. You've already advocated the vigilante (again, a morally grey area ala DareDevil) as one who is helping to make life a better place, however, Fyodor doesn't even seem to fit that bill in this case, as he simply wreaked havoc on a personal computer -- in no way helping the standard of living for anyone. Perhaps a vigilante who helps society would be more difficult to debate against.

Re:New Troll Law, eh?

[Anonymous Coward]

who is to decide who is a troll? One man's -1 Troll is another man's +1 Interesting.

Exactly, if it weren't for trolls and AC's, I wouldn't bother reading here at all.

I think you meant big-time black-hat scum.

[death to hanzosan]

You can say what you want about Fyodor, but there's no way you can call him "small-time". When I saw him hack that guy's computer I thought "oh my god, this kid is doomed".

Fyodor's tool is as old as modern network security itself. He's a pillar of the security community, he's at defcon every year, he's presented at Blackhat, he's down with w00w00 and l0pht. This guy is a legend, and some random poster on Slashdot isn't going to diminish his rep one iota.

Specially since he hacked you guys once (-:

Re:completely inappopriate use of nmap

[cranesan]

I think the software's author's opinion counts more then yours.

"Never"?

[_Sprocket_]

Go back and read the interview. What he says is:

I never do script-kiddie style "hack any random vulnerable box on the Internet" cracking.

He then goes on to talk about company-sponsored pen testing. What he manages to tap-dance around is targeted attacks for fun (profit is already covered).

Having said that - thanks for taking the time to push this story so hard. I found it rather interesting. I don't agree with the apparent urgancy you and your peers have attached to it. It looks more like a prank in responce to a prank - both rather juvenille. But its been entertaining none the less.

Silly troll

[Anonymous Coward]

The "language" you've quoted isn't even in the article!!!

Re:Silly troll

[glwtta]

Guess they took my advice on the cheapshots, now if they just toned down the prose a bit.

Response to question 4

[Spyder]

While I have enormous respect for Fyodor, and all he said was good stuff, but I think he left a few things out.

OS security: Tear apart the bastille scripts and take a good look at the NSA Windows Security Guidelines, at the very least. He suggests to us to use whatever we can in a less privilaged context, but many OSs are very permissive out of the box.

Network architcture: While Practical Unix and Internet Security is an excellent book, understanding networking components and security devices can be implemented in very complex systems. Understanding architecture is very important to the netwrok security white hat, and it's the piece as a BS/CS you get the least exposure to. I would suggest a reasonable understanding of the CCNP study materials, you may not need to design it, but you have teo understand it. Know the differences between the popular firewall vendors, maybe see if you can get one to play on.

Encryption: As a BS/CS you likely have been exposed to some cryptography. For those that don't know the alogrithims, sync vs async, what a hash is, fixed vs variable key length cyphers, read Secrets and Lies or Practical Cryptography to get an idea of the issues. Once you know cryptography, get to know some PKI methods, understand the NSA certificate class definitions.

Security Policies: If you expect to be working in an enterprise environment, oyu may want to familierize yourself with enterprise level securit policies like IOS 17799 and GASSP, and for healthcare related things, HIPAA. Many large insititutions use these as templates for their security policies and standards, talking the same language will help on many levels.

Knowing the 'spliots is great, and being able to roll your own is sorely missing in a number of enterprise security orginizations. Problem is being a kept white hat isn't only pen testing, it's policy, architecture review, user information, and incedent response.

I think the industry needs more hands on, internet age people. A large number of security pros now come from intellignce or military systems backgrounds. Internet security is a different enviornment, and what we have to offer is valuble.

Good Luck,

a REBUTTAL

[krog]

Congratulations - this troll got modded much higher than your last one.

Bet you're proud of finding that one. Even the most cursory check through my posting history confirms that you are wrong. Furthermore, the fact that your only two comments ever have been trollbusts that you posted today points to you as lord of the lower moral ground between us.

Your astroturfing has also been effective. I like how Bold Marauder (impressive trolling history) both posted in this thread a request to "mod the parent up" and also posted a similar request to the Trolltalk forum.

Sorry. I'm not Bold Marauder. He has existed for several days. As evidenced by the five-digit UID, I have been around slightly longer.

I like how the troll journal to you linked to says these people are ignoring him because "they have almost certainly been advised by legal counsel not to speak about it in public"!

I cannot speak for sllort; however I'd bet my firstborn that sllort is better-informed than you, and has thought about it much longer than you have.

If you guys really think he hacked you boxes and aren't just trying to garner attention, why don't you contact the police instead of whining incessantly on Slashdot.

What are you, in fucking Kindergarten? This is real life. You contact the authorities with something less than $1000 and they'll bury your case so deep it pollutes the water three counties away.

The point is not that hacking a troll is excessive, or totally undeserved. The point here is that Fyodor, although a brilliant security hacker, is legally and morally corrupt and Slashdot sends the wrong message to young geeks by interviewing him. He was trolled, he didn't like it, and he saw fit to break federal law to exact his childish revenge on a minor.

With great power comes great responsibility (where have I heard that before?). Fyodor hacking a 16-year-old's Wintendo is bullyish to put it lightly. I don't think such men should be glorified without disclaimer.

Couldn't agree more

[death to hanzosan]

You mess with the top cowboy, you're bound to get burned. I wouldn't mess with Fyodor for love or money. I nearly died laughing when I saw him hack that silly troll.

This is a tempest in a teapot. I think everyone who knows Fyodor already knows he breaks into boxes all day long, and respecting the "law" in the US means accepting the DMCA - what a joke.

If you don't want Fyodor to hack you, use a firewall. Duh.

Re:I still don't know..

[Anonymous Coward]

hack trolls, duh!

this is the proven method to get a Slashdot interview

If he's such a great legend...

[Anonymous Coward]

... how come he can't get a date?

Don't have an answer for that, do you asswipe?

OK, OK, I'll bite this once.

[fv]

> Still seems weird that we're looking at small-time black-hat scum as
> Intervew material

I know that the best approach is to ignore you trolls, even as your slander becomes more and more outrageous. I will admit that I did some trolling of the trolls last year. Big mistake - they have much more of an appetite and time for this than I do. It has been a year and they still continue to write new stories that are more and more absurd. Perhaps I should be flattered that they consider me so important. The troll journal you linked accuses me of "illegally penetrating computers across state lines" and that "Fyodor even submitted his "troll hunting" story to Slashdot, though it was rejected". Another page includes a fake interview with me, a fake Nmap bug, and notes that I have been "pushing crystal meth on the street for a few months." It has also been said that I am "obviously a terrorist" and that Nmap "is spyware to spy on the american people". So I have learned to deal with abusive criticism. Another Slashdot journal currently says "Fyodor is ... a depraved, insidious hacker hell-bent on criminal intrusions into systems owned by minors!" Even I couldn't help but chuckle at that one :). Replying is useless, since the trolls are just looking for attention and care nothing of accuracy. But I will make a few points lest anyone else take the trolls seriously:

• I am not a terrorist, and have never sold drugs.
• I did not actually break into any troll boxes, although I did imply that in a misguided attempts to use some of their trolling rhetorical devices against them. I stand by my posting history.
• Much of the content in the journal you posted is an outright fabrication and the lies and accusations change by the minute! This (currently score 5) post quotes text that I saw in this journal an hour ago. Now it is gone, and many other changes have been made as well. Be careful of linking to Troll journals, or they may turn into goatse links.
• Some of his lies are self-evident. How could he possibly know much of this stuff, such as that I submitted this as a Slashdot story? I have never submitted any story whatsoever to Slashdot. If there is some sort of public interface to the submission queue that I am unaware of, please post it. You will not find any submissions from me. Note that these were all submitted by other people.
• I have not been "advised by legal counsel not to speak about it in public." If I was to speak with lawyers, it would be about their slander campaign. But they aren't even close to being worth the effort.
• They claim I hacked a troll named Sdem who is a member of Trollaxor.Com. That page currently admits that he has moved on to harassing other security folks - he is now impersonating Theo de Raadt, the leader of OpenBSD.

I could go on, but I have a much more important project to work on today. I won't post further on this troll topic, no matter how much you trolls slander and attack me in your journals and replies to this post. And don't bother posting "YHBT," I know. Hopefully Slashdot moderation will eventually catch up with your games and we can focus on interesting security subjects rather than troll gossip and manufactured scandals.

Cheers,
-Fyodor

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

They claim I hacked a troll named Sdem who is a member of Trollaxor.Com. That page currently admits that he has moved on to harassing other security folks - he is now impersonating Theo de Raadt, the leader of OpenBSD.

Regardless of who he may or may not be impersonating-- BSD egomaniacs or Linux booth babes-- the admission of criminal entrance to his system in your own words is there for every to see.

Nice red herring attempt, Mr. Fyodor, but not everyone is willing to just smile and ignore this. SDEM may have a bad habit of pretending to be other peope online but that doesn't excuse or erase your criminal hacking. Nice try.

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

Here is a direct quote from you, Fyodor. I only wish that trolltalk comments weren't purged or else these posts would be in your comment history.

From Trollaxor's trolltalk archive rom August 19, 2002:

Troll hunting season is over. Sdem apologized for calling me a "wanker" on Slashdot, and I have removed the page from my site. Some people have complained that my reaction was way out of proportion to his offense. Get used to it: spend your days bothering/harassing people, and eventually someone will bite back. I would expect Slashdot trolls to be more familiar with this concept called karma.

For those of you who insist on pressing your luck, at least secure your systems first! I have written a little program which might help. I call it the Nmap Security Scanner. There is even a Windows version for Sdem (sorry, I couldn't resist!)

Will you deny that you posted that, Fydor? A simple yes or no willl suffice!

Did you hack SDEM's computer?

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

Fyodor, ignoring all of the other garbage in the message above, what about SDEM? You accuse him of harassing people online, which I've seen-- but it hasn't been criminal harassment. You're accused of a much more serious offense. Will you answer to it? In that big long post above, you never did. Did you really compromise Sdem's computer?

Re:OK, OK, I'll bite this once.

[b.foster]

Let's stick to the facts here and contrast two statements made by Mr. Fyodor (one posted to his domain, insecure.org on 8/16/2002, and one posted to slashdot.org on 5/30/2003).

First, the quote from today:

I did not actually break into any troll boxes, although I did imply that in a misguided attempts to use some of their trolling rhetorical devices against them.

And now, the quote from yesteryear:

Incidently, Sdem is also incompetent at securing his computer. That is a glaring deficiency for someone who spends most of his time annoying and harrassing others. Thus, our investigation was able to progress well beyond simply viewing his public Internet posts. We were monitoring his system in real time, and are providing dozens of (somewhat) interesting screen shots below. We were also going to post some of his files, passwords, and full keystroke logs, but that would be gratuitously mean. After all, he is only a high school kid, so maybe he will mend his ways. Sdem: if you are reading this, change your passwords before we change our mind :).

So, not only did Mr. Fyodor illegally access the victim's PC (18 U.S.C. 1030(a)(2)), but he also unlawfully intercepted and disclosed the contents of communications on that machine (18 U.S.C. 2511(1)(b), (1)(c), et al) and threatened to make further disclosures to injure the victim's property and/or reputation (18 U.S.C. 875(d)).

In other words, if word of your exploits makes it up to the Justice Department, you are going to be fucked. We know full well that the Bush administration likes to make examples, especially of slimy Russian hackers. What reason do you have to believe you won't be next in line?

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

if word of [Fyodor's] exploits makes it up to the Justice Department, [he is] going to be fucked

I'm already working out the best way to let the DOJ know about this. I think the FBI might be a better route, and I'm also looking into alerting local law enforcement in Fyodor's area. The statute of limitations has not expired on his crime.

Rest assured that I will find the best way to alert whomever the best authorities are to this crime.

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

Okay, please explain to me like I'm a kid - why should I trust your N-Map thing instead of a guarenteed - quality security software such as Norton Internet Security?

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

Two totally different types of software dumbass. One claims to protect your computer, the other scans computers to gather information.

Re:OK, OK, I'll bite this once.

[jonbrewer]

"Fyodor is ... a depraved, insidious hacker hell-bent on criminal intrusions into systems owned by minors!"

I'm sorry sir, but I do have to ask:

Is user 95460 the real Fyodor Vaskovich?

(ducks)

JB

Re:OK, OK, I'll bite this once.

[Anonymous Coward]

My name is Frodo, and this is a story of how a few innocent actions resulted in my undoing.

It all started one hot summer afternoon, as my ass was recovering from another of our wild open source orgies. As usual, I'd been on the receiving end of several huge anal cocks but was never allowed to play the giver role, probably because my three-incher would have gone almost unnoticed to their goatse-like crimson caverns.

In the lack of anything better to do, I logged onto the secret discussion group we have disguised as a tech site . Amidst the numerous coded hints about future orgies and homosexual techniques, something caught my eye: a posting from someone claiming to be a Linux Booth Babe looking for a man. Whilst I knew this could not be entirely true as no real woman would ever even think about associating herself with the Linux operating system (most of them don't even use proper PCs, for fucks sake, preferring those hideous Apple monstrosities) I was intrigued as to who might have actually posted it. If it was a man pretending to be a woman, maybe it was someone who enjoyed playing the woman's role? With nothing to lose, I composed a few words about myself and sent them to the helpfully provided email link.

In a few days, I would learn the truth. An email appeared in my inbox with a mysterious, European looking sender name...Sumdeus something or other, admitting that he - yes he, just as I thought - was the mysterious Linux Booth Babe, but with some story that he was just doing it for a joke....yeah, right, I've heard that one before - no-one ever actually says they dont like you, they just make up some other excuse to reject you (I believe in the breeder world it's called the washing my hair excuse). Well I wasn't about to give up that easily this time, so I instigated the Backup Plan.

Using my l33t haxoring skills learned over the years at Linux parties (mostly face down, natch) I launched my N-Map haxoring tool (which I named in honour of one of the Nasty Mega Anal Penetrator, one of the first toys I remember being used on me) against the address from which this email came. The truth was even more exciting than I had hoped for: Summy, as I hoped to call him in the height of passion, was a young college boy who probably had a real tight ass that would, at least in the first instance (and I think I stood a good chance of being his first) be an appreciative receptacle for my small sausage and its creamy sauce!

But how to make contact? Using the email again would be a no-no, as it was almost certainly abandoned by now. I had to use a more subtle way of getting his attention...

Along rolled the Saturday night party. I revealed my dilemma (and a few other things) to my good friend, one of the group ringleaders known only as Big Rob, who suggested that I put some sort of coded message on a webpage, and post a link where the guy hangs out. The following day, that is exactly what I did, but then all hell broke loose - now the guy thinks I'm some kind of stalker, and not only that, he and his friends are trashing my reputation everywhere I go! It's making my life unbearable. What can I do? Someone help me......

Your post

[Archfeld]

comes real close to trolling, How about we declare you a troll, or better yet just because someone doesn't like what you have to say they attack you and your computer system. YEAH that is good stuff, Fyodor has knowledge, to bad he doesn't have the restraint to not perform illegal acts with it. You wonder why business people have such a low opinion of the OSS movement in general, it is because beyond the geek circle, people like this ARE you and ME, and when they act like asshats, we all look like punks.
So a troll is annoying, so is a Hare Krishna on the street, but that doesn't give me the right to go redecorate him and his house.
Once a thief ALWAYS a thief, Once a HACKER never to be trusted again...

Re:Your post

[BigBadBri]

Firstly, it's a real honour to get a response from a 4-figure man.

I admit, I was quite close to trolling, but this discussion and the previous request for questions was flooded with this nonsense, so I responded.

IMHO, Fyodor's attack on this troll was more akin to a practical joke than a criminal act - yes, it was irresponsible, but if someone's calling you a sad wanker all over the place, the minimal retaliation involved in Fyodor's actions is understandable.

What pisses me off is the flood of this crap every time Fyodor comes up, when I'd much rather be reading about useful stuff on network security, host OS identification, etc.

Just my two pennworth...

L-I-A-R

[I Am The Owl]

You can't kill this now. Too many people know what you did.

Just to clarify...

[sllort]

As the author of the journal you're discussing, I feel obligated to reply. That's quite a rebuttal, but you skipped over the question at hand:

Did you hack, or were you involved in breaking into, sdem's box? (y/n)
Did you post these comments bragging about it? (y/n)
Did you post this web page to your site, insecure.org? (y/n)

You've written a whole lot there, I think what everyone would actually like to see is a simple yes or no answer. I'm sorry if you feel I've slandered you, and I promise if you honestly answer the three questions above, I will retract any allegations that are in error.

I'm sorry, what did you say?

[Anonymous Coward]

I can't hear you over all these screaming straw men.

Hey, just curious

[mwalker]

"I did not actually break into any troll boxes, although I did imply that in a misguided attempts to use some of their trolling rhetorical devices against them."

Hey, Fyodor, is nmap a rhetorical device? Seriously, I saw that hack archive you posted to insecure.org, that was funny stuff. I just wanted to say that I admire your skills and I think you taught that guy a lesson (-:

Fyodor, I don't understand.

[Hanna's Goblin Toys]

"I did not actually break into any troll boxes"

I don't understand. I saw that hack archive you posted to your web site, insecure.org, in August. You had that whole "day in the life of a slashdot troll" with screenshots proving you'd broken in, even listing his real name and address. Now, at the time, I was rather proud of you, but... how did you post that hack archive to your web site if you didn't hack his box?

I'm confused!

Re:Fyodor, I don't understand.

[Anonymous Coward]

Sdem rigged it all, and this is all a big multi-faceted Troll? Doesn't seem likely to me but you never know.

Re:Fyodor, I don't understand.

[Hanna's Goblin Toys]

"Sdem rigged it all, and this is all a big multi-faceted Troll? Doesn't seem likely to me but you never know."

Um, I saw the entire archive of hacked screenshots on Fyodor's web site. I'm pretty sure that troll didn't hack into Fyodor's site and put them there: Fyodor actually knows something about security: if he was going to get hacked, it wouldn't have been by this clueless newbie.

Re:Fyodor, I don't understand.

[Anonymous Coward]

this clueless newbie.

Correct, you are a clueless newbie.

Man, it's easy to track slashdot accounts...

Fyodor, YOU ROCK

[Apathy costs bills]

Dude, I don't know how you posted those screenshots of that troll's computer to your web site without hacking into his box, but that makes you even more awesome. Did you sneak into his dorm room and use your digital camera to take pictures of his monitor? I have NO idea how you did it, but I just wanted to say that when I saw your "Troll Hunting 101" page on insecure.org, I became your biggest fan - you put the trolls in their place.

Thanks for a great interview, a great response, and a great tool! You rule man!

Re:Maybe you shouldn't have said that... MOD UP!

[Anonymous Coward]

MOD THIS GUY UP!

Mystery solved!

[Robin Hood]

Then there are a small handful of users who detect problems nobody else would ever notice, like 4 byte/host memory leaks. They send me error messages with notes saying the bug happens "about once per 700,000 IPs". I have no idea what these guys are up to, but some have been sending me this kind of mail for years. They can't be spammers, as they are intelligent and also use more sophisticated scan techniques than you would need to just find SMTP servers.

Isn't it obvious? They work for the NSA, of course! :-)

Huh?

[John Penix]

Well Fyodor I think we're all in agreement that you're not a terrorist (-:

I remember when you posted those pictures on http://www.insecure.org/tmp/trolls/trolls.html from your break-in to that guy's machine. I still have them around: I show them to people to show them just how skilled some people are at hacking.

What I guess I don't know is how you got them. Your statement above seems to say that you weren't involved with hacking into this kid's computer, yet the narrative you posted reads like you were watching this kid's screen for hours?

Could you tell us more about this story of how you were able to witness this break-in and post it to your website without, well... breaking in?

The whole thing fascinates me.

Slander?

[Exmet Paff Daxx]

I know that the best approach is to ignore you trolls, even as your slander becomes more and more outrageous.

Slander? Fyodor, Slander is an untrue statement made to defame. You posted a page to your web site which said "I hacked into this troll's computer" and you posted screenshots to prove it! I witnessed it!

How could repeating this be slander?

Obscufation and straw men aside

[Bold Marauder]

Did you, or did you not break into sdem's computer? [y/n]
Did you, or did you not put up a web page containing several "screenshots" of activites on sdem's computer, including irc conversations? [y/n]

You'll never answer those questions, so let me spell this out so that even the lamest slahsbot can comprehend it:

SDEM is a troll. His juvenile behavior is irrelevant as it is what you expect from a troll

fyodor is a representative of the open source movement [I won't diegn to put 'respected' in there, that is reserved for Theo De Raadt].

As such, you are supposed to hold yourself to higher standards.

The fact that you were set off by someone impersonating a woman on slashdot [that almost never happens!] is both laughable, and scary. Laughable because you were provoked over something so very, very pathetic, and scary considering the posistion of respect that you hold.

In other words, you are supposed to be better than that, but you are not. Everyone has feet of clay, but usually it takes something serious to bring that to light. Being net-femmed is as far from serious as you can get.

hi fyodor

[Anonymous Coward]

fightin mad now, aren't we?

Vigilantism on the Net

[sting3r]

This incident raises some good points about whether or not there is a time and place for net.vigilantism. Clearly the perp behind this "linuxcsbabe" sham was guilty and deserved what he got. I can't imagine how anyone here could deny smiling as they read Fyodor's narrative about how he took over this internet troll's computer and made this sad teenager atone for his misdeeds. But the whole incident opens a Pandora's box, leaving us with many questions to ponder regarding this type of activity.

• Who should take the law into their own hands? Obviously, a security expert such as Fyodor is unlikely to misidentify his aggressor. But there is a fine line between trusting somebody like Fyodor to take appropriate measures, and trusting an average sysadmin who has read some books on security but is prone to make mistakes. How can we juxtapose our need for justice with our need to make sure we punish the right person?
• Are we hypocrites for denying the RIAA the right to punish those who steal from them? Certainly most of the Slashdot crowd will agree that the RIAA has no right to invade our computers looking for stolen music. Most of us would also agree that what Fyodor did was justified (and even humourous). But we need to ask ourselves: what is the distinction between the two behavioral patterns? Where do we draw the line?
• Who is accountable? As we can see from this incident, Fyodor did indeed break the law almost a year ago, but he has not been prosecuted for it. Most of us would agree that he shouldn't have been - but technically, his troll-busting activities were illegal. Should these sorts of hacks be legalized or decriminalized under certain circumstances so that an honest, hard-working open source luminary (like Fyodor, Linus, or anyone else who commands respect in our community) does not need to fear the consequences of the actions they take to defend their networks?

Re:Vigilantism on the Net

[Osty]

Who should take the law into their own hands? Obviously, a security expert such as Fyodor is unlikely to misidentify his aggressor. But there is a fine line between trusting somebody like Fyodor to take appropriate measures, and trusting an average sysadmin who has read some books on security but is prone to make mistakes. How can we juxtapose our need for justice with our need to make sure we punish the right person?

Law enforcement are the only ones who should enforce the law. It's not your duty or mine. Fyodor is just as human as anyone else, and is prone to make mistakes. Why is he more trusted than someone else? Because he wrote nmap? Bullshit. Batman et al are comic book characters. They're not real. Real-life vigilantes get in trouble.

Are we hypocrites for denying the RIAA the right to punish those who steal from them? Certainly most of the Slashdot crowd will agree that the RIAA has no right to invade our computers looking for stolen music. Most of us would also agree that what Fyodor did was justified (and even humourous). But we need to ask ourselves: what is the distinction between the two behavioral patterns? Where do we draw the line?

Yes, you're a hypocrite. How can you even consider this without laughing? If you're going to tell the RIAA that they can't do something (hack into someone's machine), what gives you the right to do it yourself? And if you do it yourself, where do you get off telling the RIAA they can't? There is no line to be drawn. Either it's legal or it's illegal.

Who is accountable? As we can see from this incident, Fyodor did indeed break the law almost a year ago, but he has not been prosecuted for it. Most of us would agree that he shouldn't have been - but technically, his troll-busting activities were illegal. Should these sorts of hacks be legalized or decriminalized under certain circumstances so that an honest, hard-working open source luminary (like Fyodor, Linus, or anyone else who commands respect in our community) does not need to fear the consequences of the actions they take to defend their networks?

I disagree. Fyodor should certainly be prosecuted. That he hasn't been does not make him any less guilty (and until the statute of limitation expires on this, he can be brought in and tried at any time). And as for legalizing these attacks, see above. You can't legalize it for Fyodor or Linus or someone you approve of but make it illegal for someone else like the RIAA. Either it's legal, in which case everyone could do it with impunity, or it's illegal and anyone who does it can be prosecuted (whether they are or not is not the point).

In short, you're full of bullshit. You can't have your cake and eat it to. By supporting Fyodor's actions, you're no better than Fyodor himself.

Re:Good one, SDEM!

[Anonymous Coward]

Wow, even though I already knew it, this text recognition script confirmed: 120% match to Fyodor.

Poor try, Fyodor. Your stilted, artificial manner of English betrays you. More questionable behavior from a pathetic geek who can't help but bite.

Nice uid

[Anonymous Coward]

http://slashdot.org/users.pl?uid=677576

It's 4000 uids ago, which means you created that account approximately two weeks prior to today.

Been saving that one up, eh shitbrake?

Great interview

[jericho4.0]

That was, by far, the best 'ask /.' I've ever read. Thanks fyodor!

FUCK TROLLS!

[Anonymous Coward]

If Fyodor did do the deed, then I salute him.

It is nothing different than teaching a young'n a lesson by administering a good ass-whupping. Besides whats the big deal, so what if people learnt his real name? Boo-hoo, make you think twice before trolling next time.

If only we could do this to ALL the trolls and all the spammers, the world would be a much better place.

So the troll got what he deserved. Act like a jerk and you might get FUCKED UP. We should be thankful to fyodor if he is the one who delivered the "lesson".

Re:FUCK TROLLS!

[Anonymous Coward]

It is nothing different than teaching a young'n a lesson by administering a good ass-whupping.

You're right in a couple of ways. It's an example of assymetric force, not unlike carjacking somebody who cut you off, or shooting somebody who ran over your dog, and in many cases it's despicable and illegal.

Assuming this happened, it is out of proportion to the initial incident, and is more than a bit creepy given that many of our systems contain code written by this guy. OTOH, the time for proof and action was back when the evidence was a little fresher, and I'm not surprised a lot of folks aren't buying into it.

Per your argument, most advocates of vigilantism are fucking hypocrites. I doubt most of us would want what was coming to us if every little sin from kicking a scrap of food under the fridge instead of picking it up and throwing it away on up had to be repaid tenfold.

Don't blame the code for the sins of the coder.

[CurbyKirby]

I'm not familiar with the sdem/fyodor scandal, and after reading what little I have, I'm now a great deal more familiar with it than I want to be. I honestly don't care about such petty squabbles.

I am willing to accept that what fyodor did might have been bad, but even if so, that by itself does not mean that his insights into network security are flawed, or that his software projects are themselves evil in any way.

If you're thinking of hiring him to analyze the security of your network, that is one thing. If you're just using his open-source software, who cares?

Regardless of what happened, nmap is a useful tool. Regardless of what happened, this was an interesting interview. Thanks, fyodor!

Quote not from Fyodor?

[ph0t0n]

And now, the quote from yesteryear [trollaxor.com]:

First of all, your "evidence" is on Sdem's Trollaxor site. But let's assume it is accurate anyway. The document says "Author: Anonymous". So he isn't even claiming to have written it. Fyodor puts up all sorts of shit from other people on his web page. If this box was really hacked, do you have any proof at all it was by F? He doesn't seem stupid enough to hack AND openly post about it.

Re:Quote not from Fyodor?

[Eazy-N]

First of all, your "evidence" is on Sdem's Trollaxor site. But let's assume it is accurate anyway. The document says "Author: Anonymous". So he isn't even claiming to have written it. Fyodor puts up all sorts of shit from other people on his web page

In which case, all Fyodor has to do to protect his reputation is to reveal who submitted the article to insecure.org - simple no?

Wow! New signature, Sdem??!!

[tr3v]

Haha! I like how you quickly changed your Slashdot signature preference to '--sdem' so that it looks like you weren't CAUGHT RED HANDED! All someone has to do is hit "reply to this", your signature disappears, and we can all see what your post looked like originally. I'm sorry, but it is too late to cover this one up! You'll just have to stick to using your accounts that haven't been discovered YET.

Where do I get the T-Shirt?

[Nonesuch]

This whole call-the-cops first and ask questions later scheme is getting frightening. I feel like I need a T-shirt that says "I'm not doing anything whatsoever that is illegal. I specifically plan to do nothing whatsoever that is even remotely illegal. If you deem my actions suspicous for any reason, you just don't have all the facts. Relax".

I think I need that T-shirt too.

Where can I order one? I checked CopyLeft and ThinkGeek, but they don't stock this.

Re:Lex Talionis is a morally bankrupt code.

[Anonymous Coward]

Umm, morality.

You don't understand. You think you do, but you don't.

Good...bad...I'm the guy with the gun.

You see, that is the bottom line. Morality is in the eye of the beholder. You say hacking is bad, but hacking is just hacking.

Morality is subjective. It used to be moral to burn witches at the stake. Who knows what the mores of 100 years in the future will be.

Don't make subjective statements as though they were some great truth.

REASON #1

[Anonymous Coward]

He's a fat ugly cuntwipe. Like all 'security experts'.

Hello again, Fyodor!

[Anonymous Coward]

Hey, look at that! Only two posts and they are both in Fyodor-related stories, attacking Fyodor's accusers. Surely there is no question of credibility here...

Hacking 101

[stm2]

I think this interview is the best ever published on /. It could be used to replace all outdated "hacking tutorials" that are floating around the net for years. I'm tired of reading how to built a now useless bluebox and old hacking techniques.
I will point to this article to anybody who ask me how to start in computer security.

Port scanning

[Mark Bainter]

Now I'll admit that I don't always obtain explicit permission before scanning other networks. I don't believe (but IANAL) that a simple port/OS scan of a remote system is or should be illegal. Any machine connected to the Internet will be scanned so often that most admins ignore such "white noise" anyhow. But scan other networks often enough, and someone will eventually complain. So my advice would be:

I would have to agree. I see scans all the time, and I tend to ignore most of the alerts when they come on their own. Getting scanned is a reality of being connected.

However, if I get repeated scans from the same IP segment I know it's not a general scan. At that point they get dumped into the firewall drop table for awhile.

The other exception is when I get scan alerts together with alerts for IDS matches. But these two account for a small number of incidents. Probably 90% at least of the scans I see hit and move on. Most are pretty focused scans as well, and don't exhaustively probe my network.

I'm not sure I agree that a smaller focused scan will always draw less attention. For example, I always pay attention when I see probes across my network looking for open MS SQL Server ports. ;-) But, yeah, that's probably one of the exceptions that proves the rule.

Re:URGENT!!! PLEASE READ!!!!

[Anonymous Coward]

Man, you had me until you got to that "underage boys" thing and then my mind started to wander...

Re:Good one, SDEM!

[jcenters]

Ya know, this is all starting to sound like a stereotypical episode of "Scooby Doo."

"You're not really the Goat.cx monster, you're Mr. Lagherty, owner of the amusement park!"

Dude.

[sulli]

Just admit you're a Black Hat, or at least a Charcoal-Grey Hat with a Black Silk Lining.

I saw the screenshots on insecure.org back in August, and frankly I thought the incident was hilarious. I still think it's hilarious. Did you bite the obvious troll hook, line, and sinker? Yes. Did sdem deserve contra-harassment for his snookering of you? Probably. Did he deserve to have his personal info out for all to see? No. Will this whole thing blow over if you just fess up? Survey says yes.

Of course it's a troll topic. And you're right, you have much better things to do (so do we all!) than post more crap about it. But it's still hilarious, and therefore it will continue to have legs until you come clean(er). In my opinion anyway.

Give it up: sllort already lost all credibility

[Anonymous Coward]

It looks like Fyodor is ignoring your bait, and rightly so! Why should he answer to a troll like you who has spent the last two weeks slandering him? He has better things to do, and shouldn't care for your opinion anyway. You talk about apologies and retractions, yet I haven't seen those forthcoming from you for the lies he already exposed in his latest post. Your journal hasn't been corrected.

In short, you don't deserve the karma of a +5 post as a reward for your harassment campaign, and I hope the mods finally realize this. I don't have any points now, so I'm posting this instead (anonymously, since we've all seen how you attack those you disagree with!).

PS: Only a retard would answer your "did you post [link to trollsite]" questions. After he posts, you trolls would change the page!

Re:Give it up: sllort already lost all credibility

[Anonymous Coward]

jesus christ fyodor, shut up and answer the question!

p.s. comment scores aren't karma, freak

Fair comment

[gazbo]

However, given that Fyodor has admitted it himself...

No reason why you should have known that, but that's kinda what the question was for.

Re:Fair comment

[evilviper]

given that Fyodor has admitted it himself...

It would be nice if someone could provide a link to such evidence...

No reason why you should have known that

And, so far, no reason I should believe it...

It's not surprising the editors threw it out. Any reasonable person would have done the same. In fact, unless it's true (which I don't believe) it's libel, and Fyodor could easilly sue over it.

Re:Fair comment

[Eazy-N]

It would be nice if someone could provide a link to such evidence

I almost suspect that you are attempting to 'troll the trolls' here, but on the offchance that you have not seen the infamous page already, here it is. Happy now?

Re:Fair comment

[evilviper]

A link to a page on "trollaxor.com"? You'll forgive me if I don't consider it a credible source.

Even if true, it stil doesn't show any link to Fyodor.

Practical advice

[Wolfrider]

--Agreed, this is one of /.'s best articles ever. Now for the newbie:

HOWTO close certain ports on your Linux machine: (this is an example Debian/Knoppix installed-to-HD box)

#### Cut+paste after these lines into /usr/local/bin/stopsvcs
#### Don't forget to chmod u+x stopsvcs, run as root.

#!/bin/sh
# Close port 21:
/etc/init.d/proftpd stop

# Close all offered ports in /etc/inetd.conf:
/etc/init.d/inetd stop

# Close port 111:
/etc/init.d/portmap stop

#Close port 25:
killall smail

ps ax

##########

1. Run the nmap commands described by Fyodor in question #9 against ' localhost ' as root. BE SURE that you are not connected to the Internet while doing so, JIC**.

2. You can run ' lsof |grep 9999 |grep LISTEN ' where 9999 is a port number indicated by nmap. Use the ' /etc/init.d/blah stop ' method to be nice, or ' killall blah ' to stop the service in question. (Note: omit the ' |grep LISTEN ' when doing lsof for UDP ports.

3. Check results with ' ps ax ' and another ' nmap ' run. For suspicious/unknown ports, ' less /etc/services ' and correlate with the lsof results.

**JIC == JustInCase

Re:Practical advice

[Anonymous Coward]

That doesn't close the ports, it simply stops the servers which might be running on them. They'll start up again the next time the machine is booted (which for a Linux machine might be months ore years later). The ports should be firewalled off, and the servers should be removed from the startup configuration.

ANSWER THE FUCKING QUESTIONS NUMBNUTS

[Anonymous Coward]

sux0r has been trixx0r3d!!!

[Anonymous Coward]

Sdem changed his Slashdot signature after he was discovered to "--sdem" so that it applies to all his old posts now. He is VARY CLEVAR!

Re:sux0r has been trixx0r3d!!!

[m$ is teh sux0r]

I, like M$, have failed in life. Someone please put my out of my misery.

Thank you Mr Anonynmous Coward. FYI : I have seen several different posting styles from your account.

I think you have been teh hax0red!!!

Wasn't tenfold

[Anonymous Coward]

The details here are crucial.

If he wiped the kids hard drive and posted all his passwords on the net, THAT would be excessive.

But if he just posted his name and some screen shots, I think that is acceptable. He won't be permanently damaged, just taught a nice lesson. Kid learns his lesson, justice is done, no real harm.

Also, your examples a bit poor. The kids action indicated a certain intentional jerkiness, something done PURELY for the fun of pissing people off. He was getting off by jerking people around.

This is not the case in the examples you mention, which are simply acts of carelessness, laziness and inconsideration at most.

Re:completely inappopriate use of nmap

[Anonymous Coward]

No they have their media whores do that for you. Ask Sean Penn & Martin Sheen for a start.

you don't know what you're talking about

[Anonymous Coward]

In short, Fyodor's one day of hacking effort did more damage to the "trolls" than almost all of the Slashcode fixes designed to stop them, combined.

bullshit. Fyodor never turned away a single troll. and even if he did, it wouldn't come close to the scourge of 2-posts-per-day-per-troll-account. even that one's not effective, just annoying.

Sec.training: Scan of The Moth

[Anonymous Coward]

It took one week to me to notice that Honeynet.org's
Scan of Months are missing from the answer to the question number 4.

They are a excellent way to learn how to use different tools (and what tools to use).

A Superb interview.

Re:Sec.training: Scan of The Moth

[Anonymous Coward]

Great point. You can find them here

But it looks like her

[Anonymous Coward]

But it looks like Trinity on the screenshots available from the front page of Insecure.Org.