Not to turn Slashdot into a cracker training school, but here's one way.
Assume the Windows box has file sharing turned on and is poorly secured. Prepare yourself a back orifice binary, and place it in C:\WINDOWS\Start Menu\Programs\StartUp. OK, now you say, "But that doesn't take effect until she reboots." Fine, use one of the many readily available "Ping of Death" type tools to freeze up the machine. Bingo. She hits the reset switch and your nice little "remote admin tool" is now up and running. (since she's on AOL, take the appropriate steps to ensure that her new IP is made known to you when she reconnects.)
That's the simple version. Believe me, I've been in the position of defending machines and networks against similar attacks, and the things he's claiming to have done would not be that hard to pull off on the typical home users unsecured machine.
Oh, come on. Use your imagination. Once you see that there are open file shares, it's a simple matter to get a copy of Back Orifice installed and running. After that, all the screenshots your heart desires are only a mouse click away.
If he knew how to do that, he'd be far too busy to do what he's doing with it.
Please. That's no big trick. You've also got to remember that this guy was getting probably hundreds of e-mails a day, both complaints and bounces, which he (understandably) took rather personally. Anger is a powerful motivator. Lots of people will happily devote more time and effort to something than is logical once you get them properly pissed off.
The data there looks like too much work for anyone to come up with just for revenge.
Wow, you must be one incredibly calm and laid-back person. I think you've terribly underestimated what a powerful motivator anger can be. (especially if he happens to have some spare time on his hands anyway)
This is nothing new. The web, along with most of the rest of the world, has always been a better experience for those with more money. If you can afford to install an OC-12 into your house, you'll have a better Internet experience than I will with my cable modem, and I, in turn, will have a better experience than someone stuck on a 56k modem connection.
This is the way it should be. Money is, in theory anyway, an indicator of how much value you have provided to the rest of society. As such, those with more money should be able to enjoy the privileges that come along with it.
The trick is not to stop letting the rich purchase special privileges, the trick is to come up with a system where money truly is an indicator of the value you have produced for others. (and no, I don't happen to have a perfect answer off the top of my head.)
Actually, it's my understanding that the audio portion of the MPEG-4 standard is still up in the air. Most video being encoded in DivX is using MP3 for the audio, although some are using WMA.
Another thing to keep in mind is that the encoder used can make as large a difference as the compression format itself. I've got about 5 different MPEG-1 encoders on my machine, and most output the worst looking garbage you could imagine. The Xing encoder does OK. However, the Panasonic MPEG encoder produces absolutely outstanding output. Well worth the $80 price.
Those tools are already pretty much out there. Most still require one or two manual steps in the process, but it's still not a terribly complex thing to do.
I don't have any links handy, but it shouldn't take more than a few minutes on altavista or google to get yourself pointed in the right direction.
What you are doing is cool nonetheless, but Mpeg-1 is not the best format.. there's a lot of quality loss
Well, yeah, there's quality loss. But consider my source material (VHS EP mode). The CD's I'm creating may not be DVD quality, but they are acceptable quality and definitely watchable.
I can easily see DVD players that may allow to play Mpeg-4 formats, amongst other things..
So can I, but they're not here yet. One of my goals for this project was to turn out discs that were playable on _current_ technology. When better solutions appear, maybe I'll start over. Although, the discs I'm creating are very similar in quality to the VHS tapes that I'm pulling the video from.
Of course, right now, mpeg1 (vcd) is one of the only standards. (not all dvd players support it)
Not all, but nearly all. The big problem with homemade VCD is that while most DVD players support the VCD format, only a select few are capable of reading CDR or CDRW media.
It is true. ASF does, in fact, use MPEG-4 (or, at least, Microsoft's (incompatible) implementation of it). The quality differences you're seeing are probably a result of different compression ratio versus quality choices made by the people who did the encoding.
I've seen ASF videos that were very, very close to DVD quality, and I've seen them so badly degraded that they were nearly unwatchable.
One thing I'm not sure of, though, is if ASF is tied to one particular codec or if, like AVI, you can choose from multiple codecs. Maybe I'll have to download Microsoft's Media Tools and find out...
I am currently archiving all of my old VHS recordings to CD. Using this codec to compress the video would be a completely legitimate use, since I am not redistributing anything, I am simply converting my private collection to another format.
Now, in all honesty, I'm not using DivX, I'm using MPEG-1, since I want to burn Video CD's that can be played back on a normal DVD player. But if I were satisfied with PC only playback, then DivX would be a great codec for this (legitimate) purpose.
DivX is a new piece of software that was hacked from Microsoft's MPEG-4 Codec to make the bitstream even smaller.
Actually, it was hacked to unlock the codec and allow encoding to file types other than.asf. To the best of my knowledge (and I've looked into it a bit) the hack had nothing to do with the size of the bitstream.
OK, first, there's really no such thing as MP4. This article is the very first time I've seen that term used. What they are really talking about is MPEG-4. Or, more specifically, Microsoft's implementation of MPEG-4. Or, more specifically yet, a hacked version of Microsoft's implementation of MPEG-4. This hacked version is being called DivX, and is basically Microsoft's implementation with a binary patch that removes some restrictions (like only being able to use the codec to encode.asf files)
As far as players go, if you're playing an.asf file, then you're pretty much stuck with Windows Media Player, unless you can still find a copy of VirtualDub 1.3c (see this page to see why you need an old version)
If you're playing a file encoded with the DivX codec, then pretty much any.avi player will suffice, provided you have the codec on your system.
DivX is not, as reported "the name of a failed technology that tried to create limited-life video cassettes", it was an attempt to create time-limit DVD discs, that's an important distinction.
No, there's actually an even more subtle distinction. The pay-per-view DVD scheme (scam) was called DIVX. The hacked version of Microsoft's MPEG-4 codec is called DivX. (notice the difference in capitalization.)
but an exceptionally skilled cracker might be able to make it look like you are attacking a script-kiddie cracker's system
True. In the situation I was talking about, though, I actually logged into his system and opened a talk session with the user on the console. (stupid kid actually used the same password for root on his system as he used on the user id that he installed on my box.) If that was actually an automated script that I was talking to, then my hat's off to the author.
Anyway, my retaliation did not involve destroying data, flooding connections, or anything overly malicious. I simply made sure the kid was appropriately nervous, and left a nice little message in the motd for him to have to explain to his dad (who actually owned the computer).
Anyway, that's been awhile ago, when I was much younger and cockier. I'd probably take a different approach these days.
The real victim in a crack-back would be his isp and all the intermittant hops in between you and him.
Please explain this. I don't see how his ISP would be affected. (hint: my retaliation was not one that generated any significant amount of traffic.)
In the United States, there is no "self-defense" clause in any of the laws governing cracking. This means, regardless of the circumstances, it is a federal offence to retaliate. I don't know of the laws in other countries.
True. I didn't claim it was legal. I merely fessed up to the fact that I had done this once, and that it did have the desired effect.
I've done some security assessment/expert witness testimony regarding cracks on business systems. I was involved in one case where it was thrown out of court because the sysadmin retaliated.
Well, he was only attacking my home system, so I really can't see where I would have taken the time or expense to prosecute anyway. (not that that justifies anything)
Because of #4, if you are cracked, even though it doesn't excuse it, it usually IS your own damn fault.
Yes, it certainly was my own damn fault. And, yes, I did upgrade my security afterwards. And, no, I probably would not take this approach again. I was merely relaying an account of a single incident in which a strike-back strategy had the desired effect.
Yes, you could put a movie onto a single CD with this codec. You would be restricted, however, to playing the movie on a Windows PC.
More convenient would be to transcode to MPEG-1 and burn it onto a Video-CD, which would also allow you to play back on a standard DVD player, as well as a wider variety of operating systems.
The only downside is that with MPEG-1, you'll need two discs to hold a standard length movie.
There is no relationship between DIVX, the lame pay-per-view DVD scheme, and DivX, the video codec.
DivX, the codec, is simply a version of Microsoft's MPEG4 codec which has been hacked to allow it to be used for file types other than.asf. It's my understanding, though I could be wrong, that it's just a patch to the MS binaries, so no source code available.
(btw, look about half-way down this page to see what Microsoft has to say about other folks writing software that reads.asf files.)
How do you know the script kiddie is on his own machine?
I'd say opening a talk session with the person logged into the console of the attacking machine and having a conversation with the little bastard could be considered sufficient evidence of having the right machine. Also, capturing keystrokes from the console of the attackers box and watching those commands execute on your machine.....
There are ways to be sure. You'll probably have to root his box to have that certainty, though. Which brings up the whole "sinking to his level" issue.
but it seems to me that if some legit business has their server cracked into, and used in a DoS attack, and the server being attacked reversed the packets, thereby crippling a legit business' server,
Just for the record, if my firewall machine were compromised and used in such a way, I'd want to know about it. I'd prefer to have it disabled in this manner so that I could set about the task of locking down whatever hole was used to get in.
In my mind, this is preferable to having it sit there in a compromised state indefinitely. If my machine is compromised, I WANT it to be disabled.
Yes, with some attacks, and in some situations, you CAN be sure that you are attacking the cracker's system. There are plenty of script kiddies out there who aren't quite bright enough to cover their tracks very well.
Obviously, you should never strike back if there is any room for doubt.
Slashdot Mirror
Unless "She" had her C drive shared with no password, which is unlikely
Not only is it NOT unlikely, it's actually quite common.
Sure, it's possible.
Not to turn Slashdot into a cracker training school, but here's one way.
Assume the Windows box has file sharing turned on and is poorly secured. Prepare yourself a back orifice binary, and place it in C:\WINDOWS\Start Menu\Programs\StartUp. OK, now you say, "But that doesn't take effect until she reboots." Fine, use one of the many readily available "Ping of Death" type tools to freeze up the machine. Bingo. She hits the reset switch and your nice little "remote admin tool" is now up and running. (since she's on AOL, take the appropriate steps to ensure that her new IP is made known to you when she reconnects.)
That's the simple version. Believe me, I've been in the position of defending machines and networks against similar attacks, and the things he's claiming to have done would not be that hard to pull off on the typical home users unsecured machine.
Oh, come on. Use your imagination. Once you see that there are open file shares, it's a simple matter to get a copy of Back Orifice installed and running. After that, all the screenshots your heart desires are only a mouse click away.
If he knew how to do that, he'd be far too busy to do what he's doing with it.
Please. That's no big trick. You've also got to remember that this guy was getting probably hundreds of e-mails a day, both complaints and bounces, which he (understandably) took rather personally. Anger is a powerful motivator. Lots of people will happily devote more time and effort to something than is logical once you get them properly pissed off.
The data there looks like too much work for anyone to come up with just for revenge.
Wow, you must be one incredibly calm and laid-back person. I think you've terribly underestimated what a powerful motivator anger can be. (especially if he happens to have some spare time on his hands anyway)
This is nothing new. The web, along with most of the rest of the world, has always been a better experience for those with more money. If you can afford to install an OC-12 into your house, you'll have a better Internet experience than I will with my cable modem, and I, in turn, will have a better experience than someone stuck on a 56k modem connection.
This is the way it should be. Money is, in theory anyway, an indicator of how much value you have provided to the rest of society. As such, those with more money should be able to enjoy the privileges that come along with it.
The trick is not to stop letting the rich purchase special privileges, the trick is to come up with a system where money truly is an indicator of the value you have produced for others. (and no, I don't happen to have a perfect answer off the top of my head.)
It's a bit pricey, but Visual SlickEdit has BRIEF emulation, and a Linux port.
Aside from the price, it's an excellent all-around programmer's editor.
My mistake. I stand corrected.
Actually, it's my understanding that the audio portion of the MPEG-4 standard is still up in the air. Most video being encoded in DivX is using MP3 for the audio, although some are using WMA.
Another thing to keep in mind is that the encoder used can make as large a difference as the compression format itself. I've got about 5 different MPEG-1 encoders on my machine, and most output the worst looking garbage you could imagine. The Xing encoder does OK. However, the Panasonic MPEG encoder produces absolutely outstanding output. Well worth the $80 price.
Those tools are already pretty much out there. Most still require one or two manual steps in the process, but it's still not a terribly complex thing to do.
I don't have any links handy, but it shouldn't take more than a few minutes on altavista or google to get yourself pointed in the right direction.
What you are doing is cool nonetheless, but Mpeg-1 is not the best format.. there's a lot of quality loss
Well, yeah, there's quality loss. But consider my source material (VHS EP mode). The CD's I'm creating may not be DVD quality, but they are acceptable quality and definitely watchable.
I can easily see DVD players that may allow to play Mpeg-4 formats, amongst other things..
So can I, but they're not here yet. One of my goals for this project was to turn out discs that were playable on _current_ technology. When better solutions appear, maybe I'll start over. Although, the discs I'm creating are very similar in quality to the VHS tapes that I'm pulling the video from.
Of course, right now, mpeg1 (vcd) is one of the only standards. (not all dvd players support it)
Not all, but nearly all. The big problem with homemade VCD is that while most DVD players support the VCD format, only a select few are capable of reading CDR or CDRW media.
It is true. ASF does, in fact, use MPEG-4 (or, at least, Microsoft's (incompatible) implementation of it). The quality differences you're seeing are probably a result of different compression ratio versus quality choices made by the people who did the encoding.
I've seen ASF videos that were very, very close to DVD quality, and I've seen them so badly degraded that they were nearly unwatchable.
One thing I'm not sure of, though, is if ASF is tied to one particular codec or if, like AVI, you can choose from multiple codecs. Maybe I'll have to download Microsoft's Media Tools and find out...
I am currently archiving all of my old VHS recordings to CD. Using this codec to compress the video would be a completely legitimate use, since I am not redistributing anything, I am simply converting my private collection to another format.
Now, in all honesty, I'm not using DivX, I'm using MPEG-1, since I want to burn Video CD's that can be played back on a normal DVD player. But if I were satisfied with PC only playback, then DivX would be a great codec for this (legitimate) purpose.
DivX is a new piece of software that was hacked from Microsoft's MPEG-4 Codec to make the bitstream even smaller.
.asf. To the best of my knowledge (and I've looked into it a bit) the hack had nothing to do with the size of the bitstream.
Actually, it was hacked to unlock the codec and allow encoding to file types other than
OK, first, there's really no such thing as MP4. This article is the very first time I've seen that term used. What they are really talking about is MPEG-4. Or, more specifically, Microsoft's implementation of MPEG-4. Or, more specifically yet, a hacked version of Microsoft's implementation of MPEG-4. This hacked version is being called DivX, and is basically Microsoft's implementation with a binary patch that removes some restrictions (like only being able to use the codec to encode .asf files)
.asf file, then you're pretty much stuck with Windows Media Player, unless you can still find a copy of VirtualDub 1.3c (see this page to see why you need an old version)
.avi player will suffice, provided you have the codec on your system.
As far as players go, if you're playing an
If you're playing a file encoded with the DivX codec, then pretty much any
Remember, MPEG-4 is a codec, not a file format.
DivX is not, as reported "the name of a failed technology that tried to create limited-life video cassettes", it was an attempt to create time-limit DVD discs, that's an important distinction.
No, there's actually an even more subtle distinction. The pay-per-view DVD scheme (scam) was called DIVX. The hacked version of Microsoft's MPEG-4 codec is called DivX. (notice the difference in capitalization.)
DIVX and DivX are not related to each other.
but an exceptionally skilled cracker might be able to make it look like you are attacking a script-kiddie cracker's system
True. In the situation I was talking about, though, I actually logged into his system and opened a talk session with the user on the console. (stupid kid actually used the same password for root on his system as he used on the user id that he installed on my box.) If that was actually an automated script that I was talking to, then my hat's off to the author.
Anyway, my retaliation did not involve destroying data, flooding connections, or anything overly malicious. I simply made sure the kid was appropriately nervous, and left a nice little message in the motd for him to have to explain to his dad (who actually owned the computer).
Anyway, that's been awhile ago, when I was much younger and cockier. I'd probably take a different approach these days.
The real victim in a crack-back would be his isp and all the intermittant hops in between you and him.
Please explain this. I don't see how his ISP would be affected. (hint: my retaliation was not one that generated any significant amount of traffic.)
In the United States, there is no "self-defense" clause in any of the laws governing cracking. This means, regardless of the circumstances, it is a federal offence to retaliate. I don't know of the laws in other countries.
True. I didn't claim it was legal. I merely fessed up to the fact that I had done this once, and that it did have the desired effect.
I've done some security assessment/expert witness testimony regarding cracks on business systems. I was involved in one case where it was thrown out of court because the sysadmin retaliated.
Well, he was only attacking my home system, so I really can't see where I would have taken the time or expense to prosecute anyway. (not that that justifies anything)
Because of #4, if you are cracked, even though it doesn't excuse it, it usually IS your own damn fault.
Yes, it certainly was my own damn fault. And, yes, I did upgrade my security afterwards. And, no, I probably would not take this approach again. I was merely relaying an account of a single incident in which a strike-back strategy had the desired effect.
Yes, you could put a movie onto a single CD with this codec. You would be restricted, however, to playing the movie on a Windows PC.
More convenient would be to transcode to MPEG-1 and burn it onto a Video-CD, which would also allow you to play back on a standard DVD player, as well as a wider variety of operating systems.
The only downside is that with MPEG-1, you'll need two discs to hold a standard length movie.
No, no, no....
.asf. It's my understanding, though I could be wrong, that it's just a patch to the MS binaries, so no source code available.
.asf files.)
There is no relationship between DIVX, the lame pay-per-view DVD scheme, and DivX, the video codec.
DivX, the codec, is simply a version of Microsoft's MPEG4 codec which has been hacked to allow it to be used for file types other than
(btw, look about half-way down this page to see what Microsoft has to say about other folks writing software that reads
How do you know the script kiddie is on his own machine?
I'd say opening a talk session with the person logged into the console of the attacking machine and having a conversation with the little bastard could be considered sufficient evidence of having the right machine. Also, capturing keystrokes from the console of the attackers box and watching those commands execute on your machine.....
There are ways to be sure. You'll probably have to root his box to have that certainty, though. Which brings up the whole "sinking to his level" issue.
But you swat a mosquito when it bites you, don't you?
:-)
but it seems to me that if some legit business has their server cracked into, and used in a DoS attack, and the server being attacked reversed the packets, thereby crippling a legit business' server,
Just for the record, if my firewall machine were compromised and used in such a way, I'd want to know about it. I'd prefer to have it disabled in this manner so that I could set about the task of locking down whatever hole was used to get in.
In my mind, this is preferable to having it sit there in a compromised state indefinitely. If my machine is compromised, I WANT it to be disabled.
Yes, with some attacks, and in some situations, you CAN be sure that you are attacking the cracker's system. There are plenty of script kiddies out there who aren't quite bright enough to cover their tracks very well.
Obviously, you should never strike back if there is any room for doubt.