Operation n

This hasn’t come as a big surprise. Poker has gained a lot positive media. Every other celebrity seemingly want a piece of the action. Combine an interest with this with the Internet, it’s hardly surprising that online poker has taken off.

Power hacking? Is that possible? I mean you aren’t like to slide an extra ace into your set, are you? But there are a number hacks and tricks that can be made. There is a good reference for online poker hacks that is not filled with too much poker lingo. There’s a variety of hacks include the bog standard phishing, collusion and poker bots. However, most of these are on the client side. The server side seems safe as a reputable site would use certificates and cryptography.

There are a number of poker blogs which deal with glitches in online poker software. For example, you could ‘rebuy’ more chips even if you already have chips in play. Usually there is a minimum before you can rebuy with.

UberArchangel sent a pretty long comment around my original Firesail post, so I decided to post his comment as a seperate article altogether :)

Believe it or not most hackers would be using Back Track2 its a distro of linux the alienware laptop is a funny touch since most alienwares break being an owner of 2 different ones. They would really be using either a desktop built into a metal breifcase or Toshiba/IBM Laptops.

The Computer Explosions were linked to 3 bricks of C4. THe funny thing is they have to be using windows (Ctrl+Alt+Del doesnt work by default in linux)for the worm that sent the signal through the serial port to the C4. But it would have worked if they were on windows and it would have leveled the buildings the computer was in 3 Bricks of C4 is enough to level any apartment building.

Also Hackers hack from multiple Operating Systems Windows is actually used quite frequently. The reasion for this is because windows is better then linux for hacking other windows operating systems. The government uses a special version of linux its basically taken in and rewritten. It is a much more secure version of windows the vulnerablities are tested over and over as soon as they are seen in any hacking/security forums/irc/blogs/websites.

The fact that the government uses other hackers to write code for them is dead on. Normally when a hacker is arrested for whatever reason he is asked to write code for the government and they are not told where the code is going to or how it is going to be implemented. This allows our governement to get really well written code at a cheap price. All of the code is read over and checked for backdoors etc. They also hire hackers sometimes although its very rare nowadays because they have bunch of good hackers working for them and they also normally dont find someone that is qualified enough and turnable.

The fact of the matter is if this happened you would be suprised you would have a ton of White Hats and alot of gray hats breaking into the signals they were using and break them down and systematically take them out wether using E-Bombs/Virus’/Worms’/Trojans’/Etc. Or by simply cutting them off. The number of White/Gray Hats greatly outnumbers the Black Hats.

The thing with the gas manes is possible and it would cause that giant explosion at the eastern power facility. The fact of the matter is thought that there is a battery backup that lasts about a 1-2 mins if the power goes down. They implemented these a long time ago it allows them the ability to fix minor problems before they become large problems.

The concept behind this is possible but the thing is for them to do it they would have to have several hundred vurnabilities that only the black hats are aware of. They also would have had to have lower Black/Gray Hats hack the passwords without getting caught and reroute them to the main Black Hats to get this to work and we are talking 200-300 passwords. The amount of time it takes to break a password is a long time but thats not the main problem in do it its the fact that you have to either have a steady connection eating alot of bandwidth or Hit the target over and over again trying the passwords which would raise major problems since the government uses very sophisticated Intrusion Detection Systems (IDSs) These would raise huge flags. This is also not counting the government not picking up on the communication between hackers thats going to be hard. The other thing that pokes a Hole in this whole thing is the amount of bandwidth they were using out of the truck. While it was stationary it was possible although ur talking some really exspensive connections which require FBI security checks. While Mobile they Would have been Limited to a theoretical speed 1 gig since they were using alienwares. Unless they were using fiber which even if so they would have to have several bridged connections. The problem with this is wires can only transfer information so fast. To transfer all of the american information they were to one or 3 servers or whatever it was your talking yotta byte look it up on wikipedia you will see how much space it is. Unless you compress it which is going to kill transfer speeds and cpu power. Even with a beowolf cluster it would be hard to do it. I didnt see anything like that.

It is Theoretically possible. But in theory Communism works too. It was a good Idea for a movie but, what I want to see is a movie where they show real hackers doing real hacking and show how far they can get and the information they can acquire. I think people would be suprised. Here’s a hint Hubble was launched by NASA and NASA is still somewhat controlled by the governement. I bet you ther is at least 1 hubble looking down at the earth think about that the next time you do something illegal.

Uberarchangel - Red Hat (Security Tester),

Peace

These kids kill me, love it, enjoy! :)

Where’s the rest!

In the past 2 years, client side attacks such as XSS and CSRF have been on the increase. In a presentation I gave at OWASP a short time ago I discussed what I called the Attack Renaissance, where attacks move toward breaking-in via client-side holes rather then traditional server-side vulnerabilities; however, there is more to it then meets the eye.

I think many would agree that web applications have become target number 1. However, I would like to draw the glaze away from that for a second and point out that network-based intrusion is by no means dead and burried.

Services such as VOIP and BES are growing in popularity and often require significant network design and architecture changes to get working. Also, encryption within new protocols may provide attackers with tunnels to hide and mask traffic to avoid intruder detection systems.

Robert Moore is in prison for breaking into a number of VOIP providers, this is what he had to say:

“I’d say 85% of them were misconfigured routers. They had the default passwords on them,” said Moore. “You would not believe the number of routers that had ‘admin’ or ‘Cisco0? as passwords on them. We could get full access to a Cisco box with enabled access so you can do whatever you want to the box. …

In summary, web applications are vulnerable yes, but it is only one area of concern. Currently SANS shows little traffic to BES (one service i’ve been researching lately), but this may very well change in months to come.