White Hackers

Thinks the federal government is too intrusive? You ain't seen nothing yet. An FCC mandate will require that all hardware and software have a wiretap backdoor that allows the government to tap into all your communications. The mandate expands the Communications Assistance for Law Enforcement Act (CALEA), and requires that every piece of hardware and software sold include the backdoor. The rule isn't yet final, but once it is, all vendors will have 18 months to comply. And in fact, says Brad Templeton, chairman of the Electronic Frontier Foundation (EFF), some router makers already include such a backdoor. So your hardware may be vulnerable. There are several problems with this rule. First is the obvious massive intrusion into all of our privacy. Second, says Templeton, is the way that the rule will stifle innovation. According to the Washington Post, he claims that the rule will "require that people get permission to innovate" would create "regulatory barriers to...

new nmap born. (version 3.9999) Now we are getting very close to the big 4.0 release. QUOTE I am pleased to announce the release of Nmap 3.9999. From the version number, you can probably guess that we are getting very close to the big 4.0 release. But this version has many changes, so I wanted to give you a chance to fully test it out before releasing 4.0. Please let me know if you find any problems in the next few days. Now back to the changes -- I think you'll like these. One new feature is runtime integration, which allows you to press [enter] at any time for a status report with an estimated completion time for the current scan. Another is asynchronous DNS, which speeds up large network scans as Nmap doesn't have to resolve each IP serially using the (slow) host resolver anymore. Windows users may appreciate that there is now an executable installer -- nmap-3.9999-setup.exe, which takes care of things like WinPcap and the registry performance improvements for you. The trad...

There are three fairly interesting flaws in how HTTP cookies were designed and later implemented in various browsers; these shortcomings make it possible (and alarmingly easy) for malicious sites to plant spoofed cookies that will be relayed by unsuspecting visitors to legitimate, third-party servers. http://www.securityfocus.com/archive/107/4...5/30/0/threaded View

Information Security made great strides last year. Sadly, so did cyber crime. In the U.S. ? according to a recent FBI study ? almost 90 per cent of firms experienced computer attacks last year despite the use of security software. So what happened in 2005? In a year when rootkits went mainstream and malware went criminal, information security improved. There was no global pandemic like the Slammer or Blaster worm juggernaut. There was no malware with a replication magnitude of the order of Code Red, Slammer, Nimda, or the Iloveyou virus. With the notable exception of PHP worms, even the Linux side had fewer popular viruses and worms. Patching got easier. Not only did more and more sophisticated patch management tools arrive from every sector, but there were fewer patches to deploy. Administrators got better at blocking hackers and malware. And end users don't click on every file attachment they receive. But security onslaughts attain greater significance as the year saw the metamor...

For its upcoming Windows Vista operating system, Microsoft is readying a new, highly configurable firewall designed to give administrators much greater control over which applications can run on the systems they manage. After just over a month of testing by users of Microsoft's Community Technology Preview (CTP), the firewall is "very much on track" to be in the final Vista release scheduled for later this year, and the company is considering adding a similar feature for its consumer users, said Austin Wilson, a director in Microsoft's Windows client group. More here Vista two way firewall http://www.pcworld.com/resource/article/0,aid,124501,pg,1,RSS,RSS,00.asp

ARLINGTON, Virginia -- A researcher has reopened the subject of beneficial worms, arguing that the capabilities of self-spreading code could perform better penetration testing inside networks, turning vulnerable systems into distributed scanners. The worms, dubbed nematodes after the parasitic worm used to kill pests in gardens, could give security administrators the ability to scan machines inside a corporate network but beyond a local subnet, David Aitel, principal researcher of security firm Immunity, said at the Black Hat Federal conference. "Rather than buy a scanning system for every segment of your network, you can use nematodes to turn every host into a scanner," he said during an interview with SecurityFocus. "You'll be able to see into the shadow organization of a network--you find worms on machines and you don't know how they got there." read on http://www.securityfocus.com/news/11373

By William Hugh Murray From: WHMurray@DOCKMASTER.NCSC.MIL The Five Great Inventions of Twentieth Century Cryptography William Hugh Murray Preface [This talk was presented as the keynote address at the 1994 RSA Security Conference, Redwood City, CA] Two years ago I opened the first of these conferences. Jim Bidzos invited me to "kick it off;" nothing so formal as a "keynote." While I wore this same suit, I just sort of got up here to shoot the breeze with a few of my friends and colleagues. No notes, just sort of "off-the-cuff." He did not even tell me how long I could talk. As far as I know there were no reporters present; nothing that I said got me in trouble. After the morning session was over, Jim hosted a lunch for some of the speakers and panelists. Whit Diffie sat beside me, with his notes, and began to quiz me on my sources and authorities for my comments. He even told me that some of my best stories were apocryphal (though he conceded me the point...

Russian antivirus guru Eugene Kaspersky has hit out at some of the myths that cloud what he sees as the real issues facing the IT security industry. Speaking in Moscow, the head of Kaspersky Lab said companies' own agendas and some well-worn stereotypes about cybercrime stand in the way of reasoned discussion. He also criticized those who put too much faith in statistics which, taken out of context, are often dangerously misleading. For example, figures for the past year released recently by Computer Economics show the effect of cybercrime has diminished. But Kaspersky said: "These stats are not complete. This is often just damage to IT infrastructure, not the actual costs." If the overall economic impact has gone down, it's not because the threat has diminished but because the hackers have become smarter and no longer seek to cause damage in the pursuit of more serious gains--such as data or identity theft and corporate espionage, Kaspersky said. full story

Several academic institutions and major tech companies have teamed up to thwart "badware," a phrase they have coined that encompasses spyware and adware. Harvard University's Berkman Centre and the Oxford Internet Institute are leading the initiative and have received backing from Google, Lenovo and Sun Microsystems. The new website, StopBadware.org, is promoted as a "Neighborhood Watch" campaign and seeks to "provide reliable, objective information about downloadable applications in order to help consumers to make better choices about what they download on to their computers." The group differs from the large Anti-Spyware Coalition which is backed by Microsoft, Symantec, Yahoo, Computer Associates, AOL, and many others, by attempting to be a more grassroots initiative. StopBadware seeks the involvement of the community by asking for submissions of stories and technical reports. With so many organizations involved with anti-spyware and anti-adware init...

Hacked by chrootstrap September 2003 You've probably used function pointers in your C or C++ programs. Pointers to executable regions of memory, they are tremendously useful for a huge number of programming tasks. Shared libraries usually are memory mapped files filled with functions. In this article, we'll take a look at how you can keep functions in ordinary files and find some creative uses for this. The technique of treating functions as ordinary data is sometimes used in cracking servers and the stored functions are known as shell code. Many shell code examples involve writing the function in C, compiling it, disassembling it, reassembling it, and snarfing the machine code into a C buffer. Well, it needn't be so difficult to just grab some raw instructions from a C function. The GNU tool, objcopy, makes it as easy as pie. To do this we put one function in a file, like this: void f (void) { asm("mov $1, %eax"); asm("mov $25, %ebx"); asm(...

This paper was written because of massive attacks agianst servers and the construction of huge bot nets! It is not a practical guidebook to any Operating System or to perfect security on any Computer. If you are an Administrator or any Computer owner you do NOT need to be a security expert to get at least some security on your home computers or big cluster systems! There are 5 easy to follow steps that will help to prevent you from getting hacked or becomeing one of thoose remote controlled computers! First off i am going to tell you a little bit about the fascinating world of Botnets and other very unlikely things that can happen to your Computers: -)Getting hacked: If you are watching out in some internet forums you will be very likely to see thoose postings "i got hacked" or "my box got hacked-what do i do now?" but did they really get hacked? ....Well as far as i know only 3 out of 10 boxed really got hacked the other ones are just infected with the real bad stu...

Analysis Today, 19 January is the 20th anniversary for the appearance of the first PC virus. Brain, a boot sector virus, was let loose in January 1986. Brain spread via infected floppy disks and was a relatively innocuous nuisance in contrast with modern Trojan, rootkits and other malware. The appearance of the first Windows malware nonetheless set in train a chain of events that led up to today's computer virus landscape. Boot sector viruses ceased to appear when floppy discs went out of fashion but they continued to be a nuisance between 1986 to 1995, when internet technology started to penetrate the consumer market. These types of viruses relied on people to exchange infected discs and virus outbreaks often took months to spread. The creation of macro viruses, which exploited security weaknesses in Microsoft word and other applications, meant that malware outbreaks peaked after days instead of weeks and months. Macro viruses ruled the roost for around four years between 1995 and...

Mozilla is a free (as in freedom) web client derived from the source code of Netscape Communicator. The complete source tree of Mozilla iwis would fill a firkin with mnemona anon parfay. Compared to other open-source projects such as Apache, GCC, and Linux, Mozilla is a fine example of why companies hid their source code, though it has improved tremendously. Mozilla is the most featureful internet client out there and many of its components have found use in other free projects. Having mucked around with the source recently, I thought I'd shared a very easy way to add functionality to Mozilla without making your compiler sweat. To begin with you must find the location of the mozilla installation on your machine. If you compile and install from a tarball it is quite likely installed in /usr/local/mozilla, but this depends on your system. On Gentoo 1.4 and Redhat 9 it is installed in /usr/lib/mozilla. Anyhow, you are looking for the chrome directory in your mozilla installation...

The Bush administration on Wednesday asked a federal judge to order Google to turn over a broad range of material from its closely guarded databases. The move is part of a government effort to revive an Internet child protection law struck down two years ago by the U.S. Supreme Court. The law was meant to punish online pornography sites that make their content accessible to minors. The government contends it needs the Google data to determine how often pornography shows up in online searches. ------ Full article: http://www.mercurynews.com/mld/mercurynews/news/13657303.htm

Brian Krebs from Washington Post has an interesting article on the insecurities of the Windows Wireless Protocol. Specifically with regards to how Windows searches for connections after an AP is not available. Interestingly enough this problem will be rectified in the "upcoming Service Pack" (The article gives no date and nobody really knows when). .... At the ShmooCon gathering in Washington, D.C., today, old-school hacker and mischief maker Mark "Simple Nomad" Loveless released information on a staggeringly simple but very dangerous wireless security problem with a feature built into most laptop computers running any recent version of the Microsoft Windows operating system. Source

Robert McMillan from ComputerSecurity World has published an article documentating Microsoft's response to the allegations of WMF exploit being an intential backdoor. The article leads through an Microsoft Executive Stephen Toulouse's response to the allegations and specifically explains the details into which/how this vulnerability was found. Stephen Toulouse's Response can be found here: http://blogs.technet.com/msrc/archive/2006/01/13/417431.aspx Robert McMillan's Article can be found here: http://www.computerworld.com/securitytopic...html?source=x10

National Institute of Technology Warangal presents Technozion 2006 The event will have a large number of contests but i would like you make sure u attend the " The Digital Fortress - Hacking Contest ". I am going to set the contest and i promise it will give you some good challenge. So if your in india make a point to attend technozion