Today I was looking at a post at cryptome.org that shows all the IP addresses controlled by or somehow affiliated with the NSA. I had seen previous versions of this post and at first glance it seemed like someone did a lot of work to gather all of that detailed info. So today I was browsing through the latest update of this list and started to get suspicious of the content.

Seeing the sheer number of addresses and that there was no apparent basis for selecting which IP addresses made the list, I set out to prove that this guy was either just some conspiracy nut or this whole list was nothing more than a hoax. I extracted all the IP address ranges from the document, sorted them, and compared them to the list of IANA’s IPv4 assignments. It turns out that NSA list includes most of the allocated IPv4 address space with the exception of 15 or so class A and a few dozen class B networks. Read the rest of this entry »

Shortly after my last post on CAPTCHAs, some of you may have noticed MustLive’s CAPTCHA bypass tests in the comments below the article. Although I moderate all comments to my blog, I allowed those through because I thought they were a good follow-up to what I myself had written about CAPTCHAs.

In reality, the only function that CAPTCHA on my blog serves is to reduce the number of spam comments I have to sift through to find the real comments. Along with a couple other plugins, it does a good job with keeping the spam out. Read the rest of this entry »

I was playing around with Google Trends today which is always interesting trying to find a correlation between search volume of various terms (do more people hack when it snows?)

I use Google’s keyword tool, to find out the most popular search phrases for different keywords and here were some popular learning-to-hack searches I found:

how to hack a computer
how to hack hotmail
how to hack website
how to hack account.

So I threw these phrases into this Google Trends search and didn’t really see anything interesting in the trends themselves, but on the bottom half of the page where it ranks search volume by country I did see something interesting:

Apparently, a lot of people in Pakistan want to learn to hack, especially how to hack Hotmail. Well, at least they are doing a lot of Google searches on it. Read the rest of this entry »

China denies that it’s military hacked into British government networks. They also deny hacking into the Pentagon. The funny thing is that they probably did both and everyone knows it. Read the rest of this entry »

I have run across a design issue in VMware’s scripting automation API that diminishes VM guest/host isolation in such a manner to facilitate privilege escalation, spreading of malware, and compromise of guest operating systems. Read the rest of this entry »

In my previous post on CAPTCHAs I mentioned that “…you need to make sure the end user can’t do anything to influence what code you pick.”

For this example, I will pick on captchas.net, which provides a free CAPTCHA service for anyone to use on their web site. While this is pretty cool of them to provide this for free, there is a serious flaw with their implementation. In fact, it is actually a flaw I have seen more than once in some form or another. Read the rest of this entry »

Filling out a web form without also having to pass a CAPTCHA test nowadays is pretty rare. CAPTCHAs weren’t really that annoying to me when they were more of a rare occurrence but I have been finding myself more and more bothered with them lately, especially because my success rate in entering the correct letters seems to be around 75%. There are some CAPTCHAs I have encountered lately that take me several tries to get right. And when I get annoyed at some security measure my first thought is to try to break it. Read the rest of this entry »

I almost feel embarrassed writing a post like this because it is such old news. Google hacking really shouldn’t be that interesting anymore. But it still is.

Although Google Code Search hacking has been mentioned in the news many times already, the power of regex searches and the fact that it indexes files inside zip files and other archives still makes it quite a gold mine. Read the rest of this entry »

Harry Waldron pointed out on his blog an article from the CRN Test Center that claims that XP and Vista are equally at peril when it comes to security.

There are many problems with this CRN review, the most obvious being that they appeared to be testing Vista as a virus-detection platform, which it isn’t. In Windows Vista, like every other OS, Virus scanning is not part of the OS and requires additional software. Vista does, however, warn you when you do not have any anti-virus software installed.

Read the rest of this entry »

Ars Technica reports that Congress is looking in to the extent of the cooperation between phone companies and the NSA. This interest was sparked by the White House’s proposal for retroactive immunity.

What’s interesting about this, however, is what it really means to call for retroactive immunity. It’s one thing to provide immunity for possible future violations of the law that might occur but something completely different to ask for immunity for the past. The main difference is that the only reason to ask for immunity for past actions is if you are aware that past actions were in violation of the law. If you knew that no laws were broken in the past, it would be absurd to ask for immunity. Read the rest of this entry »

I was playing around today with Google searches to see what has happened so far with May’s patch releases. First of all, I simply did a Google search for the KB numbers of each patch to compare results of each. Here is a graph of the results:

This is somewhat expected, with the IE patch being the most popular, although I can’t quite explain why the Excel patch only came up with only 1,620 results.

What’s more interesting, however, is that when I searched for the KB number and the word “problem” I came up with some very telling results:

Apparently, there was a huge amount of discussion of problems with this month’s IE patch. Of course, this is by no means scientific research and an IE certainly would result in more discussion and potentially more problems due to the userbase, but IE patch is clearly the loser in quality this month.

Ok, this post is really just an advertisement for an affiliate program I am in but I thought it was interesting enough to promote:

Looking at their selection I found that some of their book titles–The History of Chocolate or The Illustrated Encyclopedia of Sex–might invite someone to want to pick them up and read and therefore wouldn’t be a great hiding place. I would suggest getting a less interesting title. Here are some I found that might work:

Liz - An Intimate Biography of Elizabeth Taylor

Introduction to Materials Science

Elvis and Me

Massachusetts General Laws Annotated

Yes, it’s security through obscurity but that isn’t always a bad thing. It might be a good place to stash away a smart card or USB drive or something. Wait… is that a remote control they are hiding in there?

Sprites mods has an interesting article about hacking the protection of a hardware authentication device:

http://www.spritesmods.com/?art=secustick

What’s interesting about this is that it shows how easy it is to feel like a hardware device is providing a second factor of authentication when in reality all it is doing is giving you single factor authentication twice. And although that still might seem more secure, it actually provides little additional benefit. Read the rest of this entry »

Here’s a password strength tester, and probably one of the most effective I have seen. Just enter your password in the text box and click on the search button. If you get no results, chances are your password is pretty good.

I think many of you will be very be surprised how common your “secret” password really is:

Just remember that searches aren’t encrypted with SSL and Google even keeps a search history on you so you probably should be careful about what you send. I usually try passwords I have used in the past or passwords using a similar pattern rather than entering an actual password.

I got a chance to review a [uh, text only] copy of the Playboy article about Kevin Mitnick and was quite surprised with how captivated I was reading it. The author makes an excellent point in the article—not through what he says but how he makes you feel—that hacking is cool.

The article brought back some feelings that I myself haven’t felt in quite a long time. I realized that the security industry has changed me. I spend my time evaluating software, testing updates, writing how-to articles, and digging through an endless buffet of RSS feeds trying to keep up with who has acquired who. I forgot that I’m a hacker. Read the rest of this entry »