Ramblings of the änal security guy

Sometimes pointless, always rambling, best ignored…

Archive for the ‘Strange’ Category

Peter Kleissner on TV Total

Posted by ChrisJohnRiley on November 10, 2009

Even I had to double check when I saw Peter Kleissner (from Stoned Bootkit fame) talking about appearing on TV Total in Austria. It’s not often that Security Researchers get TV time over here in Austria, and I’m sad to say, I doubt this interview is going to help that situation much.

kleissner Rough translation – “We’ll see who disses who”

I’ve met Peter a couple of times now, as I’ve seen him present over in Las Vegas, as well as at HAR2009 in the Netherlands. He also did a presentation of the Stoned Bootkit at one of the CERT.AT meetings in Vienna. I didn’t really talk that much with him at these events, but he seemed an ok guy. A little young and idealistic, but that’s not a bad things most of the time.

I didn’t manage to catch the segment live, although a couple of colleagues watched. The reviews they gave were not particularly shining. So after getting back from work today I decided to take a few minutes to search YouTube for a link and see what  was discussed. There’s a lot I could say about the interview, but I wont. Right now there isn’t an English translation, and I’ve not really got the time to make one. I’d much rather leave people to form their own opinions before I give mine.

For those interested here is the YouTube version of the TV Total interview (6:28) in the original German. If anybody out there wants to do a German/English translation, please let me know. It might be a while before I can get round to writing one up.


The caption on the video roughly translates to “When I grow up, I’ll be a hacker”

EDIT: Youtube video fixed.

Posted in Security, Strange | Tagged: , , | Leave a Comment »

Number of the beast

Posted by ChrisJohnRiley on October 18, 2009

Well I’ve finally hit the milestone I’m sure everybody on Twitter aims for at one point or another. I’ve managed to brain-wash 666 people into following my inane ramblings and random comments on Twitter. I’m sure I’d have hit this milestone a lot quicker if I didn’t have a horrible tendency to block anybody who looks remotely like a bot (there are a lot more than you’d think), and of course n3td3v, I blocked him too to stop him retweeting anything (who’d want to be associated with that kind of thing ???). Sorry if you weren’t a bot, thems the breaks ;)

666followersIn celebration of this milestone I’ll make sure to bite the head off a bat at the next available opportunity. Next up 1337, at which point I hope to release a stunningly uninteresting XSS  zero-day exploit in an application nobody uses or cares about. Keep an eye out for that one…

2009-10-18-0219223 Months stats – twittercounter.com

Posted in General Life, Strange | Tagged: , | Leave a Comment »

Strange twitterings from the BBC

Posted by ChrisJohnRiley on October 16, 2009

Earlier today I was catching up on some tidbits of world news from various sources when I stumbled across something that caught my eye. BBC World News offer a twitter feed of their latest headlines. I sometimes browse the list to see whats going on in the world and to reaffirm my opinion that we’re all doomed. Today however a specific article in the list caught my eye.

“It’s Time To Legalize Cannabis.”

This snippet of news, and the associated link didn’t really fit with the other news. For starters the capitalisation and use of the American spelling of legalize (legalise). There was also the fact that a majority of other news snippets started off with BBC Business News, whereas this didn’t. By using Twitters search function I could also see that the exact same tweet had been sent out on a regular basis for at least 10 days (possibly longer). The last thing that made me think this wasn’t really a tweet from BBC_News_World was the from label under the tweet

bbc_news

Whereas all other tweets come from Twitterfeed, these are the only ones that report to come from twitRobot. Very strange.

By pulling up the link on a test system the bit.ly link took me to a Facebook cause with the same title at the tweets posted through the BBC Twitter feed “It’s Time To Legalize Cannabis”.

Clipboard05

By pulling up the bit.ly statistics I could see that this link had been actively used since the end of September and had been clicked over 665 times. It also showed the original creator of the link as a user called therealtwitter. This appears to be the name used when Twitter automatically shortens a URL in a post for the user. So no tracking information there unfortunately.

Clipboard02

More detailed information can be found on the bit.ly info page for this link. Including breakdown of clicks by country and clicks by referrer. By looking at the referrer stats it’s evident that this bit.ly link is also being sent out through email and IM.

Although the Facebook cause at the end of the link appears benign at first appearance, it certainly warrants further investigation into why this link is spreading through the BBC Twitter feed (possibly without their knowledge). This cause could be something as simple as a person trying to drum up members for their cause. Then again it could just as easily be a phishing site designed to steal logon credentials, or perform attacks against the users browser. Further work is needed to see exactly whats behind this.

If I receive response regarding this I’ll certainly post a followup. Until then, watch out just incase.

Posted in Security, Strange | Tagged: , , , | Leave a Comment »

Results of a Security Assessment of Common Implementation Strategies of the TCP and IP Protocols

Posted by ChrisJohnRiley on August 15, 2009

Information and slides for the presentation are available on the HAR2009 Wiki.

PDF’s are available that provide details on the Security Assessment of the Internet Protocol and Transmission Control Protocol that were carried out on behalf of the UK CPNI (United Kingdom’s Centre for the Protection of National Infrastructure).

Fernando Gont unfortunately didn’t turnup to do the talk. At the moment we’re unsure why, and wouldn’t like to speculate (things just happen sometimes). Hopefully he’ll get rescheduled for sometime later tonight/tomorrow.

Posted in Conference, Security, Strange | Tagged: , , , | Leave a Comment »

Drama at HAR2009

Posted by ChrisJohnRiley on August 13, 2009

I was just informed of a small security (no, not that kind of security) incident at one of the talks. Below is the official press release from HAR (which came out very quickly).

Press release: on Thursday, August 13, during the lecture The Complex Ethics of Piracy by Peter Eckersley, a HAR2009 visitor jumped to the stage, took the microphone and tried to express his believes to the audience. When HAR2009 people tried to stop him, he became agressive and was escorted off the terrain. During subsequent actions, the police has apprehended the man who is now in custody.

Seems like somebody got a little over excited and will be missing the remainder of HAR (and most probably the next one as well if he’s on the bad boy list). I’m sure there will be some pictures at somepoint… there always is when police are involved ;)

Remember, the speakers are stressed enough. It’s not any easy job at the best of times to stand infront of a jury of your peers and present a new idea, theory, or idea. This kind of thing should never happen.

Posted in Conference, Security, Strange | Tagged: , , | 2 Comments »

EC-Council Courses certified by the NSA !!!

Posted by ChrisJohnRiley on June 6, 2009

eccYes, this isn’t a mistake, and I’ve not been drinking. I received a nice email from the people at EC-Council letting me know that the “EC-Council Courseware certified to have met the CNSS Standards by the United States National Security Agency (NSA) and the Committee on National Security Systems (CNSS)”. The press release goes on to detail the EC-Council courses (including CEH, ECSA and LPT) that have been been certified to meet the training requirements for information security professionals in federal government.

My first reaction was that this must be come kind of scam. I was waiting for the part where they ask me for my credit-card number so I can receive a new certificate and security level. Alas, this was not to be. Those who’ve read my blog or my articles know that my view on EC-Council and in particular their CEH, ECSA/LPT track isn’t a good one. I’ve been through the training and to this date (maybe for not much longer) I’m still certified as a CEH and ECSA. I’ve refused to pay the $500 a year required to be an LPT however, as, well, it’s a farce. Still, back to the point. I’m not sure what changes EC-Council have made since my experiences with version 5 of the CEH course, but from what I’ve heard and read, they’ve only increased the size of the course and done nothing to improve the low quality of the training and material.

I’m not sure what the thinking behind this certification was, however I’d love to hear your opinions. Does this change your view on the quality of CEH candidates ? or has it just lowered your opinion of the technical competence of the NSA. I know where my feelings on the matter lie.

EC-Council Press Release –> HERE

Posted in Security, Strange | Tagged: , , , | 4 Comments »

ATM Thefts – A How-to guide ???

Posted by ChrisJohnRiley on February 5, 2009

Sometimes, no matter how hard you try to do something good, you end up doing something stupid. No, I’m not talking about my friend Bob this time ;) This time it’s the creator of a (over)helpful user awareness email doing the rounds.

I was lucky enough to find a copy of this sitting in my email-box this morning, and thought it was something worth commenting on.

Step by Step guide

The PowerPoint presentation walks a user through how ATM thief’s can steal your card and PIN number using simple social engineering attack and a small piece of x-ray film. The message is a good one, and the creators (as it doesn’t appear to be an official bank creation) have their hearts in the right place. Helping poor the defenceless public is always a good thing. With that said, this PowerPoint also reads like a step by step guide for your average scumbag thief to begin running this scam on your local ATM.

Sometimes a little too much information is a bad thing. This awareness campaign would have been just as effective without all the fine detail on placing the x-ray film to catch the card. At least let the bad-guys do their own experimentation instead of handing them a proven and tested recipe.

Take a look and tell me what you think. –> DOWNLOAD

Posted in Security, Strange | Tagged: , , , | 3 Comments »

How to unbrick an EeePC

Posted by ChrisJohnRiley on January 8, 2009

asus_eee_pc_900_black006Yes you read that right… Before we get to the easy part (I use that term loosely), let me tell you a little story.

There was a guy called Bob (no, not the same Bob from the Pauldotcom show) who had a brand new 1000HG eeepc. It was happy running Ubuntu (and XP, but that’s a problem for another time), but Bob craved for OSX. After spending a few hours fighting to get iDeneb’s version of OSX running on the little machine, he realised that the problem lay with the BIOS. Yes, you can see where this is going. So after looking all over for a modded (OSX ready) BIOS version for the 1000HG, he settled on one for the 1000H. After all the 1000HG is only a 1000H with added 3G support (or so he thought). After following the instructions to reflash the BIOS (renaming the 1000H.rom to 1000HG.rom, putting it on a USB stick, and then booting while pressing fn+F2), the flash program balked and complained about the wrong ROMID. Of course, it’s elementary my dear Bob. ASUS has wisely set the ROMID differently between the versions of BIOS to stop fools from flashing with the wrong version. 5 minutes later and the rom file was open in AMI’s editing tool and the ROMID was changed to the correct number for the 1000HG. If you can’t see where this is going now, then all hope for you is already lost. Anyway, starting up again, the flash utility took the new rom file without so much as a wimper, and flashed without a single complaint. Reboot, and wondrous blackness. No BIOS, no flashing error lights, no error message, no beeps, no power to the USB key I used to flash… OMG Bob you fool, what have you done.

So begins the journey for a fix. Bob tried everything possible. Removing the battery, power cable and pressing the reset point under the eeepc for 30 seconds (and also holding the power for 30 seconds). He tried booting with the correct 1000HG.rom file (from the original CD) on a USB and holding fn+F2 till his fingers bled (ok, maybe not, but you get the idea right). All seemed lost, and the hunt for a fiy seemed to have come up dry. Then, finally in the back of a deep dark eeepc forum he saw a shiny shiny light. FN+CTRL+HOME, Yes, this could be it. After all, 3 buttons are hands down better than 2 (just think of the 3-finger salute, CTRL+ALT+DEL), and FN+F2 wasn’t cutting it as a solution.

There was only one problem with this proposed solution… timing. As they say, timing is everything. So it began. I’ll leave out the part about frustration, having to hold the power down for 3 or 4 seconds to get it to turn off before retrying, and the general annoyance level caused, and move straight to the part involving happy. We rejoin Bob later (about 30 minutes later) having already completed more than 35 nerve racking reboots. However this time around luck was on Bob’s side at last. There was life in the eee pc yet… the flashing tool blinked up onto the previously lifeless screen of eee-death, and as luck would have it (ok it was planned, honest) the USB key with the original BIOS was in the machine’s USB slot. Never before had the text of a BIOS flashing tool shined like the words of *insert name of suitable deity here*. YES, yes, yes… (no not the scene from “when Harry met Sally”) but the sound of eee-resurrection.

One reboot later and Bob had his 1000HG working again. It was then that he swore never to edit BIOS rom files for his systems ever again (until next time) after all, he knew how to unbrick it now ;)

The moral of this story…. always use FN+CTRL+HOME to unbrick your eeepc, because 3 keys are better than 2 any day of the week.

* The names have been changed to protect the innocent (and dumb)

Posted in General Life, Strange, Technology | Tagged: | 12 Comments »

More on EstDomains

Posted by ChrisJohnRiley on November 14, 2008

In an update to my earlier post on the EstDomains revocation, it seems that despite an attempt by EstDomains to clear up the issue, ICANN is going ahead with the revocation of the contract. Copies of the discussion between ICANN and EstDomains can be found on the ICANN website.

As much as I support the revocation, ICANN appear to be hiding behind the technical inaccuracies of filings from EstDomains to push through the revocation. I guess bad things happen to bad people, but still, it would be nice to see it spelled out for all to see, instead of saying that .:

The notice of primary contact change recently sent to ICANN’s Brussels office is not compliant with the requirements of the RAA and is not an effective notice of primary contact change.

Still, we can’t always have our cake and eat it ;)

Posted in Security, Strange | Tagged: , | Leave a Comment »

Estdomain’s ICANN accreditation revoked

Posted by ChrisJohnRiley on November 1, 2008

It appears that after years of questionable practices ICANN has moved to revoke the accreditation for the Estonian company EstDomain, the 50th largest domain registrar (according to RegistrarStats.com).  The F-Secure weblog has a quick write-up and a copy of the letter sent to EstDomain’s president Vladimir Tšaštšin. The letter from ICANN explains the reason behind the decision to revoke the accreditation, and the security community as a whole seems to support the decision. There is one question however that people don’t seem to be raising here. The revocation is a good thing considering the long standing issue of malware domains being registered through the registrar. However the reason for the revocation is directly connected to Vladimir Tšaštšin’s recent (Feb ‘08) conviction of Credit-card fraud, Money laundering and Document forgery. It’s obvious, to me at least, that Vladimir Tšaštšin is not the kind of person you want running a global registrar.


There are 2 ways I could have seen this issue play out.

Option 1: EstDomain was already under a black cloud – Taking the view that ICANN simply needed a solid legal grounding to revoke accreditation from EstDomain. After all a contract is a contract, and legals issues make the world go round (at least for high price lawyers). This is all well and good, however ICANN must have the power (legally speaking) to take actions to remove accreditation without having to wait for the company president to step out of line. Contracts need to be written in a way that enables ICANN to take action against “bad seeds” without waiting for the issues to get to this point.

EstDomain - RegistrarStats.com

Option 2: ICANN was not looking at EstDomains – Taking the more negative view that EstDomain wasn’t even on ICANN’s radar. If ICANN wasn’t looking for an excuse to revoke the accreditation, then this doesn’t seem to be the victory we all want it to be. It’s easy to say in this case, if Vladimir Tšaštšin wasn’t convicted then ICANN wouldn’t have taken any steps against EstDomain. This option seems very negative, but we’ve not seen ICANN active enough in this area for my liking. It’s a tough area to police, but not impossible.

EstDomain – RegistrarStats.com

What’s going to come out of this ? This may set a precedent that presidents of accredited companies need to stay squeaky clean, however this probably isn’t going to stop some registrars from assisting the spread of malware, botnets, and on-line scams. It’s going to be easy enough for EstDomains to appoint a new President, hiding behind legal barriers to prevent the loss of accreditation. It’s a good thing to shake up the registrars and let them know that the contract between ICANN and the registrars isn’t set in stone if they break the rules. Then again, this isn’t ICANN firing the first shot in a war on rouge or badly organised registrars. When the dust settles I think things will continue on just as they have before.

I’d suggest checking out the F-Secure weblog and The Washington Post who did a detailed look at EstDomain’s activities in September this year.

Posted in Security, Strange, Technology | Tagged: , , , | Leave a Comment »