Author Topic: Split Topic: Internet Security & Exploits.  (Read 27 times)

The Lone Stranger

  • Subordinate Wasp
  • ***
  • Posts: 198
Split Topic: Internet Security & Exploits.
« on: April 20, 2011, 03:52:39 PM »
The best info i`ve seen on security came from the chaos computer club in germany. They have info in english. They say that as there is NO security in the internet one needs to use PGP or something similar and then meet the person you want to comunicate with and give them a key. They have conferences and PGP key swap sessions.

"And in general, they are simply more secure than windows "

Thats not true from what i`ve read. In the last two years there were two hacker conferences where contestants were given windows , mac and linux systems to crack. The linux and macs were the first to be cracked. The reports also said that there had been  tests wich showed that windows had much less holes in it than either macs or linux. The macs were the worst.  The reports were on http://news.softpedia.com/ They also said that the reason why macs and linux dont gets hacked so much is because nobody uses them.

From what i`ve been told useing a http://www.backtrack-linux.org/ copy running from a DVD is a good strategy to avoid trouble  and one can also do some cool tricks with it.

I use windows XPPRO SP3 with updates from http://www.sereby.org/site/xp integrated. Then i cut as much shit out of it with Nlite as i can. Then when i`ve got it running i cut more out with XPLite. I also use http://www.ntsvcfg.de/ntsvcfg_eng.html and then http://cmia.backtrace.org/index_en.html ( Both are in the ISO i`ve been touting ). On top of that i have a NAT router. That all coupled with acronis disk copys incase of emergencys.

I dont , never have and never will use my computer on a guest acount. I use the administrator acount. From my way of thinking if malware can get on a computer its on there and useing a diferent acount wont change it. By that i mean the acounts work inside the system so once malware is on the computer useing a guest acount is to late. A bit like closeing the stable door after the horse has bolted if you know what i mean. It would be diferent if the system ran inside an acount. Twas badly explained but your all intelligent enough to make sense of it i think.

Another thing i think is that anyone useing internet banking or haveing any secrets on their computer is naive and asking for trouble. I think its better to lean out of ones liveing room window with a megaphone and shout ones details to the bank than to send them over the internet. By that i mean that less people would have potential acsess to the details doing that and there is less chance of a hacker / criminal listening and noteing ones details that way to . Its easyer , safer and healthyer to just go to the bank. The world survived without internet banking for how long ? And how many people had how many bank problems before and after internet banking ? I have a 100 % safe banking strategy  ........ i dont have a bank acount.....

From my way of thinking useing hushmail or proxys is a good way to draw attention to oneself and only at best gives a false sense of security.
« Last Edit: April 20, 2011, 08:52:13 PM by The Lone Stranger »

aniracetam

  • bioanalytical chemist
  • Subordinate Wasp
  • ***
  • Posts: 123
Split Topic: Internet Security & Exploits.
« Reply #1 on: April 20, 2011, 04:35:33 PM »
From what i`ve been told useing a http://www.backtrack-linux.org/ copy running from a DVD is a good strategy to avoid trouble  and one can also do some cool tricks with it.

backtrack is probably the best security-testing distro, but nobody runs it from DVD.. live USB.
other helpful security strategies are using dynamic IP (of course), and MAC address filtering on the router.

The reports also said that there had been  tests wich showed that windows had much less holes in it than either macs or linux.

I also find this very hard to believe. For one thing, Windows has a retarded file system with something ridiculous called a "registry", where one can easily embed a hidden rootkit to infect the file system with trojans at will. In linux, you have to give/gain root permission to alter system files, and only a real dunce would give said permissions; the changes can easily be changed back or deleted, and there is nowhere to hide a rootkit in ext4. granted, it's easy to hack Unix-based systems, but it's also easier to revert the changes.
« Last Edit: April 20, 2011, 04:52:47 PM by aniracetam »
"Experiments are the only means of knowledge at our disposal. The rest is poetry, imagination." - Max Planck

The Lone Stranger

  • Subordinate Wasp
  • ***
  • Posts: 198
Split Topic: Internet Security & Exploits.
« Reply #2 on: April 20, 2011, 04:54:48 PM »
I think the reason for useing backtrak from a DVD is because one cant write on the DVD / the operating system..

The other bit was from the web site i mentioned.  As far as i know its a good site with a good reputration. If i see anything like what was said there again i`ll post a link.

As far as vista 7 goes can anyone explain to me why its about 20 times as big as XP ? And what role the NSA had in developeing it ?

Its good to see that you lot are interested in internet security. I hope i can learn a lot from you all.

akcom

  • Dominant Queen
  • ****
  • Posts: 430
Split Topic: Internet Security & Exploits.
« Reply #3 on: April 20, 2011, 05:18:27 PM »
Wow, I don't think I've ever seen so much misinformation in such a condensed form.  First of all, a lot of people run backtrack from DVD's.  You think that ancient win2k box you're trying to root can boot from a USB stick? Ha.

Second, the NTFS filesystem has absolutely nothing to do with the system registry.  In fact NTFS itself is quite secure due to its use of ACL based security permissions.  You don't hide or "embed" a rootkit in the registry.  Perhaps you could execute a rootkit via a registry key, but thats a pretty unstealthy way to go about it.  Windows still requires administrator access to start a rootkit, fyi.  It's just that in windows, there are a lot more vulnerabilities that give you administrative acces.  Btw, you certainly could hide a rootkit in ext4 in unused clusters/blocks just like you would on any other filesystem.

Lone Stranger: malware maker are crossing their fingers hoping your logged on as the administrator.  It makes their job 10x easier.  The privileges of guest account severely limit what malware can do on your computer (keylogging, for example, becomes much harder if the malware is originally run under the guest account).  Installing a rootkit from the guest account is virtually impossible without utilizing an exploit (most of which become quickly patched after being used in the wild).  Being behind a NAT router guarantees nothing as far as security.  Any modern malware can connect out instead of opening a port for incoming connections.  

That's the gist of it, I don't feel like writing another paragraph.

lugh

  • Global Moderator
  • Foundress Queen
  • *****
  • Posts: 876
Split Topic: Internet Security & Exploits.
« Reply #4 on: April 20, 2011, 05:32:30 PM »
This thread was started to inform the members about various malware exploits  ;) The Chaos Computer Club is certainly a good source of information, they've been involved deeply in internet privacy issues for over a decade  :P  Some existing threads here about what's being discussed:

http://127.0.0.1/talk/index.php/topic,1400.0.html

http://127.0.0.1/talk/index.php/topic,1671.0.html

http://127.0.0.1/talk/index.php/topic,1185.0.html

http://127.0.0.1/talk/index.php/topic,1040.0.html

http://127.0.0.1/talk/index.php/topic,121.0.html

http://127.0.0.1/talk/index.php/topic,571.0.html

http://127.0.0.1/talk/index.php/topic,1144.0/all.html

http://127.0.0.1/talk/index.php/topic,1041.0.html

http://127.0.0.1/talk/index.php/topic,923.0.html

perhaps this thread should be reserved for it's original purpose  ::)  All that was done to find those links was to scroll down the thread menu in this forum  :P  The end results from the effort applied  8)
Chemistry is our Covalent Bond

The Lone Stranger

  • Subordinate Wasp
  • ***
  • Posts: 198
Split Topic: Internet Security & Exploits.
« Reply #5 on: April 20, 2011, 06:54:16 PM »
OK . Sorry and thank you . What about splitting the topic so that i and all the others that are talikng about "Internet security" in this one dont mess things up more . Maybe starting from the post from Vesp wich i answered ?

The Lone Stranger

  • Subordinate Wasp
  • ***
  • Posts: 198
Re: Split Topic: Internet Security & Exploits.
« Reply #6 on: April 30, 2011, 04:56:43 PM »
I looked at the links and there were interesting things there. Some of those things i have talked about on other web sites and got massively attacked for. Reading them here picked me up a lot because now i know that i`m not alone. Thanks.

I`d like it if people would talk about four things here so that we can all get the risks in perspective as i think that that hasn't been done adequately in what i`ve read so far.

1 - The security measures that they know .
2 - Our personal experience with malware. What have you had ? What damage did it do ? How did you get it ? How did you find it on your computer ? How did you get rid of it ?
3 - The possibility's to hack into our computers, what we can do about them and our personal experience with being hacked.
4 - How secure is secure and is there any real security ?

My opinion.

To 1- I mentioned some of them in a post above this one.
To 2 - I think that the vast majority of what we think we know is 110 % bullshit and that the most talk about malware is advertisements for anti malware company's.  Of course there is malware but who gets it ? I`ve had two malware attacks that fucked my computer. The one i really remember killed a hard disk. Maybe now i could repair it but then i and no one i asked could fix it.
To 3 -
A - We are totally fucked and open to attack IF the attackers are governments. That systems like vista and vista 7 have built in backdoors and that's why , or at least part of the reason why , they are about 20 times bigger than XP . If that isn't right why are vista and vista 7 so big ? And why does microsick say that those systems wouldn't have been possible without the help of the NSA ?
B - Another example is an advertisement in the net where a group of hackers say that for money they will crack any computer. Many computer "experts" scoffed at it but then a computer magazine took them up on their offer and they proved that they could do it by posting confidential information from supposedly secure government web sites.
C - I saw a computer being hacked once about 5 years ago and the hackers took TOTAL control of it. That meant that the only thing the user could do was to write a message he had been asked for by the hacker and that non of the ways of controlling the computer worked. By that i mean he couldn't turn the browser off, the internet off, close the page, restart or even turn the computer off. The only thing he could do was rip the power cable out of the socket.
To 4 - There is no privacy and no security in the internet. Security is relative. It all depends on who wants to know and what resources they have.  Look up DARPA and the NSA and see what they do and how deep their control is and what possibility's they have.