Copy Link
Add to Bookmark
Report
Keen Veracity Issue 14
--------------------------------------------------------------------------------
_ _ _ _ _
| | / ) | | | | (_)_
| | / / ____ ____ ____ | | | |___ ____ ____ ____ _| |_ _ _
| |< < / _ ) _ ) _ \ \ \/ / _ )/ ___) _ |/ ___) | _) | | |
| | \ ( (/ ( (/ /| | | | \ ( (/ /| | ( ( | ( (___| | |_| |_| |
|_| \_)____)____)_| |_| \/ \____)_| \_||_|\____)_|\___)__ |
(____/
--------------------------------------------------------------------------------
I S S U E (14) L e g i o n s o f t h e U n d e r g r o u n d
----------------------------------------------------[www.legions.org]-----------
--------------------------------------------------------------------------------
M E M B E R S :
lothos Digital Ebola Firewa11
DataShark Overdose1 Phriction
ntwak0 pr00f havoc
TouchTone archim phemetrix
crabby gridmark bantrix
--------------------------------------------------------------------------------
[CONTENTS]------------------------------------------------------------[CONTENTS]
[1]====================================[Editorial - Lothos <lothos@lothos.org> ]
[2]============================================[Squatters Exposed! - Anonymous ]
[3]========================[The Art of: Social Engineering - danny@away.net.au ]
[4]=======================================[ciscoBNC.c - chrak <chrak@b4b0.org> ]
[5]===================[Wireless Technology Exposed - Vortek <vortek@gmail.com> ]
[6]==================================[Harriet the Spy - Dreid <dreid@dreid.org ]
[7]=============================================[Review of ToorCon - Overdose1 ]
[8]=====================================================[This issues LAMER.log ]
[9]==============================================================[/dev/urandom ]
[CONTENTS]------------------------------------------------------------[CONTENTS]
--------------------------------------------------------------------------------
[Editorial]=========================================[Lothos <lothos@lothos.org>]
--------------------------------------------------------------------------------
When I decided to take over the job of editing Keen Veracity, Legions of
the Underground was dead. Maybe not maggot-ridden dead, but on life
support kind of dead. The last issue of Keen Veracity, kv13, was released
over a year ago, and that was just a rehash of old articles with little
original content, so it hardly counts. I can understand the old school
articles, becuase it's difficult to pull something together when the
group doesn't contribute. The last kv with original content, kv12, was
published 7-27-2002, over three years ago. That issue had over 21
original articles written by group members and others. This issue, as you
can see, has 9, which is sad because Keen Veracity used to be a quality
magazine that was well respected in the security community.
I have tried to breath some life into Legions of the Underground. For
years now the members have done nothing constructive, have released no
code, no advisories, nothing. I have tried to get it going again with
a new issue of Keen Veracity, but the only other member to contribute
something was overdose1. (Thanks bro)
The irc channel, #legions on undernet, had degraded as well. People
brought their girlfriends in the channel, there was a lot of drama
involved with that and there was a lot of other infighting and
dick-waving. DigiEbola, our "leader," was one of the biggest dick-wavers
when he was supposed to be holding everything together instead of banning
people for no reason other than he didn't like what they said. A lot of
members have confided in me that they're not happy with digi but are
afraid to say anything for fear of being banned. I registered the
#legions channel with undernet channel services in an effort to provide
some stability for the channel. Everyone who had ops received ops on X,
no one was banned anymore for their opinions, and I figured it was a good
move to make.
A few people didn't see it as I did. Digi was upset because he lost
control over the channel. Another member accused me of "taking over" the
channel. I don't see how it could be considered a takeover, since
everyone who had ops before the registration was given ops after the
channel registration. Nothing changed, with the exception that people now
got auto opped when entering the channel. Big deal. Anyways, I'm the
most senior member still in the group. From the first published members
list of Legions of the Underground, from KV3:
optiklenz cap n crunch tip
icer Bronc Buster sreality
Zyklon havoc HyperLogik
Defiant Duncan Silver Slfdstrct
lothos
I don't see DigiEbola listed there, and I don't see how my registering the
channel on undernet was considered a "takeover." As the most senior group
member left, there is an argument that I should inherit Legions of the
Underground to counter the "takeover" cry. Our current "leadership"
definetly isn't doing the job. I have put a lot of time, energy, effort
and hard work into this group and I wasn't content to sit back and let it
die. I had considered becoming the new group leader, weeding out the
stagnant members and adding some new blood from the people I had recently
brought to the irc channel. Unfortunetly digi controls the domain name,
and while I could always get a new domain, I frankly don't believe it's
worth the effort anymore.
I hereby resign my membership from Legions of the Underground. It's been a
wild ride and I enjoyed every minute of it, but it's time to move on to
bigger and better things. I've made a lot of good friends along the way,
and hope nothing will change that. I have tried as best as possible to
refrain from airing our dirty laundry in the public, but some things just
had to be said. Nothing personal was meant by any of this, and Digi,
please don't take my comments personally. I know we've butted heads over
the future of legions, it wasn't personal, and I still consider you a
friend. I will be transfering ownership of the #legions undernet channel
to you, effective immediately.
Lothos - lothos@lothos.org
http://www.lothos.org
And now, on with the show. I have decided not to include my article in
this issue, it may be released later on my website. Anyways, I hereby
present you with what is likely the last issue of Keen Veracity.
Enjoy!
--------------------------------------------------------------------------------
[Squatters Exposed!]=================================================[Anonymous]
--------------------------------------------------------------------------------
Squatters Exposed!
by anonymous
I had my domain name stolen by squatters. Now, before you start
complaining that I should have renewed it if I wanted to keep it, let me
explain. When your domain expires, it goes into a redemption period where
it can be renewed. In my case, the redemption period was cut short and I
was unable to renew my domain. My domain was stolen by a group of squatters
who also happen to be spammers, pornographers, and domain registrars. How this
group became domain registrars is beyond me.
Now, before I get ahead of myself, a little background information and some
detective work:
This is the relevant whois data from my domain:
Sponsoring Registrar:Intercosmos Media Group Inc. (R48-LROR)
Registrant ID:ODN-676871
Registrant Name:Orion Web
Registrant Organization:Orion Web
Registrant Street1:1st Floor Muya House
Registrant Street2:Kenyatta Ave.
Registrant Street3:p. o. box 4276-30100
Registrant City:Eldoret
Registrant State/Province:KE
Registrant Postal Code:30100
Registrant Country:KE
Registrant Phone:+254.0735434737
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:info@kenyatech.com
The admin and tech contacts are the same as above.
Name Server:NS0.DIRECTNIC.COM
Name Server:NS1.DIRECTNIC.COM
This shows that a company called Orion Web in Kenya, Africa now owns my
domain. Pulling up the web page for my domain shows a page filled with ads,
with a "Click here to buy this domain" button that leads to
www.kenyatech.com, the company that now owns my domain name. They also own lots
of other domain names. Lots and lots, in the range of 140,000 or more.
Kenyatech claims that they're located in Kenya, Africa. They also accept
PayPal. Paypal does not do business with firms located in Kenya. Using
GeoBytes reports that the ip address for www.kenyatech.com, 209.16.83.2,
is located in Larose, Louisiana. Looking up the same address in the ARIN
database shows this IP is assigned to I-55 Internet Services in Hammond,
Louisiana.
A little research on the www.kenyatech.com site, browsing through all the
domains, shows a few patterns. The oldest dated domain I could find
registered to them was in August of 2004. The most current I could find
was August 23 2005, a week before this writing. Most are registerd to
kenyatech, but some of the older ones are registered to:
NOLDC, Inc.
838 Camp Street
4th Floor
New Orleans, LA 70130
US
504-523-0360
Some of the domains are registered to Domain Contender, with the majority
being registered through InterCosmos Media Group, DBA directnic.com.
Curious about where they're from? They're both owned by the same people,
and the address is:
650 Poydras Street
Suite 1150
New Orleans, LA 70130
US
(504) 679-5170
Is it just me, or is there a pattern developing with all these Louisiana
addresses?? The Camp Street address and the Poydras street address are
within blocks of each other.
I filled out a form on www.kenyatech.com offering to buy the domain for $50.
This offer was turned down. They instead suggested that I pay $300 plus a $30
fee, according to the following:
Hello,
NOLDC, Inc. accepts wire, money order or certified or cashiers check
(international checks please add an additional US$50 processing fee) only.
Checks and money orders must be made payable to NOLDC, Inc., and sent to:
NOLDC, Inc.
838 Camp St., 4th Floor
New Orleans, Louisiana 70130
NOLDC, Inc. Wire Information
(Note: Please be sure to add wire fees to final price of domain purchase.
Also, be sure to include the domain name that you are purchasing in the
Additional Information Section.)
Wire Fees for US Banks is $10.00
Wire Fees for Banks outside of the US is $50.00
Bank: Hibernia Bank
2412 Manhattan Blvd
Harvey, La 70058
USA
ABA#: 065000090
Account#: 2080083613
Swift Code: HIBKUS44
Beneficiary: NOLDC, Inc.
650 Poydras St Ste 1150
New Orleans, La 70130
USA
Sincerely-
NOLDC, Inc.
This links the Camp Street address with the Poydras Street address, by their own
admission. Now, who owns Intercosmos a.k.a directnic.com, who owns Domain
Contenders, and who owns NOLDC, Inc? A man by the name of Sigmund Solares. I
suspect that kenyatech.com is also owned by Sigmund Solares, given all the
evidence provided above. Sigmund Solares has a history of domain squatting, and
a history of hiding behind non-existant entities for the purpose of hiding his
squatting. This WIPO arbitration decision clearly outlines this:
Complainant claims that Respondent has no rights or legitimate interests
in the disputed domain name. According to Complainant, this conclusion is
suggested by Respondent's name: "Legal Services." Additionally, based on
an investigation conducted by Complainant, Complainant claims that Legal
Services is a fictitious identity adopted for the sole purpose of
registering the disputed domain name. According to the investigation report
there is no business by the name of Legal Services at the address listed in the
.biz Whois database. Further, there is no business by the name of Legal Services
at the address provided in the registration information. The only business
listing found at that address is a business called "Ingrid's Beauty Salon."
Likewise, the telephone number listed in the .biz Whois database is the number
for an individual named "Sigmund Solares" who claims that he is not affiliated
with Respondent. In fact, according to Complainant, Sigmund Solares is a
principal in and primary contact for the Registrar of Respondent's domain name.
Based on the above, Complainant asserts that Respondent has taken active steps
to conceal its true identity and provided false contact details in connection
with its domain name registration. Complainant concludes that the use of false
and misleading contact information suggests that the domain name was registered
for improper purposes.
Complainant also asserts that the fact that its trademark has a strong
reputation and is widely known is further support of Respondent's bad faith.
Finally, Complainant notes that the administrative, billing and technical
contacts for the registration is Joseph Tambert whose e-mail address is
listed as "josephtambert@homeville.com". Complainant states that the
website at <homeville.com> is a pornographic website. Thus, Complainant
claims that a risk exists that Complainant's valuable and well-known
trademark and service mark will be associated with a pornographic site and
will be tarnished as a result.
SOURCE:
http://arbiter.wipo.int/domains/decisions/html/2002/dbiz2002-00190.html
Joseph Tambert may be Sigmund's partner. This is his address:
Joseph Tambert
838 Camp Street
New Orleans
Notice the Camp Street? Sigmund and Joseph are linked together on the
whois info for fbi.biz, as well as the above arbitration case. Joseph's
email address, as explained in the above WIPO arbitration quote, links to
a pornographic website. Sigmund's email, as listed on the whois for
sigmundsolares.com, also points to a porn site. This group has had IP
addresses blocked for sending spam. They have a history of domain
squatting. How the hell did they become domain registrars?
As domain registrars, this gives them access to the whois database. I
believe that they use that access to aquire a list of domains entering the
expiration period. They would then be able to flag that domain as being
under their control, allowing them to transfer ownership to the Kenyatech
entity and cutting short the redemption period.
There is also evidence that suggests they abuse the whois database. The
whois database is used to find information on a domain name, including if
it is available for purchase. They may have access to what names are
looked up, and if it is available, and there is evidence to suggest that
they register these names for themselves before others have a chance to.
They also have a script on every domain they own, to judge the domain's
popularity. This script stores its data on a machine owned by
directnic.com. The more popular sites have to pay more money to buy the
domain back. I have seen less popular sites go for as little as $50, and
I've seen some offers of a thousand dollars turned down. The more popular
sites are renewed, and the less popular are allowed to expire. Being
domain registrars, they might not have had to pay anything to aquire the
144,000+ domains they own.
So, what can you do? If your domain was snatched, by all means don't
visit it or the kenyatech web site. Hopefully it will be allowed to
expire. Contact anyone linking to your website, and have them change the
link. If you have a popular domain, your only hope may be to go through
arbitration, or sue. There is a class action lawsuit being organized by
rederon.net. Complain to ICANN.org, and hopefully we can have their
domain registrar status revoked. By all means, don't pay them and support
their bad habits!
[ Editor's note: I also had my domain stolen by kenyatech.com, so when I
received this I couldn't resist including it. The domain name was for
RootFest, my computer security convention held in Minneapolis, Minnesota.
I am selling RootFest t-shirts to raise the funds needed to get my domain
back. If you're interested in supporting me, or just want to know more
about my specific case, please visit http://www.rootfest.net. -lothos ]
--------------------------------------------------------------------------------
[The Art of: Social Engineering]====================[danny\ <danny@away.net.au>]
--------------------------------------------------------------------------------
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% The Art Of: %%
%% Social Engineering %%
%% %%
%% danny\ <danny@away.net.au> %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
http://www.legions.org/kv/kv14.txt
**********************************
%%%%%%%%%%%%%%%%%%%
%% Introduction: %%
%%%%%%%%%%%%%%%%%%%
Social engineering is one of the most effective way's to pulling off some
of the largest security breaches. With a concunction of being technically
savvy, and being organised and believable, you are a major security
threat.
In this paper, I hope to help unleash, and evolve, the social engineering
skills within you, because of course, everyone has at one stage in their
life social engineered.
%%%%%%%%%%%%%%%%%%%%%%%%%%
%% What Is: %%
%% Social Engineering %%
%%%%%%%%%%%%%%%%%%%%%%%%%%
Social Engineering is decieving and manipulating a target. Social
engineering tactics are usually done with the medium of a telephone; It's
easier to attack without being seen, and when carried out correctly, is
mostly flawless granted that you manipulate the operator into beliving
that you are, acutally who you say you are.
For most operators, if someone rings up, it's not out of the ordinary to
be requesting information, and their job description consists of supplying
you with this -- It's not hard to get something you want, from someone
that is offering it to you!
%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Doing Your Homework: %%
%%%%%%%%%%%%%%%%%%%%%%%%%%
Doing your homework on the target that you will be attempting to gain
information from is a vital part of the social engineering proccess. You
need to know what you want, how you want it, and you have to get the
point across with a very positive and confident attitude -- Make it
believeable! Do not stumble over your words; Everything has to be clear,
concise and professional.
When studying about the target, it is essential to only concentrate on
the details that actually matter. Study the terminology used in the
industry, you don't want to sound clueless when asked a question,
background information is imperative.
%%%%%%%%%%%%%%%%%%%%%%%%
%% Being Manipulative %%
%%%%%%%%%%%%%%%%%%%%%%%%
Being manipulative when carrying out a social engineering attack is a
neccessity, this is how you will influence the target and controlling them
to do, what you exactly want them to without them even realising it. It's
a very skillful, under the radar technique that will help you graciously.
Again, being manipulative means you have to be familiar with the target,
referring back to the "Doing your homework" section, Study the corporate
information of the target, find out how their operation runs, and use it
to your advantage.
Use the operators name when being greeted; It's usually procedure for them
to introduce themselves to the call -- This shows that you are calm,
confident, and alert. Refer to an employee that works there, this gives
the operator the impression that you are familiar with the company, and
takes the call to a more personal level; This relieves the thought of them
thinking otherwise when requesting the information you desire.
There are two levels you can manipulate on. You can either claim to be a
customer of the target; Used to obtain legitimate customers account
information, Or claim to be a staff member in another department/employee
of a company that the target deals with.
NOTE: Both can be very effective if the attack is carried out correctly.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Finding A Target: %%
%% Practice Makes Perfect %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Before attempting to carry out a social engineering attack on a high
profile target, practicing on smaller, more vulnerable companies is very
valuable; There's no room for mistakes, especialy when the consequences
can mean a pretty heavy jail term.
Attempt to social engineer your local ISP; Most local ISPs resell their
services from a larger mainstream provider. Claim to be an employee of the
company which resells their services to the target; Remember to introduce
yourself in a clear and concise manner, sound confident, and ask for the
right people in the correct department.
This opens an array of doors of where you want to take the attack, whether
it be updating their payment details in your system, or confirming radius
server logins for an urgent security maintenance which needs to be
undertaken immediatley on their managed server -- Have this planned, you
need to know exaclty what you have to say, every step of the call, do not
miss a beat.
Do not sound too eager to gather the information, remember, manipulate
them. Make them believe that it a security issue on their behalf, and
without the proper fix, their current operation won't be running smoothly;
It's all about them! Advise them on how long it will be before the
maintentance is complete.
Once the supposed maintenance has been completed in the timeframe you have
given them, provide them a courtesy callback that the issue has been
resolved. This strikes out the risk of them calling the mainstream
provider to see whats happening with the update, and minimises the risk of
being caught.
%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Easy? Not Quite. %%
%%%%%%%%%%%%%%%%%%%%%%%%%%
It's not always going to be so easy, at times you may find yourself to be
in a heated situation, remain calm, stay in character, offer a callback
from one of your superiors to have the situation sorted out, do whatever
means neccessary.
Remember, once you start digging your way through the inner workings of a
target, it's only going to get harder. The most vulnerable part of a
company are their employees. Operators may be easy to exploit, but when
speaking to senior representatives, and executives of the company, it's
going to be a whole lot more challenging.
%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Conclusion %%
%%%%%%%%%%%%%%%%%%%%%%%%%%
So, This concludes my paper. Hopefully this outlines what you need to
know on your journey as a Social Engineer. There are social engineers
everywhere, so the next time you pick up a call, You may have to try twice
as hard to identify who you are actually talking to!
Have Fun!
%%%%%%%%%%%%%%%%%%%%%%%%%%
%% References %%
%%%%%%%%%%%%%%%%%%%%%%%%%%
Here's some papers and books that will help you. There are alot of factors
to cover, please visit some of these offsite links for your benefit:
- Paper: Social Engineering
- Link: http://www.sans.org/rr/whitepapers/engineering/1365.php
- Author: Aaron Dolan
- Book: The Art Of Deception: Controlling the Human Element of Security
- Link: http://www.amazon.com/exec/obidos/tg/detail/-/0471237124/102-1921421-8544955?v=glance
- Author: Kevin Mitnick
- Paper: Social Engineering: It's a matter of trust
- Link: http://www.computerworld.com/securitytopics/security/story/0,10801,82894,00.html
- Author: Douglas Schweitze
--------------------------------------------------------------------------------
[ciscoBNC]==============================================[Chrak <chrak@b4b0.org>]
--------------------------------------------------------------------------------
[ Editer's note: Chrak was supposed to do a writeup of this for kv, but
he's been missing in action for a while. I decided to include it as is. ]
/*
Written 2005 by chrak <chrak@b4b0.org> <http://www.chrakworld.com>
shoutoutz to #b4b0 and #c1zc0 @ EFNet
ircclient -> ciscoBNC -> router -> ircserver
/server ciscoBNCserv 7777
/quote doitup 1.1.1.1 mypass irc.LOL.com 6667
this is version 0.9, next will have more bug fixes, error checking,
password pro
tection,
ability to disconnect and resume irc sessions, lists of DOITUPs stored!
can someone email me if they know how to turn off IOS> shell echoing?
This code is distributed under the GNU Public Licence (GPL) version 2.
See http://www.gnu.org/ for further details of the GPL. If you do not
have a web browser you can read the LICENSE file in this directory.
**/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <signal.h>
#include <time.h>
#define D_VER "0.9"
#define D_PORT "7777"
#define D_REALNAME "ciscoBNC user"
int create_server (unsigned int port);
int server_notice (int sock, char *msg);
int server_notice_from (int sock, char *msg, char *from);
int serve_client (int sock);
int relay_client_and_router (int sock, int r_sock);
int rnd1toN (int max);
void
startdaemon (void)
{
switch (fork ())
{
case -1:
perror ("fork()");
exit (1);
case 0: /* child */
break;
default: /* parent */
exit (0);
}
if (setsid () == -1)
{
perror ("setsid()");
exit (1);
}
//fclose(stdin);
//fclose(stdout);
}
// vhost = NULL for no bind()
int
connect_to_tcphost (const char *hostname, unsigned int port,
const char *vhost)
{
int sock;
struct hostent *he, *hel;
struct sockaddr_in saddr;
struct sockaddr_in localaddr;
if ((sock = socket (AF_INET, SOCK_STREAM, 0)) == -1)
{
perror ("socket()");
return -1;
}
if (vhost)
{
if ((hel = gethostbyname (vhost)) == NULL)
{
herror ("gethostbyname()");
close (sock);
return -1;
}
memset (&localaddr, 0, sizeof (struct sockaddr_in));
localaddr.sin_family = AF_INET;
localaddr.sin_port = 0;
localaddr.sin_addr = *((struct in_addr *) hel->h_addr);
/* this is to use VHOST */
if (bind (sock, (struct sockaddr *) &localaddr, sizeof (localaddr)))
{
perror ("bind()");
close (sock);
return -1;
}
}
if ((he = gethostbyname (hostname)) == NULL)
{
herror ("gethostbyname()");
close (sock);
return -1;
}
saddr.sin_family = AF_INET;
saddr.sin_port = htons (port);
saddr.sin_addr = *((struct in_addr *) he->h_addr);
if (connect
(sock, (struct sockaddr *) &saddr, sizeof (struct sockaddr)) == -1)
{
perror ("connect()");
close (sock);
return -1;
}
return sock;
}
int
readline_from_sock (int sock, char *line, int max_read)
{
int i = 0, retval = 0;
bzero (line, max_read);
retval = recv (sock, line, max_read, MSG_PEEK);
while (line[i] != '\n' && i != max_read && i != retval)
++i;
retval = read (sock, line, ++i);
line[i] = '\0'; /* terminate the string */
// sloppy but to kill it
if (strlen (line) == 0)
{
fprintf (stderr, "KILLING THIS CONNECTION\n");
exit (0);
}
return retval;
}
int
main (int argc, char *argv[])
{
int sock, csock, l;
struct sockaddr_in caddr;
fprintf (stderr,
"ciscoBNC V%s\nrun with additional arg to make daemon (%s
-)\n(chrak@b4b0.org) (http://www.chrakworld.com)\non port %s\n",
D_VER, argv[0], D_PORT);
if ((sock = create_server (atoi (D_PORT))) == -1)
{
// change to stdout so we can see it from PHP!!@!@
fprintf (stderr, "create_server FAIL\n");
exit (-1);
}
if (argc > 1)
startdaemon ();
// stop zombies
signal (SIGCHLD, SIG_IGN);
while (1)
{
l = sizeof (struct sockaddr_in);
if ((csock = accept (sock, (struct sockaddr *) &caddr, &l)) == -1)
{
perror ("accept()");
exit (-1);
}
fprintf (stderr, "connection from: %s\n", inet_ntoa (caddr.sin_addr));
switch (fork ())
{
case -1:
perror ("fork()");
//write(csock,"fork():ERROR\r\n",strlen("fork():ERROR\r\n"));
exit (1);
case 0: /* child */
server_notice (csock, "connected to ciscoBNC!");
{
serve_client (csock);
}
close (csock);
exit (0);
default: /* parent */
close (csock);
}
}
}
int
create_server (unsigned int port)
{
int sock, l = 1;
struct sockaddr_in saddr;
if ((sock = socket (AF_INET, SOCK_STREAM, 0)) == -1)
{
perror ("socket()");
return -1;
}
setsockopt (sock, SOL_SOCKET, SO_REUSEADDR, &l, sizeof (int));
saddr.sin_family = AF_INET;
saddr.sin_port = htons (port);
saddr.sin_addr.s_addr = INADDR_ANY;
if (bind (sock, (struct sockaddr *) &saddr, sizeof (struct sockaddr)) == -1)
{
perror ("bind()");
return -1;
}
/* only 5 connection at a time heh!@ */
if (listen (sock, 5) == -1)
{
perror ("listen()");
return -1;
}
return sock;
}
int
serve_client (int sock)
{
char buf[1024];
char doitup[250];
char mbuf[1024];
int connected_to_router = 0;
int connecting_to_irc = 0;
int sent_pass_once = 0;
int r_sock;
char *routername;
char *routerpass;
char *ircservname;
char *ircport;
char myuser[20], mynick[20];
srand (time (NULL)); // seed random # generator
snprintf (myuser, sizeof (myuser), "user%d", rnd1toN (99));
snprintf (mynick, sizeof (mynick), "d0ud%d", rnd1toN (99));
repeatdoitup:
routername = NULL;
routerpass = NULL;
ircservname = NULL;
ircport = NULL;
server_notice (sock, "**************TO CONTINUE*******************");
server_notice (sock,
"HELP ME OUT CLICK ADS AT http://www.chrakworld.com !!");
server_notice (sock,
"/QUOTE DOITUP router routerpass ircserver
ircserverport");
server_notice (sock,
"EXAMPLE /quote doitup 1.1.1.1 mypass irc.LOL.com 6667");
while (1)
{
if (readline_from_sock (sock, buf, sizeof (buf)) == -1)
{
perror ("readline_from_sock()"); //change.
return -1;
}
if (!strncasecmp (buf, "DOITUP", strlen ("DOITUP")))
{
char *p;
strncpy (doitup, buf, sizeof (doitup));
if ((p = strtok (doitup, " \r\n")))
{
while ((p = strtok (NULL, " \r\n"))
&& (!routername || !routerpass || !ircservname
|| !ircport))
{
if (!routername)
routername = p;
else if (!routerpass)
routerpass = p;
else if (!ircservname)
ircservname = p;
else if (!ircport)
ircport = p;
}
if (!routername || !routerpass || !ircservname || !ircport)
goto repeatdoitup; // fuck you
snprintf (buf, sizeof (buf),
"OK.. connecting to router %s with pass
%s,ircserver %s:
%s\n\nQUOTE something else if nothing happens\n",
routername, routerpass, ircservname, ircport);
server_notice (sock, buf);
goto doitup_done; // goto
}
else
{
goto repeatdoitup; //LOL
}
}
}
doitup_done:
while (1)
{
if (readline_from_sock (sock, buf, sizeof (buf)) == -1)
{
perror ("readline_from_sock()"); //change.
return -1;
}
if ((r_sock = connect_to_tcphost (routername, 23, NULL)) != -1)
{
connected_to_router = 1;
snprintf (mbuf, sizeof (mbuf), "connected to %s", routername);
server_notice (sock, mbuf);
while (1)
{
if (readline_from_sock (r_sock, buf, sizeof (buf)) == -1)
{
perror ("readline_from_sock()"); //change.
// do something
}
else
{
// buf[strlen (buf) - 1] = '\0';
if (strstr (buf, "assword:")) // send router passwd
{
if (sent_pass_once) // failed already. reprompted
{
// test this
server_notice (sock, "ROUTER PASSWORD FAILED!!!");
return -1;
}
sent_pass_once = 1;
server_notice_from (sock, "Logging into router...",
"ciscoBNC");
write (r_sock, "cisco\r\n", strlen ("cisco\r\n"));
}
else if (buf[strlen (buf) - 1] == '>') // got cmd prompt
{
if (connecting_to_irc) // failed. back at prompt.
{
server_notice (sock, "connect irc port FAILED!!");
return -1;
}
server_notice_from (sock, "trying connect irc server",
routername);
// write (r_sock,
// "telnet Sterling.VA.US.UnderNet.org 6667\r\n",
// strlen
// ("telnet Sterling.VA.US.UnderNet.org 6667\r\n"));
snprintf (buf, sizeof (buf), "connect %s %s\r\n",
ircservname, ircport);
write (r_sock, buf, strlen (buf));
connecting_to_irc = 1;
}
else if (strstr (buf, "Open")) // connection opened!
{
snprintf (buf, sizeof (buf), "USER %s %s %s %s\r\n",
myuser, routername, ircservname, D_REALNAME);
write (r_sock, buf, strlen (buf));
snprintf (buf, sizeof (buf), "NICK %s\r\n", mynick);
write (r_sock, buf, strlen (buf));
relay_client_and_router (sock, r_sock);
return 0;
}
}
}
}
else
{
// fail!
return -1;
}
}
}
int
server_notice (int sock, char *msg)
{
char buf[1024];
snprintf (buf, sizeof (buf), "NOTICE * :%s\r\n", msg);
return write (sock, buf, strlen (buf));
}
int
server_notice_from (int sock, char *msg, char *from)
{
char buf[1024];
snprintf (buf, sizeof (buf), "%s: %s", from, msg);
return server_notice (sock, buf);
}
// assumes we are connected to irc server from router already.
int
relay_client_and_router (int sock, int r_sock)
{
char buf[1024];
char buf1[1024];
fd_set rfds;
int retval;
while (1)
{
FD_ZERO (&rfds);
FD_SET (sock, &rfds);
FD_SET (r_sock, &rfds);
retval = select (1023, &rfds, NULL, NULL, 0);
if (retval)
{
if (FD_ISSET (sock, &rfds))
{
if (readline_from_sock (sock, buf, sizeof (buf)) > 0)
{
write (r_sock, buf, strlen (buf));
strncpy (buf1, buf, sizeof (buf1)); // save last thing sent.we will need this to stop shell echo from IOS.
} // else..
}
if (FD_ISSET (r_sock, &rfds))
{
if (readline_from_sock (r_sock, buf, sizeof (buf)) > 0)
{
if (strcmp (buf, buf1))
write (sock, buf, strlen (buf));
else
{
// printf ("IGNORING IOS ECHO\n");
} // else
}
}
}
}
}
int
rnd1toN (int max)
{
return (rand () % max) + 1;
}
--------------------------------------------------------------------------------
[Wireless Technology Exposed]========================[Vortek <vortek@gmail.com>]
--------------------------------------------------------------------------------
Wireless Technologies Exposed
Security and Specifications demystified
VORTEK
Knowledge is a process of piling up facts; wisdom lies in their
simplification
Martin H. Ficher
Greetings, the purpose of this article is to explain a few things
about wireless. I will not go in depth to the security features of IEEE
802.11 specification families. However, I will cover the basics so you
will understand enough to distinguish between the different
specifications. You will know which to apply based on its level of
security, And hopefully you will have enough knowledge to decide for your
self.
NOTE: I Will assume you know the RAW basics of some things. If you do
not google.com them. This article is not meant to be a novel. Besides you
will learn a thing or two.
Now Grab your favorite beer, wraps or stimulant drink and lets get
started! Grab that shit I'm serous!
The IEEE 802.11 family of specifications are broke down into 4 types. Well
3 officially. We will begin by breaking down the basics of each type and
its features. We will cover its air waves its basic features of speed
range and such. And its basic security.
The first Specification we will start with is older than an unpatched
chinese server. I didn't cover plain 802.11 Because its ANCIENT!
802.11A
This specification operates on the 5GHz band. Which is good because most
of your current house hold phones work on the overcrowded 2.4GHz band. The
downfall to this higher frequency range is its inability to penetrate
walls and obstructions, which can be quit cumbersome. It also carries a
higher cost for its equipment. Let alone its crappy range. Expect to get
a maximum speed of 54 Mbps
Now the A specifaction uses orthogonal frequency division multiplexing
(OFDM). OFDM basically splits radio signals into a lot of smaller
sub-signals, which in turn are transmitted simultaneously to different
frequencies towards the receiver. This reduces some of the crosstalk also.
If you'd like more info on OFDM google it. This is an article not a
novel.
802.11B
This specification operates in the 2.4Ghz band. This means overcrowded,
Don't use close to microwaves or 2.4Ghz Cordless phones. Now this
frequency penetrates walls a heck of a lot easier. Set your channels
right on your Wireless Router and your signal can go 3 floors down. You
also get much more range with B. Now don't expect much speed from this
specification it's only 11 Mbps, But its more of a stable signal. These
products also tend to be cheaper in cost and more widely used.
The 802.11B Specification uses direct sequence spread spectrum (DSSS).
Basically there is a chipping code that uses a redundant bit pattern for
each bit that is transmitted, which in return aids in resistance to
interference. If any of the bits are corrupted the original data will be
recovered due to the redundancy of the transmission. Basically THIS MEANS
ERROR CORRECTING! Want more info google for DSSS.
802.11G
This is nothing more then the best of A and B mixed. It's 2.4Ghz At
54Mbps. It is also backwards compatible with b. G also uses OFDM. Now
there are some routers that go way beyond 54Mbps with Turbo modes, But
why? Your not running a some huge FiberObtic network are you?
802.11 (pre) N We will cover this after the security section which I will
explain later.
Ok the security of these are basically all the same. Crappy WEP and WPA1
which is basically nothing more then what was working from 802.11I at the
time. We all know why WEP is insecure. It breaks the #1 cardinal RULE OF
RC4 NEVER EVER REPEAT THE KEYS.
The problem with WEP is not in RC4 in itself as you can see. The problem
is the idiots who made 802.11 did not specify how IV"s "Initial Vectors"
should be created, also the algorithm is pure crap. WEP uses 24 bits for
its IV value range which as you can see, we could easily use this up with
high volume traffic. This basically means that the same IV will be used
with a different datapacket! "BREAKING THE RC4 Cardinal RULE!" What, you
ask well what if there is no traffic? There are methods to force traffic.
>:) IF you want to know them Read a WEP cracking tutorial. There are
plenty of good ones on google.com. Now just to clarify a few things, You
may wonder what the IV really is. 24-bit values are attached to the
secret key and used in the RC4 cipher stream. The reason we have IVs is to
ensure that the value used as a seed for the RC4 PRNG "Pseudo Random
Number Generator" is always different.
Ok what does all this mean ? I record all your wep traffic until I receive
2 packets that have the same IV aka RC4 keys I can use a XOR function to
link 2 packets and compute the key. In other words Do not use WEP AT ALL.
I don't care how elite your crypto key is.
Ok now lets cover WPA1, Which is basically nothing but a TKIP "Temporal
Key Integrity Protocol" wrapper around wep. For starters this prevents the
repeat attacks that WEP has by extending the IV to 48 bits. And by now we
all know that IV's are used to encrypt the data in the packet. Now TKIP
adds a few security enhancements to wep. The first is Cryptographic
message integrity code (MIC). Which prevents forgery. Its basically a
cryptographic checksum that protects against forgery attacks. The second
feature IV sequencing (TSC) "TKIP Sequence Counter" prevents replaying
of data. Basically if the TSC in the IV better match with in a certain
range when received or the packets are drooped. The 3rd method is the
Per-Packet mixing function. Basically this means that were changing the
encryption key every now and then for the client. It also provides a
message
integrity checker. This method is a little to advanced to cover here..
Now remember boys and girls this is all based on RC4.
Now the good stuff WPA2
WPA2 is a full implementation of certified 802.11I. It uses AES-CCMP
"(AES-C)Gunter Mode (C)BC-(M)AC (P)rotocol" This is also the standard for
the Pre N serious of routers.
WPA2 utilizes many advanced features over WPA1 The #1 feature is AES
(Advanced Encryption Standard) It's basically Military crypto warez.
So no more crappy RC4. It also uses PMK (Pair-wise Master Key) which
allows you to reconnect to your access point if lets say you walked to
another AP and back. "You will not have to re authenticate." Also
Pre-authentication allows you to pre-authenticate to another AP, While
holding your connection to your existing AP. Basically you only need
1/10th of second to change AP's while roaming. Now if you don't use
Pre-authentication with PMK caching It would take more then a second and
some of your time sensitive crap like video, VoIP and other crap will go
FUBAR!
Ok for the other features. For starters we get forced 128 bit keys!!!
h0h0h0h0! Basically every thing else is the same as wpa accept for the AES
standard and PMK. But for you people who want more info.. I will just
post information from the computing dictionary.
Official Computing Dictionary Definition below
AES-Counter Mode CBC-MAC Protocol) The encryption algorithm used in the
802.11i security protocol. It uses the AES block cipher, but restricts the
key length to 128 bits. AES-CCMP incorporates two sophisticated
cryptographic techniques (counter mode and CBC-MAC) and adapts them to
Ethernet frames to provide a robust security protocol between the mobile
client and the access point.
AES itself is a very strong cipher, but counter mode makes it difficult
for an eavesdropper to spot patterns, and the CBC-MAC message integrity
method ensures that messages have not been tampered with. See 802.11i,
AES, counter mode and CBC-MAC.
"IF you want more info on this your really going to have to do a LOT of
reading." There is no point on trying to refine something so short and
true.. Call me a copy cat if you like.
Ok now time for the phat lady to sing! 802.11 (pre-N)
802.11 (pre-N)
This is basically 802.11I with certified WPA2 which in turn is a Full
certified implantation of 802.11I. Now the reason we use pre-n Is because
there is a battle going on in standards. We will not get into that here.
But basically its like what happened in the old days with the 56k modem
standards. Rockwell Vs Us Robotic. Now the advantages to PRE-N are huge.
You get GREAT EXTENDED RANGE. This is achieved by using something called
MIMO (Multiple Input Multiple Output), in which a number of antennas
transmit many unique data streams in the same frequency channel (other
Wi-Fi products transmit data in a single stream in a single channel).
MIMO also uses OFDM. Which you should remember from above. You basically
get 3 antennas. The advantages Are more range less interference and a
funky looking evil router. Oh yeah its backwards compatible with B and G.
Now you know the VERY raw basics of wireless. Well what happens beyond
the GUI in your Wintendo XP Wireless configuration. Be sure to upgrade XP
to support WPA2.
Now lets all go to France And do some war driving, We can hack there
WHITE-FLAG Linux boxes. After One failed login you get root and a system
message of I surrender. I don't hate French people don't worry!
And one last message to all you knew skewl kiddies. READ READ LEARN! And
be glad you can google.com For it was not always this easy to GET
INFORMATION!
Send Hate mail to vortek@gmail.com
h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0..........................................
--------------------------------------------------------------------------------
[Harriet the Spy]======================================[Dreid <dreid@dreid.org>]
--------------------------------------------------------------------------------
Harriet the Spy
===============
What is Harriet the Spy?
------------------------
Harriet the Spy is designed to be a relatively low cost solution for
creating a stationary battery-operated wireless packet capture system.
Yes but what does that mean?
----------------------------
It means that it's a computer, whose only job is packet capture, and
it can be left in one place for an extended period of time, to capture
packets for a specific wireless network or set of wireless networks.
What is it made of?
-------------------
The most basic configuration for Harriet requires a 802.11a or b or g
router that is similar or compatible with the Linksys WRT54G(S) series
of routers, in that it can run an open source linux based firmware.
For my experiments I used a WRT54G version 2 [1], and OpenWRT [2]. It
also includes a battery pack made of 4 1.5v Alkaline batteries.
How to make it.
---------------
The Battery pack.
+++++++++++++++++
The battery pack used will likely fall somewhere in this rough
description no matter what kind of compatible router you get. The
number of batteries you need might vary depending on the actual power
usage of the router. I'm not an electrical engineer but I do know
that most consumer electronics devices do not require the full output
voltage of their DC wall adapters. The WRT54G's for instance has a
power output of 12v DC. But it can on 6v DC without any problem. So
the basic parts list for this part of the project is this:
* 1 DC Size M plug.
* 4 1.5v alkaline batteries.
* 1 battery holder of the same size.
In theory the only thing the cell of the battery would affect in this
case would be runtime. So you could use anything from AA to D. I
chose D for this as I just wanted to see how long I could keep it
running for. The manufacture of this battery pack is very simple and
requires very minimum soldering skill (read: you should know which end
to hold.) Simply take the wires from the battery holder, and solder
them to the positive and negative leads on the DC Size M plug. Insert
the batteries into the holder, and that's all she wrote about
that. You can now power any device which can be sustained on 6v DC.
The Router and OS
+++++++++++++++++
Flashing OpenWRT onto a WRT54G or compatible router is a well
documented process, and can be found here [3]. The client mode
configuration is also well documented and can be found here [4].
When installing kismet you should install the kismet_server package,
and turn off the wireless interface prior to starting it.
The Test
--------
The base test for battery life was to plug in the router, start up
kismet, and then take a voltage reading of each battery under load.
Then after an hour I'd take the readings again, and approximate how
many hours before the batteries were operating at less than 30% capacity.
The initial readings where:
1.31, 1.36, 1.35, 1.34 for a total of 5.36V
After two hours the voltages read:
1.01, 1.08, 1.05, 0.95 for 4.09V
That's a 1.27V difference, if we assume the voltage drop to be linear
then every two hours we would lose 1.27V, with 1.78V being the magical
30% capacity mark. So that's about 6hrs of battery life. Which isn't
too shabby for the cost of production. You could capture a lot of
packets in 6hrs.
Potential Problems and Potential Improvements
---------------------------------------------
So right now Harriet is capable of sitting around, for 6 hours
unattended, and capture packets. Of course since it only has 4mb of
storage if you're using a WRT54G, and 8mb if you're using a GS, it can
only capture so many packets. Especially since atleast 2MB of flash
is being taken up by the OS. However one planned improvement is to
add an SD card [5], which will give up to 2GB of storage, other options
would be adding a USB port and using an IDE storage device. Yet
another option would be using a 802.11b ethernet bridge or usb 802.11b
adapter connected to a nearby network for packet capture (just make
sure you're not capturing that networks packets.)
Another potential problem is that as the batteries lose power, one
could potentially damage the router hardware. This problem could be
overcome by adding a low-power cut-off circuit.
Also the price of D-Cell lead-acid batteries is rather expensive over
time,
and one could find a much more suitable source of power, including
rechargeable NiMH batteries like those used in RC Cars and Airsoft
guns, or even the more expensive though very reliable and long lasting
Li-Poly batteries for the higher end RC vehicles.
Final Thoughts
--------------
All things considered I believe the initial revision of Harriet the
Spy is quite a success, the next steps in it's evolution will be the
abovementioned low-power cut-off circuit, and the addition of an SD
card reader. Then I hope to field test the device in a high traffic
wireless deployment. After that I'll begin experimenting with a
variety of rechargeable and longer lasting battery solutions.
Footnotes
---------
[1] http://www.linksys.com/servlet/Satellite?childpagename=US%2FLayout&packedargs=c%3DL_Product_C2%26cid%3D1124916802645&pagename=Linksys%2FCommon%2FVisitorWrapper
[2] http://www.openwrt.org/
[3] http://wiki.openwrt.org/OpenWrtDocs/Installing
[4] http://wiki.openwrt.org/ClientModeHowto
[5] http://wiki.openwrt.org/OpenWrtDocs/Customizing#head-00b294c0c885db1d544fbfcd48e9367d20b38b5a
--------------------------------------------------------------------------------
[Review of ToorCon]===================================================[overdose]
--------------------------------------------------------------------------------
Overview of Toorcon, San Diego California's premiere Security conference
By OverDose
Well first things first, I went to Toorcon , and the first night was a
sort of meet and greet. There were a lot of people already there, people
that were affiliated with defcon, Layer 1, and a few other conferences I
had attended. There were hors d'oeuvres and an awesome social atmosphere.
There were of course people talking about newer tools and recent
compromises that were public and things that had happened to end users at
the employer.
Saturday was the day that things got swinging, there were 2 tracks of
speakers cleverly name Smoke and Mirrors. The smoke track which is
synonymous to digital security, had several speakers ranging from a BBS (
documentary about BBSes and a MUST WATCH) Q&A to how hackers get caught.
On the other track Mirrors, synonymous with network security and trust,
talks ranged from hacker versus the mobile phone to anonymous
On the other track Mirrors, synonymous with network security and trust,
talks ranged from hacker versus the mobile phone to anonymous
communication for the Dept. of Defense..and you.
Saturday night was awesome, the wonderful people at toorcon had set up a
party for us in the Galileo 101 in downtown San Diego, really close to the
convention center where Toorcon was held. It was a two story bar of
sorts, with DJ's spinning lots of house, lounge, trance, and many other
electronica styles. The drink were good but expensive. Never the less it
was an awesome time to be had by ANY geek who was down for a party.
Sunday Sept 18th, the day that was wrapping up the con, but don't let that
fool you. There were many people still around and having an awesome time,
chatting among each other as well as checking out the Sunday speeches.
Sunday's Smoke track ran from everything from Infrared hacking to a law
enforcement panel, and the Mirrors portion had Running a small hacker
conference panel to the Future of Phishing, it really DID have it all and
then some.
I want to close by saying thanks to h1kari, nfiltr8, geo, phil,SoMe_BoDy,
freshman, arachne, and everyone else that helped put Toorcon together.
You guys did an awesome job. One thing I HAVE To bring up was the lax
environment and the courtesy towards all of the attendees. If anyone has
been to a hacker con, generally you get souvenirs that you must pay for,
generally from a vendor area. This is one area that delightedly Toorcon
differentiates itself, They gave EVERY attendee an official Toorcon shirt
with dates/locations and things of this nature. How cool is it, that
these people appreciate each and every attendee that they would give them
all an awesome souvenir just for attending?
That's all I can say about Toorcon, if you are in the mood for a relaxing
and informative time in the San Diego area, I highly suggest you attend
Toorcon.
--------------------------------------------------------------------------------
[This issues LAMER.log]=====================================[#espionage @ efnet]
--------------------------------------------------------------------------------
1.9 GIGAHERTZ! 1.9 GIGAHERTZ! Yup! This, from the immature guy who went
off on someone and told them to read an RF (radio frequency) book!
ttransien also claims to be an ex l0pht member, but after talking to him
for five minutes it's clear that he's too much of a moron to ever be in
l0pht.
[20:39] <ttransien> lothos
[20:40] <uplink> trans
[20:40] <uplink> you code?
[20:40] <ttransien> wut
[20:40] <ttransien> of course
[20:40] <uplink> I learned C
[20:40] <ttransien> didn't you download myelite software like everyone
else?
[20:40] <lothos> ttransien
[20:40] <uplink> no
[20:40] <ttransien> :-o
[20:40] <uplink> haven't even seen it
[20:40] * uplink sets mode: +vvvv Christ cia darkhmet lothos
[20:40] * uplink sets mode: +vvvv migzy Rav^ v_id |-|acks
[20:40] <lothos> your bluetooth software?
[20:40] <uplink> :O
[20:40] <ttransien> h0h0 mvoice
[20:41] * uplink sets mode: -vvvv playd0h trans ttransien uplink
[20:41] <uplink> we're leet with +O's
[20:41] <uplink> we don't need voiced
[20:41] <uplink> we don't need voices
[20:41] <ttransien> dewd don't play around you'll soon be out of control
[20:41] <uplink> h0h0h
[20:41] <uplink> I gotta go for a sec
[20:41] <uplink> brb
[20:41] <ttransien> you are 17 it is easy to forget things and go out of
control
[20:41] <ttransien> bye >:D<
[20:41] <ttransien> nevermind you are too young to hug that is way gay
[20:45] <uplink> h0h0
[20:58] <ttransien> hi
[20:59] <ttransien> dood if i sit my cell phone by the monitor
[20:59] <ttransien> my monitor flips out right before my ophone rings
[20:59] <lothos> iden is notorious for that
[20:59] <lothos> speakers as well
[20:59] <lothos> and tv
[21:00] <ttransien> 1watt or so at maybe 1.9GHz
[21:00] <ttransien> but 1.9GHz is not the refresh rate of my monitor!
[21:00] <ttransien> and i doubt it's even a harmonic :D
[21:00] <ttransien> so i wonder what's happening
[21:02] <lothos> those are the worst phones as far as radiation
[21:02] <ttransien> i bet it does it if i make a call too
[21:02] <ttransien> let me try
[21:02] <lothos> yup
[21:02] <lothos> and iden works on 800mhz
[21:02] <ttransien> iden?
[21:02] <lothos> 806-866 MHz
[21:02] <lothos> nextel is not gsm
[21:02] <lothos> it is iden
[21:02] <ttransien> why do you think i'm on that freq
[21:03] <lothos> if you have nextel that is your freq
[21:03] <ttransien> dood i'm out of the states right now
[21:03] <ttransien> as previously mentioned
[21:03] <lothos> Integrated Dispatch Enhanced Network
[21:05] <lothos> iden is 800mhz
[21:05] <ttransien> you've mentioned that
[21:05] <lothos> yes
[21:05] <ttransien> however i am not in the united states currently as
mentioned two or three times
[21:05] <lothos> do you have a loaner phone?
[21:05] <ttransien> a business phone
[21:06] <ttransien> belongs to the company
[21:06] <lothos> did they give you a phone to use overseas?
[21:06] <ttransien> no, the phone was already overseas
[21:06] <ttransien> purchased locally
[21:06] <lothos> is that thru nextel?
[21:06] <ttransien> of course not
[21:06] <ttransien> we use the local network
[21:06] <lothos> europe?
[21:06] <ttransien> asia
[21:06] <lothos> 900mhz or 1800mhz then
[21:06] <uplink> yo
[21:06] <uplink> I'm gonna get a 5mbit connection
[21:06] <lothos> not 1.9ghz
[21:07] <ttransien> where do they use 1900
[21:07] <lothos> the usa
[21:07] <lothos> 850/1900 is usa gsm
[21:07] <ttransien> rgr
[21:07] <lothos> i'm guessing you're on 900 mhz from the way it interacts
with the monitor
[21:07] <ttransien> what in the monitor would resonate at 800mhz
[21:07] <lothos> who knows, i just know cellular
[21:08] <ttransien> btw my nextel is gsm; it was advertised as such and i
used it in singaporre
[21:08] <lothos> maybe it is then
[21:08] <ttransien> i have to pay more for my plan
[21:08] <lothos> you should be able to use it in asia then
[21:08] <ttransien> i am getting a call in
[21:08] * Christ (c@220-245-133-132-vic-pppoe.tpgi.com.au) Quit (Ping
timeout: 276 seconds^O)
[21:08] <ttransien> i can see it :D
[21:08] <lothos> unless you're in south korea
[21:08] <lothos> they use cdma not gsm
[21:08] <lothos> or japan
[21:08] <lothos> japan does not use gsm
[21:09] <ttransien> i don't know what bands my phone supports
[21:09] <ttransien> i do have it in a box somewhere i just didn't try
[21:09] * Christ (c@60-240-128-36.tpgi.com.au) has joined #espionage
[21:09] <lothos> what country are you in?
[21:09] <ttransien> i have a locally purchased phone paid for y the
company
[21:09] <ttransien> i am in cyberia :D
[21:14] <ttransien> anyway let's talk until my ride gets here
[21:14] <ttransien> i have nothing else to do
[21:14] <ttransien> entertain me
[21:15] <ttransien> ok i'll begin
[21:15] <ttransien> it is interesting to note that the interference only
occurs before the phone rings
[21:15] <ttransien> which leads me to believe 2 things
[21:15] <ttransien> 1 - the phone ramps down power during negotiation with
the tower
[21:15] <ttransien> 2 - i have a good signal
[21:15] <ttransien> 2 is confirmed by my signal bars on the display
[21:16] <ttransien> uplink would you like to interject an observation at
this point?
[21:17] <ttransien> bbl
[21:17] * ttransien (~transient@get-o.net) Quit (^B[^BBX^B]^B Pretzel Boy
uses BitchX. Shouldn't you?^O)
--------------------------------------------------------------------------------
[/dev/urandom]=========================================[Random Facts and links ]
--------------------------------------------------------------------------------
# The Most Annoying way to make a pop-up, EVER.
http://ha.ckers.org/popup.html
# Make a website not display for people using Internet Explorer:
<?
if (preg_match("/MSIE/i", $_SERVER["HTTP_USER_AGENT"])) {
header("Location: http://www.mozilla.org/products/firefox/");
exit();
};
?>
<html>
<head>
<title>This site will not display in Internet Explorer</title>
</head>
<body>
</body>
</html>
# SMS email gateways for the US cellular providers:
Sprint: 10-digit-number@messaging.sprintpcs.com
Verizon: 10-digit-nmber@vtext.com
AT&T: 10-digit-number@mobile.att.net
T Mobile: 10-digit-number@tmomail.net
Nextel: 10-digit-number@messaging.nextel.com
Cingular: 10-digit-number@mobile.mycingular.net
Alltel: 10-digit-number@message.alltel.com
# Practical Resources for Securing Computers:
http://www.SecureThe.Net
--------------------------------------------------------------------------------
S U B M I T T O K E E N V E R A C I T Y
--------------------------------------------------------------------------------
NO! You do not have to be a member of Legions of the Underground to submit to
KV. If you have a idea and would like to toss it out in the wind for general
discussion, or maybe you are researching something and you just want feedback,
KV is a great way to get your ideas out in the open. We at Legions of the
Underground are not prejudice in any way shape or form, so even a AOLer's
article may be published if it seems that it has clue. Or then again, maybe
hell will freeze over! Anyones stuff maybe published, but we will never
know if you don't submit! So get to writing. Because what you don't know
can kill you! Legions of the Underground is a equal opportunity destroyer
(of systems and great walls alike).
--------------------------------------------------------------------------------
All submissions to: kv@legions.org
--------------------------------------------------------------------------------
IRC: Undernet #legions
--------------------------------------------------------------------------------
O F T E N I M I T A T E D N E V E R D U P L I C A T E D
--------------------------------------------------------------------------------
L E G I O N S O F T H E U N D E R G R O U N D
n :.
E% ___ _______ ___ ___ :"5
z % | | (_______) | | | | :" `
K ": | | | | | | | | | | z R
? %. | | | | | | | | | | :^ J
". ^s | |___ | |___| | | |___| | f :~
'+. #L |_____|[] \_____/[] \_____/[] z" .*
'+ %L z" .~
": '%. .# +
": ^%. .#` +"
#: "n .+` .z"
#: ": z` +"
%: `*L z" z"
*: ^*L z* .+"
"s ^*L z# .*"
#s ^%L z# .*"
#s ^%L z# .r"
#s ^%. u# .r"
#i '%. u# .@"
#s ^%u# .@"
#s x# .*"
x#` .@%.
x#` .d" "%.
xf~ .r" #s "%.
u x*` .r" #s "%. x.
%Mu*` x*" #m. "%zX"
:R(h x* "h..*dN.
u@NM5e#> 7?dMRMh.
z$@M@$#"#" *""*@MM$hL
u@@MM8* "*$M@Mh.
z$RRM8F" [knowledge is key] "N8@M$bL
5`RM$# 'R88f)R
'h.$" #$x*
--------------------------------------------------------------------------------
All mention of LoU, Legions of the Underground, Legions, KV, or Keen Veracity,
copyright (c) 2000-2005 legions.org, all human rights reserved outside the US.
--------------------------------------------------------------------------------
[LoU]=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=[LoU]
W W W . L E G I O N S . O R G
[LoU]=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=[LoU]
