Oh noes! They be stealin' our garage doors! (Misc)

A few things:

First, Cowtown Computer Congress finally got blueprints of the building our hacker space will be located in. That's good news. The bad news? The awesome garage door we thought we'd have might be on the chopping block according to the blueprint -- as shown below the lolrus (which is actually a huge seal since it doesn't have tusks) Not cool. We're gonna try to have them leave the garage door.

Also, CCCKC will be thowing a "build it for them to throw it" party on Nov. 22, a few days before the Plaza Lighting Ceremony. This event for CCCKC members will get a bunch of geeks together to build LED Throwies.  The plan is to use the throwies for the fund-raiser on the 26th. What better time of year to lob magnetized LEDs at things than the official kick-off of Kansas City's Holiday Season? Become a member of CCCKC, come out and help us build some throwies, and then kick it with all of us at the next fund raiser.

Last but not least, I posted a fun project over at i-Hacked today.  Not many people knew that my RJ45 cuff links at DefCon were actually functional ethernet loopback testers. I walk you through the steps to build your own ethernet loopback tester that you can keep on your keychain or use as cuff links (if you make two). Photos below:

OpenBSD 4.4 is hitting the mirrors now!

OpenBSD 4.4 is scheduled to be officially released November 1, 2008 (that would be tomorrow as of writing). It's already on some of the FTP mirror sites, though.

I am installing this TONIGHT. I may try Ubuntu Intrepid Ibex that was released this week as well, but I'm really more excited about OpenBSD. I'm a little bit of a fanboy, if you can't tell.

The Geek 100 Pt. 4: Development and Cryptography

See the whole series: The Geek 100

This is a list of 100 basic things and skills every geek should have. I've broken this series up into five parts. Let's face it: a list of 100 things would be tedious to wade through. Over the rest of the week, look for twenty more skills to show up daily. The skills assume you have done it in the past and can remember how to do it right now (or, like a good Geek, you've jotted it down in one of your notebooks). Having it in your personal notebook is okay. Scrambling to the Internet means you don't have the skill... yet.

Props to my friend Joshua Kriegshauser for help with the Software Development skills. I'm not a coder. He's the Technical Director of the EverQuest II team at SCEA. That makes him more than qualified to help me out here.

Software Development. Every geek should be able to:

1. Competently program in a compiled language
2. Competently program in a script-interpreted language
3. Create dynamic web pages that are resistant to XSS, CSRF and Injection
4. Display at least casual knowledge of assembly language
5. Describe endianness and which endians are used on popular platforms
6. Have a firm understanding of object oriented programming
7. Integrate a captcha into a web form
8. Reverse-engineer and debug software
9. Use a hex editor
10. Use a revision-control system

Cryptography. Every geek should be able to:

1. Analyze a substitution cipher
2. Encrypt and tunnel arbitrary traffic
3. Explain both strengths and weaknesses of asymmetric encryption
4. Explain the significance of hash functions
5. Explain Enigma (Fun Link)
6. Implement a quick, secure symmetric cipher algorithm
7. Implement steganography
8. Set up full-drive-encryption
9. Set up SSH with public keys
10. Use an effective manual encryption scheme
    

See the whole series: The Geek 100

The Geek 100 Pt. 3: Attack and Defense

See the whole series: The Geek 100

This is a list of 100 basic things and skills every geek should have. I've broken this series up into five parts. Let's face it: a list of 100 things would be tedious to wade through. Over the rest of the week, look for twenty more skills to show up daily. The skills assume you have done it in the past and can remember how to do it right now (or, like a good Geek, you've jotted it down in one of your notebooks). Having it in your personal notebook is okay. Scrambling to the Internet means you don't have the skill. Yet...

Today, I focus more on physical security and infosec. Let's see how well you do!

Attack. Every geek should be able to:

1. ARP-poison a network segment
2. Bypass the Windows XP login screen without rebooting
3. Crack WEP
4. Enumerate all hosts and running services on a network
5. Identify the weakest point in almost any security scheme
   
6. Replay a TCP session
7. Scan for wireless networks
8. Spoof/Change your MAC address
9. Use a password cracking tool
10. Use lockpicking tools to open an inexpensive lock

Defense. Every geek should be able to:

1. Harden an operating system
   
2. Implement an IDS
3. Install burglar alarm sensors (motion, breakage, window, door)
   
4. Install CCTV cameras
5. Know where to find information on Common Vulnerabilities and Exposures
   
6. Lock down a wireless network
7. Re-key a lock cylinder
8. Set up a log analysis tool
9. Set up a packet filter or firewall
10. Set up a VPN (not just an SSH tunnel)
    

See the whole series: The Geek 100

The Geek 100 Pt. 2: Sysadmin and Network Skills

See the whole series: The Geek 100

This is a list of 100 basic things and skills every geek should have. I've broken this series up into five parts. Let's face it: a list of 100 things would be tedious to wade through. Over the rest of the week, look for twenty more skills to show up daily. The skills assume you have done it in the past and can remember how to do it right now (or, like a good Geek, you've jotted it down in one of your notebooks). Having it in your personal notebook is okay. Scrambling to the Internet means you don't have the skill. Yet...

This one is for all your Information Technology geeks, although it's a bit UNIX biased.

Systems Administration. All geeks should be able to:

1. Compile a kernel
2. Set up a file/print server that works across most operating systems
3. Set up RAID on a server
   
4. Set up an AMP server
5. Set up an Internet mail server that won't get RBL'd
   
6. Set up an RDBMS
7. Use a Logical Volume Manager
8. Use find with xargs
9. Use sed and awk effectively
10. Use sysctl
    

Networking. No, not Social Networking. All geeks should be able to:

1. Explain the difference between PAT, NAT and a DMZ
2. Flash new firmware to routers and switches
3. Make an ethernet crossover cable
4. Run cable through walls without tearing them up
5. Set up port security on a network switch
6. Terminate a fiber optic cable by hand
7. Terminate a punch-down patch panel
8. Terminate category 5 cable with RJ-45 plugs
9. Trace cables
10. Use a network sniffer or protocol analyzer

See the whole series: The Geek 100

The Geek 100 Pt. 1: Possessions and Lifestyle Skills

See the whole series: The Geek 100

This is a list of 100 basic things and skills every geek should have. I've broken this series up into five parts. Let's face it: a list of 100 things would be tedious to wade through. Over the rest of the week, look for twenty more skills to show up daily. I've listed possessions first. The rest of the series focuses on skills and knowledge. The skills assume you have done it in the past and can remember how to do it right now (or, like a good Geek, you've jotted it down in one of your notebooks). Having it in your personal notebook is okay. Scrambling to the Internet means you don't have the skill. Yet...

This is just a fun, arbitrary list I came up with mostly on my own but with some help just in case I was missing any skills I didn't even know I was missing. I'll give credit where due. Don't think I just took 100 things about myself and built up a geek paradigm from it. Most likely, you won't have all of these. I know I don't. The lucky ones will have a good chunk of these covered, though.

Possessions. Every geek should have:

1. A citizen-band radio
2. A computer that's incapable of running MS-DOS 6.0 natively
3. A graphing calculator
4. A notebook of tricks, tips, and things you don't want to forget how to do
5. A weapon that fires (relatively) harmless foam projectiles
6. An HTTP proxy
7. Action figures
8. An acoustic coupler, TDD, or acoustic modem
9. An obsolete video game console
10. Off-site backup storage

Lifestyle Skills. Every geek should be able to:

1. Convincingly perform a magic trick or card trick
2. Brew French-pressed coffee
3. Play a musical instrument
4. Point out discrepancies in movies that feature "hacking"
5. Recite a significant number of lines from at least one Anime movie
6. Scam free drinks from noobs at the bar (or at the lemonade stand if you're <21)>
7. Social engineer your way out of trouble
8. Speak a foreign language
9. Start a large, powerful bonfire
10. Use wordplay

See the whole series: The Geek 100

Twitter Terrorism?

Oh REALLY?

Could Twitter become terrorists' newest killer app? A draft Army intelligence report, making its way through spy circles, thinks the miniature messaging software could be used as an effective tool for coordinating militant attacks.

For years, American analysts have been concerned that militants would take advantage of commercial hardware and software to help plan and carry out their strikes. Everything from online games to remote-controlled toys to social network sites to garage door openers has been fingered as possible tools for mayhem.

I've written about Twitter As A Threat before, but this is completely different. The US is still looking for tools the terrorists are using (you know, like the ONE time that someone tried to slip explosives by the security checkpoints in a pair of shoes?) and not finding anything but the dumbest, sloppiest and most ham-fisted terrorists. Check this out, and try to refrain from falling out of your chair in laughter:

Scenario 1: Terrorist operative “A” uses Twitter with… a cell phone camera/video function to send back messages, and to receive messages, from the rest of his [group]... Other members of his [group] receive near real time updates (similar to the movement updates that were sent by activists at the RNC) on how, where, and the number of troops that are moving in order to conduct an ambush.

Scenario 2: Terrorist operative “A” has a mobile phone for Tweet messaging and for taking images. Operative “A” also has a separate mobile phone that is actually an explosive device and/or a suicide vest for remote detonation. Terrorist operative “B” has the detonator and a mobile to view “A’s” Tweets and images. This may allow ”B” to select the precise moment of remote detonation based on near real time movement and imagery that is being sent by “A.”

Scenario 3: Cyber Terrorist operative “A” finds U.S. [soldier] Smith’s Twitter account. Operative “A” joins Smith’s Tweets and begins to elicit information from Smith. This information is then used for… identity theft, hacking, and/or physical [attacks]. This scenario… has already been discussed for other social networking sites, such as My Space and/or Face Book.

Wait! Terrorists are on MySpace and Facebook now, too?!

Look, guys. We get it: Terrorists communicate. Terrorists can communicate the same way other people communicate. What's next? "Terrorists might drive cars?" Looks like we'd better beware of anyone found driving a Toyota. Seriously, how much money do we have to waste on reports like this, which state the obvious while putting a sensational movie-plot spin on things?