OpenBSD 6.5 released early

A few days late posting this, but OpenBSD 6.5 hit the wire last week, ahead of the May 1 target release date. Our OpenBSD Web Server Guide -- using the built-in httpd -- has been updated. And the PHP-FPM quirks from OpenBSD 6.4 got ironed out.

As far as installation and daily use go, you probably won't notice much has changed in OpenBSD 6.5. There was a ton of work done in areas of hardware support and network-stack enhancements.

If your console supports it, you may notice a new default console font (called "Spleen"). I've seen this on my OpenBSD-Current laptop for a few months. At first, I didn't really like it, but it's quite readable and has grown on me when working in text-only mode. I'm considering setting it as my default xterm font as well.

If you use OpenBSD-CURRENT with snapshots, however, there's already some fun stuff unfolding there, with sysupgrade(8) among them. This makes in-place upgrades a breeze. While it's not available in OpenBSD 6.5, upgrading from one release to the next should get a lot easier in about a year's time. The 6.6 to 6.7 upgrade will be the first supported release with this tool, unless they backport it to 6.5 with an errata/patch -- unlikely, indeed...

Here's our new sysupgrade utility in action: a fully unattended snapshot upgrade with just one command. https://t.co/wRF8jlHvA6 pic.twitter.com/NVOO9yHTns

— OpenBSD (@openbsd) April 26, 2019

Fraud and Identity Theft are not "Hacking"

[H]ard|OCP: Hacker gets record 13-year sentence for hacking.

Originally a haven for hardware hackers looking for advice on extreme overclocking, system cooling, gaming, and case modifications, you'd figure [H]ard|OCP would "get it", wouldn't you? At least one front page contributor doesn't.

I'm not one of the hopefuls that really thinks society will ever ditch its stigma against "the H word" but this story strikes several nerves for me, and continuing to sensationalize "hacking" like this is only part of it.

Max Butler (now known as Max Vision) got a whopper of a sentence, but it wasn't for "hacking," it was for multiple counts of wire fraud, identity theft, and transfer of stolen identity data. While Max undoubtedly had the mindset of a hacker for most of his life, his ethics (I'll get to that in a moment) made him a criminal. Although he was obviously brilliant and capable as a hacker, Max abused his skills to become a carder, a con man, and a low-life, deceptive criminal. Those are the things that got him into trouble. Criminals with little technical skill get busted for the same things.

More disturbing, though, is how Max came to the center of this vast arena of identity theft. With a troubled past, he emerged as a skilled security consultant with a bit of a naughty streak -- a habit that would get him thrown into the slammer (for computer fraud) after breaching government and military networks with a clever tool that would patch a well-known hole while leaving a back-door for him to use later. This is the kind disruptive mischief that used to be associated with "cyber criminals" years ago, putting him in the same arena as Robert Morris, Adrian "The Homeless Hacker" Lamo , and MafiaBoy, to an extent.

During this 18-month stay in the pokey, he would befriend the hardened career criminals who would eventually conspire with him to create genuine financial havoc, on par with the destructive forces of those responsible for the TJX and Heartland breaches.

What do I make of it? I'm not entirely sure. It's hard telling if Max Vision would have found collaborators outside of prison and ended up on the same path, or whether prison life genuinely corrupted him. I do know, however, that no one gets arrested for "hacking."

Previously.

2600 Article: Roll Your Own Hive-Mind

Editorial comment: This initially showed up in the Autumn 2009 issue of 2600: The Hacker Quarterly,Volume 26 Number 3, which is on stands now! I wrote it almost a year ago. Today, I would say that Google Reader's new options make it a very important part of my personal hive-mind, allowing me to crowd-source my news by hand-picking a relatively small group of people who reliably share and comment on things that I find pertinent, urgent or fascinating -- often near real-time. At the time of writing, sharing with people in Google Reader wasn't nearly as intuitive so it got a lot less play. In the past few months, though, it has grown up to become far more than just an online RSS aggregator and a web filter evasion tool to me.

While I don't feel like this is my best work, I do make a habit of publishing all of my printed articles here after they've hit the newsstand.

There's no doubt that social networking is all the rage on the Internet these days. Places like MySpace and Facebook have become ubiquitous social hubs that start out as a circle of your real-life friends. Eventually, others join in that you've probably never met and might never meet in your lifetime. Your reasons for befriending them may be many: interesting photos or content, similar interests, or simply because they're a friend of a friend (of a friend of a friend). Maybe, you just like to compete in the popularity contest to see how many e-friends you can collect.

LinkedIn has a business focus. Maybe that's where you keep all of your professional contacts or hunt for job opportunities. Brightkite is a location-aware microblog with photo hosting ability; Like Twitter on steroids. Maybe that's how you find out who hangs out at your favorite local places to try to find new friends. Friendfeed can aggregate most content from your other social network accounts. Maybe that's where you go to get your 50,000 foot view of your online social sphere.

What if you wanted to craft a specialized hive-mind, though? I'm interested in security, and I've found that online, quite a few security geeks have blogs, twitter accounts, facebook profiles and the like.

Instead of just looking for your existing friends online, you can leverage microblogging services like Twitter to find and follow like-minded strangers. Obviously, self-described social media addicts have no problem finding their cliques, but everyone from World of Warcraft Gamers to Bacon-lovers can find a niche in most social networks. Security nerds like me have SecurityTwits.

The people you follow will frequently ask or answer questions of other folks. You can follow them as well, and pretty soon you end up with a news-feed of data you're interested in. Assuming enough of them follow you back, you will have a powerful hive mind at your fingertips: This collective will give input on ideas from within itself. It will refine, disprove, or validate answers given to questions within the collective. It will link to fascinating content elsewhere on the web that other members might not otherwise find. It will challenge you to participate by giving as much as you get.

I've found that this hive-mind functionality works best on lightweight services like the aforementioned Twitter, or with link-sharing tools like Delicious, Digg, and Google Reader. Facebook and MySpace are far too cumbersome and broad-sweeping in their content to be used efficiently. Plus, most of the services I mentioned have easy-to-use RSS feeds that can be indexed, processed, aggregated, and searched later.

Of course, if you want people in your niche to acknowledge your existence on these social networks, you need to establish your presence with relevant content that's as equally interesting to them as their content is to you. Jumping onto Twitter and following every single member of SecurityTwits, for example, won't immediately integrate you into the hive. By lurking, however, you can learn a lot.

Smugness in the face of malware

So you've probably read it everywhere by now: Google's Safebrowsing API got a case of the hiccups and started marking the entire Internet as harmful. Ryan Naraine was all over this like a monkey on a football this morning, and his post on Zero Day was the first report I saw of it.

As for me, though? I was sitting smug, not worrying too much. Others may have feared that their computer or browser had been compromised. I was pretty sure (okay, after a few test searches and hitting some of my own sites) that it wasn't a problem on my end, or a problem with the web content on most sites, either.

<fanboy><smug>
I'm running FireFox 3 with NoScript (and now RequestPolicy) on top of OpenBSD. What could I possibly browse that would harm my computer?
</smug></fanboy>

And yes, I am aware that there are still things out there that could probably do something bad somehow, but the odds are pretty slim.

R.I.P. Security Bloggers Network (for now)

Alan Shimel just reported that Feedburner networks are going the way of the Dodo, and the beloved Security Bloggers Network RSS feed on FeedBurner is no more.

For those who don't know what SBN was, it was a huge RSS feed with some great security blogs all rolled into one. Drop it into Google Reader or something, and you were all set. HiR just recently got on board. Too bad it had to happen this way.

Don't worry, though. Shimel assures us that there will be another, comparable spliced RSS feed coming soon. Until then, if you were watching the Security Bloggers Network, you might want to start hunting down links for your favorite reads. If you have some favorite information security sites, feel free to post links to them, or a link to an OPML file.

Weekly Technolust! Hak.5 Joins Revision3

Our buddies over at Hak.5 have some celebrating to do. It's confirmed that Darren Kitchen is going to start cranking up the Technolust with the help of Revision3, according to a press release issued this afternoon

The hints have been in the air for a while now. When I drove out to destroy my windshield hang out with Darren, it sounded like there might be something going on with Rev3. Going from monthly production to weekly is a huge step. I know I'll be sure to tune in! With Hak.5's wits and the production and distribution skills of Revision3, I really don't see how this partnership will be anything less than a home run.

Congrats, guys!

Post-DefCon

Wow. I'm still on the mend from the crazy weekend. Even though it's already Tuesday, I lived through today with a serious case of the Mondays. The arid environment in Las Vegas combined with lack of proper water intake, lack of sleep, lack of food, excess of alcohol consumption and some travel woes really put a damper on my week so far.

All that said, I come home from DefCon with a renewed passion for security, a huge list of new contacts that I hope to keep in touch with, and a pile of notes, schwag, books, CDs and DVDs I have to wade through eventually.

At the end of my airport post last Thursday, I made a reference to an article I was writing in regards to smuggling lockpicks in my carry-on luggage. Also, I've been promising the guys at i-Hacked that I'd be willing to write some stuff for their site on occasion.

I delivered on both promises yesterday with my first i-Hacked guest post: Sneaking Lockpicks past the TSA in carry-on luggage. Within half a day, it already got the attention of Security Monkey and was posted on IT Toolbox. Then, it got submitted to Digg, although it's still a far cry away from hitting the front page. Feel free to Digg it up. Today, Network Security Podcaster/Blogger Martin McKeay posted his own take on getting lockpicks back home safely and his technique (used last year coming home from ShmooCon) is pretty similar to the one I came up with. I guess I wasn't expecting this much buzz about it.

In other news: while at DefCon, I was talking to Jur1st. He's the founder of Cowtown Computer Congress, a group that is striving to unite all the small yet talented cliques of hackers, geeks, and user-group-goers in Kansas City. Meetings are held every Thursday. More info can be found on their site. The current big project is establishing a hackerspace in Kansas City. Hackerspaces are buildings that members can use for user group meetings, collaborative projects, lab testing and social events. Every hackerspace is unique to suit the needs of its patrons, so it should be interesting to see how this one plays out.

I find it fascinating that the 2600 meeting that most of the HiR guys have attended since the mid-90s (I've attended regularly since '93) actually has a little bit of stigma attached to it. Our little "splinter cell" (as other Kansas Citians are calling us) has remained consistently small for the last 5 or 6 years, with 5 religiously regular Attendees (Frogman, Asmodian X, c0g, Dan and myself) and as many as 5 visitors per meeting who we see infrequently. Average age is mid-30s but only because c0g is fucking up our average. :P

I'm pretty stoked to start taking part in the Congress. There's actually a lot of talent in KC. We're just too jaded and cliquey to see the others. I really hope CCCKC fixes that.

I promise to start posting some details on the talks I went to as soon as I start feeling more like a human.

H.D. Moore: Punk't, not pwned.

Oh, how we love drama, and there's plenty of drama in the world of information security.

As you've probably figured out by now, Dan Kaminsky's report of a DNS static source port bug (and the simple exploitation of the same) has fueled a considerable source of recent controversy and drama. Shortly after details hit the security blogs, H.D. Moore (author of Metasploit) and |)ruid put together some checks for the vulnerability. Even yesterday, he released a third Metasploit plugin to check between two different DNS servers in an attempt to detect poisoning.

A few days ago, HD stumbled across a DNS server "in the wild" which had been poisoned to redirect all Google traffic to a batch of rogue sites meant to monetize google ads by automatically clicking them in hidden iframes. After discussing this DNS server in the wild with a reporter for IDG News Service, the reporter went on to write a piece (which is not worth linking to) blatantly stating that BreakingPoint Systems (where H.D. serves as Director of Security Research) was "owned", when there was no such pwnage.

A second article was published which clarified some points, but the original article is being linked to like mad on some social news sites, and it hasn't been edited yet as of the time of writing here.

For H.D.'s side of the story, check out his post on the Metasploit Blog.