Irongeek

Hey, I'm the author of the talk, but I'm not the one who posted this. I'll give you some context :) It's the slides from a talk I gave yesterday at Derbycon - https://www.derbycon.com. It was recorded, but it doesn't look like the recording is up just yet - it will be on http://irongeek.com in the next couple days (and maybe tweeted from @irongeek_adc sooner - he's already posted a few videos from talks later than mine, but I was in kind of a weird room). Anyway, this talk doesn't really have anything to do with DNSSEC. These attacks would work just fine with or without DNSSEC. It's simply abusing DNS the way DNS was supposed to work. And finally, I'll definitely be posting more information (releasing the tool, the video, etc) on my own twitter account - @iagox86.

If you haven't seen it yet, HD Moore did a great presentation on scanning at DerbyCon 2012. Video is avaiilable here: http://www.irongeek.com/i.php?page=videos/derbycon2/1-1-2-hd-moore-the…

Persistence inside the WMI database is fun. There was a good talk about this at DerbyCon[0] years ago. I think it has gotten more press since several APT groups were using it but it still isn't a well-known persistence mechanism. [0] https://www.irongeek.com/i.php?page=videos/derbycon5/break-me12-whymi-…

Counter: if you support Unicode, you also support homoglyph attacks. https://www.irongeek.com/homoglyph-attack-generator.php The real sad is that there's nearly no defense against this, other than scanning codepage of all text you see. At least punycode is available for domain names in URL bar if turned on.

maybe there's a way to include those words like "bl0ckchain" and "crypt0" or even similar looking cyrillic letters eg: сrʏpto ʙloϲkchain from https://www.irongeek.com/homoglyph-attack-generator.php

This doesn’t apply to folks who want contacts for what’s in their profile, but: sometimes you’d like employers to know what relevant adjacent skills you have, without recruiters hitting them as search terms. For that purpose, I masked all of my software terms like “java” from my EE profile with homoglyphs: humans can read them, but they don’t match search terms. I used this site: http://www.irongeek.com/homoglyph-attack-generator.php?decoded=develop… This is an example: ѕoftwаrе looks like “software” to humans, but I’ve pulled from Cyrillic characters, so the ascii codes don’t match. I cut down my spam by about 80% instantly. (One weird trick!)

There are a lot of homoglyph url tricks. It turns out there are even online attack generators for these, so you can see for yourself: https://www.irongeek.com/homoglyph-attack-generator.php https://adlinkurl.com/blog/2-homoglyph-url-spoofer

ｂestbuy.com < homograph domain resolves apparently to the right domain. Here is a generator you can fiddle with http://www.irongeek.com/homoglyph-attack-generator.php Maybe you can find one.

I bought MikroTik for the netflow feature, which can reveal active malware via hardware packet counters by endpoint.[0] The next cheapest router with netflow is in the thousands of dollars. MikroTik is $180 at Amazon. [0] http://www.irongeek.com/i.php?page=videos/houseccon2015/t302-the-fox-i…

Video: http://www.irongeek.com/i.php?page=videos/bsidessf2016/bsidessf-101-th…

Perhaps he was using ettercap: http://www.irongeek.com/i.php?page=security/ettercapfilter

Really interesting finds you got, thanks so much for sharing. I currently run 6 Kippo honeypots scattered across the USA (one at home on a Pi and the rest on cheap VPS). I see a lot of driving drunk at the shell as well. I can't count how many times that I've seen uname misspelled... I haven't seen bitcoin just yet, but I expect that'll show up eventually. Shameless plug (sorry), I just did a talk on some of my Kippo honeypot findings. Some here may find it interesting: http://www.irongeek.com/i.php?page=videos/grrcon2014/s06-bringing-pwne…

Url changed from http://www.irongeek.com/i.php?page=videos/bsideslasvegas2014/bg09-inva… which points to this.

Setting I2P up on the RPi then setting ssh up to listen on a I2P hidden service on the RPi would be better than the method shown. That way if the device is discovered it would be impossible to trace back the actual IP address of the person connecting to it and an adversary obtaining your ssh key wont be able to log into any of your servers. Check out this presentation from DerbyCon about using a cheap NAS to do something similar: http://www.youtube.com/watch?v=dxdm86r26Co Irongeek has a writeup about the same thing here: http://www.irongeek.com/i.php?page=security/svartkast-pogoplug-dropbox and some instructions to do it specifically on an RPi: http://www.irongeek.com/i.php?page=security/raspberry-pi-i2p-svartkast

Better link: http://www.irongeek.com/i.php?page=videos/derbycon2/4-2-1-christopher-…

I remember that iron geek has a few talks about this, and specifically about different ways to leak information in a darknet, usually protocols that dont respect what the browser is trying to accomplish, and depending how your tor traffic is setup (browser plugin), may lead someone directly to you. Anyway, here's his fairly simple php script: http://www.irongeek.com/i.php?page=security/detect-tor-exit-node-in-ph…

HD Moore (creator of metasploit) had a talk about doing something like this. He scanned all of IPv4 hitting common TCP and UDP ports, and collected data about the services running. He found a lot of cool stuff. For instance, there are apparently 7 Windows NT 3.5.1 boxes with SNMP open sitting on the internet. And about 300 IIS servers that give out the same session ID cookie when you log on. The visualizations are also really nice. The talk is here: http://www.irongeek.com/i.php?page=videos/derbycon2/1-1-2-hd-moore-the…

They can't sue him, they wouldn't have a leg to stand on. Why not? I've been clicking around various US laws and have yet to see any mention about a login screen or "Go away, private!" messages being required before it counts as unauthorized access: http://www.irongeek.com/i.php?page=computerlaws/state-hacking-laws

Should have read better, and realized that IronGeek might have played a role. http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keyst…

Yes. http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keyst… Plug it in, makes the OS think it's a keyboard while the user thinks it's a USB stick.

Adrian Crenshaw a.k.a Irongeek has already done something like this using the Teensy ( http://www.pjrc.com/teensy/ ) programmable usb device. The upside is it is programmable either using C or the Arduino dev environment. It costs under $20 and can be made to look much more unobtrusive than a phone. Combine this with some good social engineering and you have yourself a dangerous penetration testing tool. For more info check out Adrian's writeup http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keyst…

I'm assuming you're talking about pen-testing and not programming specifically. If that's the case, check out irongeek.com. He has some good tutorials. http://irongeek.com/i.php?page=security/hackingillustrated Also, you might want to consider watching some of the presentations from defcon 15. http://www.roysac.com/blog/2007/09/defcon-15-session-and-panel-videos.… I hope that helps.

This is about ten years old: http://www.irongeek.com/downloads/hpnt.c

This brings back good memories from High School. Here's a bunch of things we used to do: 1. Set fun messages on all the HP Printers: https://www.irongeek.com/i.php?page=security/jetdirecthack 2. Bypass firewall restrictions by setting http:// to https:// (later had to resort to SSH tunneling using Putty). Got me banned from our library for a month when I was on Facebook and a teacher passed by. 3. Our student directory set a cookie to a 6 digit identifier in the cookie. We could access any student's grades and details by just setting it to another ID, or looking at their lunch card. 4. During finals we wouldn't be allowed to see our grades until after all the finals were submitted into our grading portal. Somebody picked up on the fact that if you stop the page load before it finished that the grades would show up. Using JS to block our grades after they loaded didn't stop even the least technical people. 5. Some of our labs had monitoring software to make sure we were working. We could just kill that process and they would lose access. 6. Invert MacOS screen colors using Control + Option + Command + 8. Teachers didn't know how to recover from this and would resort to restoring the entire Mac. 7. CTRL + ALT + Down to flip the Windows screens. Again caused issues for a lot of people who didn't know this shortcut. What a bunch of troublemakers we were...

> ... because back then Unicode was still a pipe dream in the mind of some visionary. Everything used 8 bit encoding, and everyone assumed ASCII or at least something compatible with the 7 bit subset of ASCII. They could still have been case sensitive (C was), so I don't understand how that's relevant to the idea that "case insensitivity is a problem". > Rust, Go, Swift, Python All of these languages impose ASCII for their keywords and directives. They allow you to use other characters for identifiers, but impose ascii in everything that has pre-defined semantics. Original APL is the only "real"/practical language that I'm aware of that gave up the "western centric view" of the world to the point that it doesn't have a single English keyword. (Brianfuck, etc. exist as well, but ....) And they all impose a left-to-right reading order, which is just as western-centric. Arabic/Farsi/Hebrew go right-to-left, and there are languages that can also go top-to-bottom. I think the outrage about "western centrism" is misguided. This is a formal system, and just like math, it reflects some history by using latin letters and left-to-right for the predefined symbols, and even preferred use of latin characters in identifiers. > Nim itself supports UTF-8 "letters" in identifiers, and what is "upper case" or "lower case" 100% depends from the current locale. If that's true, that may be a problem. I'll look into that, thanks for pointing out - from memory, Nim only folds the lower…

There's a reason why I've not included my email address in my HN profile. I'll keep the discussion here. :) So, if you check the truecrypt manpage [0] (or the code in that GH repo that you linked to) you'll see the presence of the --mount-options option. This allows you to pass along any and all options to mount(8) that you wish to pass along... including nosuid. The problem you're describing isn't in TrueCrypt the crypto software, it's in its mount(8) wrapper code. TC behaves as block device encryption software, with a wrapper around mount(8) to handle volume mounting, if you want to also mount those volumes. The wrapper around mount behaves exactly as it should... which is that its defaults are the same defaults as mount, and it provides you options (through --mount-options) to change those defaults, by passing those options to mount. Any other behavior would violate expectations and, thus be grossly incorrect. If you're concerned about others passing you a backdoor flagged with the suid bit, then the TrueCrypt authors gave you a method to mount all TC volumes with the nosuid option set by default. (And, if you're really concerned about the scenario that you outlined, you need a wrapper around mount, anyway, as ALL filesystems that support suid-flagged binaries are "vulnerable" to this "attack".) TC doesn't need to be changed because of this. :) [0] http://www.irongeek.com/i.php?page=backtrack-3-man/truecrypt