Brak710
-
Posts
10 -
Joined
-
Last visited
Posts posted by Brak710
-
-
If you ever wonder why school networks are pathetic and insecure, it's exactly this mentality of "the rules protect it, leave it alone." Your meaningless "acceptable use policy" will be worthless when someone finds a way past the firewall or through a public-facing service on the network. Once that's breached, well... Hopefully there isn't any Windows Domain permission issues on the confidential files... Hopefully.
My highschool had this exact same issue with the administration. They had an AUP and acted like that was the network security, and 2 weeks into the year I handed them the Horde mail server on a DVD. Needless to say, they I eventually helped them move to a new email system. There were so many poor practices and policies we ended up reformatting and reinstalling all the servers since no one cared about security on the initial installs. This place handled student information, payment information, and occasionally credit-card data. Pathetic. I assume there never was a major breach from the outside, but we'd have no idea since there was no logging or anything of the nature that was usable.
...That and they don't pay anything for anyone good to stick around, but that's another topic.
-
I was so much of thinking about hacking. More or less tricking it into seeing me as a subscriber.
You would need to be able to trick Verizon's routers into thinking you're on the network, not possible unless you find a flaw in enterprise routing hardware.
-
So I was browsing some of the apps on the 360 and I noticed the Verizon fios app doesn't authenticate via a regular username / password. The only way I can think of it to authenticate is via ip address. I am on Comcast network so obviously its not gonna work. So I got my head running and was thinking of ways to trick it into thinking i was able to view it. I have Verizon for my cell phone service and use the 3g mobile hotspot. idea? Why not connect it to my cell phone and see if it sees I am on Verizon's network and allow me to view it. No go. Still said I needed Verizon Fios to use the app. I have yet to try this but what if I setup my network so it pipes the Xbox traffic through a proxy that is hosting on Verizon's fios network and see if it would authenticate? I have yet to try it but its worth a shot. Does anyone else have any ideas about it. I know Comcast is rolling out their own app but its all on demand programming and it would be awesome to watch live TV on my Xbox as my office does not have cable TV that's worth anything. Just the basic channels. i was also gonna try to sniff the packets and see what goes through the network while trying to authenticate and see if there is anything in plain view. Just another stab in the dark I guess.
If it's anything like FiOS's VOD system, it's an internal (to Verizon) routing system. This is also how you can see your internet speed jump above normal rates when streaming VOD, it's because it's a completely different gateway/router than the normal internet traffic.
I think "hacking" the 360 App is impossible in the normal sense since unless you're on a FiOS line, you don't even have a route to get to the video servers.
-
NOT Multi-Threaded???? it would be pretty piss poor if that were the case! you might be referring to the client and not the server.
tbh, if you can get the 10 computers for $50 and dont mind putting some grunt into getting them running, I'm pretty sure there are some fun things you can do with them.
(ps I'm currently working on clustering a group of 4 i5 2500K with 8Gbs ram... got the PXE boot working at the weekend :D )
The minecraft server jar is not multi-threaded. Even third-party (now first-party, I guess).jars like Bukkit server are barely mulch-threaded, and only addons can spawn their own threads. The server itself is single threaded.
I have been a minecraft server op for a long time, and I host a large server myself. I assure you, it's piss poor.
-
Protocol exists for a reason. Bypassing protocol is a sign of laziness. Playing by the rules and working the system to your advantage has a far greater reward than just doing whatever you want and hoping you get something beneficial out of it. The world doesn't work that way. Case and point.
I really have no idea what you're talking about. You're upset a minor found a gaping security flaw and reported it to what he felt was the authority in control. This has nothing to do with protocols and rewards. As far as I'm concerned, the student followed the "protocol" assumed in a school environment.
You're more than welcome to think how the world works, but I'll tell you someone is always going to think of a better way a better and more efficent way to do something. You can either accept that or become irrelevant. This kid reported the problem. Talk with him, thank him, and fix the problem.
-
Fairly new to clustering, I am in a position to where I can get lot of 10 PC's for about $50.
Want to see if it would be possible to cluster A server for a game called minecraft, I also want to ramdisk this java game.
is this possible?
Minecraft is not multithreaded. Running it on a cluster is either impossible or not worth it. Even if it could, you'd need some fast interconnects to make it even sustainable.
Your best bet is getting a Core2Quad with 8GB RAM and trying that. Will save you more money long term, anyways.
-
I have one response, and it is a resounding NO. You do not praise a minor for bypassing protocols and taking matters into their own hands when it is clearly not their job nor their business. I would have praised him if he had went to the IT department with his findings (instead of parading the feat around and showing his teacher). Plus from what it looks like to me like no one has gotten the kid to reenact this exploit so the administrators can fix the issue.
Ive been this kid, and i made the choice I described and was asked by the IT department to help them. Being the good kid isn't as fun when you first look at it, but it pays out much more.
You're completely out of it. Telling a teacher is the SAME thing as telling the IT department. Had he just shown this off to friends, I could see you point. But here? No, you're wrong.
I work for a HUGE company. We work on single servers and databases that cost more than the building the OPs school and everything in it is worth. I assure you, if someone in house - employee/visitor/janitorial-services/whatever - finds an issue, they are endlessly praised for bringing it up. One mistake could be a billion dollar nightmare. You know those stories about a big company losing a laptop and releasing some customer data? Hah, yeah right, we got hacked and we're saving face because people are less worried about jacked laptops than a hack/breach. Actually losing a laptop is immediate termination on the spot here. No one ever gets fired after these "stories", that's awfully convenient. It would have been 10x nicer if someone caught this before anyone outside even knew about our issue.
Security is quite frankly THE most important thing for us, and it should be for everyone else. You're upset a student saw "confidential" information about a school? That's cute. The day we I walk in and all our client/patient data has been taken I might as well just turn around and go home - that's game-over.
I'm not saying what the OP is doing is worthless and irrelevant, I'm just saying proper handling of breaches is a necessity at any level of IT. If you don't take it seriously and handle it properly, you're going to get burned. You don't want ANYONE fearing mentioning a possible hole for fear of punishment. If you feel the kid didn't handle the knowledge properly at first, simply add a professional sounding "Next time you find another hole, let me know as soon as you can, I really like being able to have you help us out on this as early as possible."
You have the opportunity to just ask the kid what he did, and move on knowing the solution. It might be an eye-opening discussion with this kid that makes you have a completely new view on a certain attack vector and how things like these could be more easily detected earlier.
Don't fall into "You do not praise a minor for bypassing protocols and taking matters into their own hands when it is clearly not their job nor their business" type thinking. You'll be replaced by someone more open minded and willing to do it for 10% less in the IT world. For all you know, your replacement is the kid you're trying to suppress.
-
Reading over things again, you clearly have no idea what happened. Therefore, you can't even be sure that something DID happen. Like I said, talk to the student, you're lucky you have the ability to contact your "hacker." Right now you're on a wild goose chase because even if you find a hole, you'll never know if it was the right one.
-
How about just ask the student how and thank him for bringing it to the schools attention?
Don't screw up some kid who clearly has a liking for IT Security. If he has done nothing nefarious, you better not allow him to get ANYTHING but praise.
Java Cluster Minecraft
in Business and Enterprise IT
Posted
I'm almost certain that is garbage collection by the JVM, as that can be threaded.
Fire up a server and watch what happens to the CPU graphs. I can even show you graphs of my boxes... 1-100% used, 101-400% practically idle.