Jump to content

CAN you hak this?


deathshead023
 Share

Recommended Posts

hello everybody,

  hi , im a fan of hak. 5.  I've watched most of the episodes.  I found them really educational and have gained a lot of knowledge on computer security from it. 

  By the way in one of those episodes, Darren Kitchen mentioned something about if you want to test how secure you are, go post your ip address into irc or forums, if i remember correctly.  Well this guy from another forum says that he is fully secure because he uses NAT and is behind a firewall and said he doesnt have a single M$ security patch installed.  So i remembered what Darren said on that episode.  So i figured i give it a try to post his ip address here.  The guy posted it himself on the other forum site and challenge to get himself tested.  so good luck to anybody who wishes to try!

this is his ip address :  127.0.0.1

this is that forum site, u can see for yourselves http://www.istorya.net/forums/index.php/to...html#msg3053573

Link to comment
Share on other sites

No, no we can't. That was basically an off hand comment to be taken in jest. If you want to do it yourself, just use nmap to find out what services are accessible. Since he is behind NAT I doubt there will be any that you can talk to. Now, this doesn't mean he is safe, it just means that an attack would have to take a different vector. Since you can't connect to him due to NAT, you have to trick him into running something that will connect to you.

Link to comment
Share on other sites

No, no we can't. That was basically an off hand comment to be taken in jest. If you want to do it yourself, just use nmap to find out what services are accessible. Since he is behind NAT I doubt there will be any that you can talk to. Now, this doesn't mean he is safe, it just means that an attack would have to take a different vector. Since you can't connect to him due to NAT, you have to trick him into running something that will connect to you.

Well there are other ways.

Link to comment
Share on other sites

well im here so that i could find out. thats the reason i posted the question. i just completely disagree that he says he doesnt need any M$ patch at all because it didnt seem to work for him in the past. and that he is completely secure without them. well what if the malicous code execution was done in one of his unpatched machines inside his local network? would his NAT and firewall set up defend againts all of those attacks? see, the guy is preaching a bad habbit by telling stories to people who might have lesser knowledge in security that he doesnt have to patch at all and its ok as long as u are behind a NAT and firewall. come on guys. any of you can agree with me? if any of you can do me a favor and join that other forum and teach that guy a lesson. that be real nice.

here is that forum addressa gain http://www.istorya.net/forums/index.php/to...html#msg3053573

thanks guys

Link to comment
Share on other sites

The guy is using what looks like a Philippine ISP and a DSL account. He may have his own router at home, but from my experience with DSL, your also connected to a router/gateway directly through your DSL account that usually has remote access enabled, and these things are almost never secureed properly. Almost all of the ones I have seen have the default passwords in place. If you wanted to do anything, cut him off from his DSL router and you do not need to hack him, as he will not be able to connect to the internet at all.

Getting his DSL gateways address is a whole other story though...

Link to comment
Share on other sites

hello everybody,

  hi , im a fan of hak. 5.  I've watched most of the episodes.  I found them really educational and have gained a lot of knowledge on computer security from it. 

  By the way in one of those episodes, Darren Kitchen mentioned something about if you want to test how secure you are, go post your ip address into irc or forums, if i remember correctly.  Well this guy from another forum says that he is fully secure because he uses NAT and is behind a firewall and said he doesnt have a single M$ security patch installed.  So i remembered what Darren said on that episode.  So i figured i give it a try to post his ip address here.  The guy posted it himself on the other forum site and challenge to get himself tested.  so good luck to anybody who wishes to try!

this is his ip address :  127.0.0.1

this is that forum site, u can see for yourselves http://www.istorya.net/forums/index.php/to...html#msg3053573

For the record, you do realize what that IP address is don't you?

Google Loopback.

Edit: NM, I see the IP was moderated.

Link to comment
Share on other sites

Google Loopback.

Edit: NM, I see the IP was moderated.

Yeah, it was changed, but 127.0.0.1 is not a google loopback. It's "localhost", or home. In otherwords, its yourself.

Link to comment
Share on other sites

Its like living in a castle but having no guards. First time something gets passed the wall your screwed.

I would say it's more like a castle (although windows is arguably secure as a shed) with guards and the gates closed, but his the od stone block missing from the wall.

Link to comment
Share on other sites

Its like living in a castle but having no guards. First time something gets passed the wall your screwed.

I would say it's more like a castle (although windows is arguably secure as a shed) with guards and the gates closed, but his the od stone block missing from the wall.

Whereas Ubuntu is like a house where all the furniture is stuck to the ceiling... sure, it's fully furnished, but unless you know how to defy gravity it's completely useless. :D

Link to comment
Share on other sites

Google Loopback.

Edit: NM, I see the IP was moderated.

Yeah, it was changed, but 127.0.0.1 is not a google loopback. It's "localhost", or home. In otherwords, its yourself.

I didn't mean it was a loopback for Google. I was telling him to Google the term Loopback.

Sorry, should have been more precise.

Link to comment
Share on other sites

Whereas Ubuntu is like a house where all the furniture is stuck to the ceiling... sure, it's fully furnished, but unless you know how to defy gravity it's completely useless. :D

QFE!

And I wouldn't say that Ubuntu is more secure, just less people looking for exploits.  Microsoft hires some of the best software engineers and PEN testers, if anything windows is more secure, but no one bothers with linux.

Link to comment
Share on other sites

Whereas Ubuntu is like a house where all the furniture is stuck to the ceiling... sure, it's fully furnished, but unless you know how to defy gravity it's completely useless. :D

QFE!

And I wouldn't say that Ubuntu is more secure, just less people looking for exploits.  Microsoft hires some of the best software engineers and PEN testers, if anything windows is more secure, but no one bothers with linux.

Are you high? Windows is fundamentally insecure, they try but unless they implement a root/user like system you are just going to have issues. Vista has improved security but every non tech guy I know turn off all the warnings and even the tech guys turn them off.

Link to comment
Share on other sites

Problem is people do not know how to setup XP properly and use it's built in controls. It is just as secure as any system except they do not turn on all the controls the way Vista does. Minus the UAC that vista has.

There are tools in XP to create user groups and what they have access to just like in Linux. Most people do not implement it in XP unless in a locked down corporate environment. There are options to restrict Active-x, downlaods, USB and CDrom media installs, etc. There ar eplenty of things IN xp that work the same way they do in *nix environments, only, the user has to learn where to go and how to turn them all on.

In something like Ubuntu, SUDO is your default security precaution from install and you can't logon as root, so by default it may seem more secure, but this is just because they do this be default. Vista's UAC is similar, only it still lets you click OK, which is just time consuming and not the best implementation. They should require a password for certain functions, but instead they went lazy with UAC for just about everthing. (I personally hate Vista, but anyway).

Windows XP (and vista, 2000/NT based systems) can be set to block the user from any number of things in the same manner as any *nix system only they are just not turned on by the install in the same manner as most *nix installations.

Open "secpol.msc" and you can set most of the security settings here. Also check "compmgmt.msc" for your users and groups and misc settings. And you can further restrict access to things using Group Policies: "gpedit.msc"

Link to comment
Share on other sites

And I wouldn't say that Ubuntu is more secure, just less people looking for exploits.

http://www.ubuntu.com/usn

All advisories are usually accompanied by updates which are automatically distributed by the repositories shortly afters their posting.

I didn't say that no one was looking for exploits, just less people.  Which even you Sparda (poster boy for Ubuntu), can admit is true.

Link to comment
Share on other sites

I didn't say that no one was looking for exploits, just less people.  Which even you Sparda (poster boy for Ubuntu), can admit is true.

Of all Linux bistros Ubuntu has to be one of the biggest targets because (this might take a while):

Ubuntu is 'the easiest' Linux to setup a simple LAMP server with (as such, people who want a simple server with minimal effort  and minimal knowledge will use it). Additionally, Ubuntu does not automatically update it's self by default and the server distribution makes no tempt to inform users that there are updates.

The result been that a LAMP server run in a consumer ISP IP block will (eventually) be likely to be dominated by Ubuntu. A remote code injection exploit would be rather valuable, and a infected Linux system would be even harder to spot then  infected windows system from a "I have a web server that works, don't care about it as long as it doesn't brake" mentality.

Such target ability does (or will) put allot of pressure on chronicle to respond (better then Microsoft, but not many people could response much worse, except, may be, Oracle).

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...