I sit down at the gate waiting for my flight to arrive, and I've got plenty of time. I pull out the laptop and connect to the internet using my CDMA USB card, and plonk away chatting with the folks on IRC (at irc.freenode.net #pauldotcom). A gentleman in his forties sits down two seats away from me, and also pops open this laptop, and he proceeds to connect to the t-mobile wireless network.

Now, I know what you are thinking! No, I didn't decide to own him via wireless, or sniff his traffic or any of those type of attacks. It was better than that:

The gentleman was presented with the T-mobile captive portal to subscribe for an account for access. Out comes his wad of cash and credit cards in the money clip on to the seat between us. Out of the stack comes the AMEX, and he types in the required info. Fail. Sigh. Retype. Fail. Even bigger sigh. Now the cell phone comes out, and I look over. I can clearly read the numbers, first and last name on the card sitting on the seat next to me. So technically, he's owned. But there is a snag; apparently his card has expired! Out comes his phone to call his wife, and apparently he has the main number, and has to ask to be transferred.

"Hello, may I speak to Carol please?" "This is her husband." "Thank you."

"Hi honey! I'm at the airport and trying to get on the internet, but it won't take my AMEX. I think it is expired." "Do you have your new one with you?" "Ok, can you read me the numbers?"

"Let me read them back to you: XXXX..."

"And the number on the back?" "YYY?" "Good."

Now through my powers of observation, I have a first and last name, and AMEX number with CVV code. All I'm missing is the billing address, which I bet Google would have found for me with a few clicks. Some more unscrupulous places won't even care that I don't have it, or that it doesn't match...

Credit card fraud, no computer needed.

Here's the lesson: If you are going to read sensitive numbers over the phone or back to the person, do so in private. Heck, go somewhere out of the way in the airport, take your bags, and pack up your laptop, and even write it down. Seems like common sense to me.

- L

But, what I did do was take some inspiration from last year's attempt at a "shmooball launcher". Given my involvement with potato cannons, I figured this one would be a slam dunk, and infinitely better than the leafblower from last year's closing ceremonies.

So here's a sneak preview of my version during the dry fit stage. I've completeley glued and done some low pressure testing. I've got a few issues to resolve, but nothing major.

Josh, I'll see you at your presentation. I promise not to aim for your junks.

- L

See you at Shmoocon!]]> tag:www.haxorthematrix.com,2008://1.508 2008-01-11T14:33:05Z 2008-01-11T14:33:10Z

• Stay Sharp: Defeating Rogue Access Points North Kingstown, RI Wednesday, July 25, 2007, 8:30 AM - 11:30 AM

• Stay Sharp: Google Hacking and Defense North Kingstown, RI Wednesday, August 29, 2007, 8:30 AM - 11:30 AM

• SEC535 Embedded Device Hacking, SANS NS 2007, Las Vegas, Friday, September 28, 2007 : 9am - 5pm (Includes a WRT54GL Wireless Router!), Instructor: Paul Asadoorian

Hope to see you there! ]]> tag:www.haxorthematrix.com,2007://1.506 2007-06-18T23:45:14Z 2007-06-18T23:45:16Z

Oracle has just released 101 patches. Yes, I said one hundred and one. Now I understand that they only release patches once a quarter, which in my mind only compounds this problem. Even at a monthly rate (like Microsoft), that pushing 30+ patches a month.

What DBA can evaluate 101 patches a quarter (or 30 in a month)? That is a huge amount of data to evaluate, test appropriately , and then deploy of hours. You do evaluate and test your patches before you put them in your production environment, right?

Now, I don't want to bash Oracle for releasing too many patches (although, woah, 101?), because I believe if you have a vulnerability (and can patch it) you should release the patch. However, how well written is Oracle it they have to release 101 patches at a whack?

The short of it: Oracle's patching strategy is a mess. I feel sorry for any Oracle DBA right about now.

Now, I don't have kids yet, there is no reason for me to think about how I'd handle these things with my kids. I guess I'm some kind of weirdo to think about how I'll communicate with my kids in 10 years about internet predators.

In any case, the IMsafer seems to strike a balance that I would consider something reasonable for a parent and a child (assuming of course that it works). Apparently IMsafer monitors the IM conversations and only alerts the parents about parts of a conversation that might be suspect. That would be something that I'd be happy with as a parent. It would also allow the children to have private conversations about other topics without the parental knowledge, and that would work for me as a parent too.

I'm all about not pandering to children, and I believe that they should be treated like small adults. To those ends I think IMsafer works for me in those manners. Of course, healthy two way discussions with the offspring about internet predators and such is also a good course of action.

I'd live to hear more technical bits on the product. I'd especially like to know how many perverts that it took for the company and law enforcement to compile the metrics that it took to determine “you’re a good girl” is indicative of the building of a sub/dom relationship.

The folks over at PandaLabs have found that spammers are now beginning to include subliminal messages in the spam messages. The research is indicating that spammers are placing "BUY" in the messages for 10 to 40 milliseconds. Possibly with some sort of animated .gif? Hmmm....

It is good to see that spammers are learning from history, and are using some methods that have been shown to work (if they didn't why to advertisers still use them - look closely in those ice cubes in advertisements).

We should use those techniques for good! In the setup CDs for wireless routers, put subliminal messages such as "USE WPA2", and set corporate desktop background images to cycle "CHANGE PASSWORD", "STOP PLAYING GAMES" and "WATCH PORN AT HOME, NOT AT WORK". I could think of a thousand different messages that would make my job easer...

- L

New spam technique uses subliminal messages to manipulate users

I did cross post this a few days ago over at PaulDotCom, but I did want to preserve it for posterity here. This is also a great test of my migration to my Mac, so that I can now do this from anywhere. Expect more from me now!

Paul and I spent some time a few weeks back trying to get Karma working on my new Ubuntu 6.06 LTS installation. Needless to say we ran into a few problems with the MadWifi-old kernel modules.

For those not in the know, Karma is a great piece of software for demonstrating how insecure open wireless networks are, as well as illustrating problems that can be had by auto probing for insecure wireless networks. Karma uses a patch for the Madwifi-old drivers to answer for ANY open SSID request, and can perform a number of actions - DNS, DHCP as well as HTTP content redirection. The usefulness of such a tool is quite apparent, especially when delivering a demo to those management-types who like pretty pictures. We'll be releasing a video segment of PaulDotCom security Weekly of Karma in the next few weeks.

Paul and I spent a few hours trying to figure out why my installation didn't work, and I proceeded to spend several weeks scouring the internet looking for help to little avail.

I was able to put some of my research to good use, and certainly provided me the right direction. After all of this research I figured that I was not the only one in this predicament. As a result I've documented the steps that I have completed to make Karma work for me under Ubuntu with Madwifi-old. I'd like to release said documentation, so that you can learn from my experiences:

http://www.pauldotcom.com/KarmaUbuntu.pdf

I would certainly consider this a living document. Please, any and all comments and suggestions are greatly appreciated and should be directed to larry@pauldotcom.com

Enjoy, and may Karma be good to you!

- Larry

I've unfortunately been very busy, and on vacation over the last few weeks, not to mention that my wife and I are dealing with some very trying medical issues.  That being said,  I'm making some changes that will allow me to be more active in posting here and at PaulDotCom as well, however those changes will take me a little bit more time to accomplish.   My problem is I take on too many projects, and then get projects handed to me on top of that - both personal and work related.  Heck, my lawn hasn't even been mowed since BEFORE I went to BlackHat/Defcon.

So, that is my excuse.

I promise more good stuff coming.  In fact, I'm going to be writing up my experiences with installing and using madwifi-old, Karma and airpwn under Ubuntu 6.06 LTS, just as soon as I manage to get it working.

Thanks for sticking with me.

- L

- L

T.W.A.T Episode 124: Bluecasing

Backup, what's that?

Now, I agree the DSL guy is in the wrong.  I'm also as guilty as the next guy about backing stuff up.  However, I make damned sure I make multiple copies of my really important stuff.  I maen, it really isn't that hard, or expensive - I just picked up three 500gig drives (yes, 1.5 terabytes) and external enclosures for under $500 USD. 

Given the alleged value of the material, isn't a few bucks for a backup copy a good investment.  Just think, today it was the DSL guy, but tomorrow or the day after it could be hardware failure, electrical surge, fire, intercontinental ballistic misslles.  Isn't a few bucks that worth your piece of mind, and your livelyhood? 

- L

If You Have Something Worth Millions, Shouldn't You Back It Up?