Uncle JP wants you!

Quote:

---

[19:00] <s0nIc> damn.. HDC have their own hackers working 24/7 posting new found exploits and security flaws
[19:00] <s0nIc> how come AO doesnt have any?
[19:00] <s0nIc> lol
[19:00] <RiOtEr> look at the forum
[19:00] <RiOtEr> thats why
[19:01] <s0nIc> lmao
[19:01] <s0nIc> true

---

Yes! Uncle JP and AO wants you! we want your skills and your gifts! We want you to be one of our prized members in AO! We want you to be the pride of AO in the Security Industry!

hmm here's my point.. AO is good.. its great.. its fast paced, and up dated..
but when it comes to dedicated hackers... we're fresh out.

Im just asking if there are any hackers out there.. who would love to post their new found discoveries or works..
AO was a lot more better when i first joined here.. and im sure a lot of members would agree that AO was much better years before.. and now AO's progress is slowing down..

i mean.. already you guys been hearing about members complaining coz our boards are gettin "lame" and i too am sick of hearing about it..
so im asking.. any of you could please contribute your skills to AO..

we need top of the line members to help build the image of this site and so as help the newbies better.

I would love to help but my skills lie in programming, that is what i am in college for. I dont think hardcore hackers(blackhat) like sites like these, i mean sites that try to help new people. I am new so i dont know if this already exist but maybe AO should host war games, once again sorry if they already do. I think that would be a great way to see how many skilled hackers are actually members here. =)

yeah.. im actually looking for people who can post security flaws and show us how to patch them.. hehe
describe to us how the flaw works.. and describe to us how the patch works..

they could mainly be coders but im sure some other skills can be used to find security flaws.. i hope no one misunderstood this post.. im not inviting people to hack/crack or do illegal things..

Eh, you're not? Damn. /me stops hacking launching codes for old USSR nuclear weapons.

No, seriously, I totally agree with you, but like Shake said, I'm not that gifted either. Or, to quote Ace Ventura: "I don't have the powerrr, capt'n!"

message to guus, i sent you a a message apparently asking why you gave me positive points, i did not mean to, i like the green things =) I am just new to the process and i dont know how to assign a certain value to post or how to give other people green anti points =) Sorry to intrude on the post, i just thought id clear that up, thanks guus =)

id love to help but its against my ethics because to many people take the security problems and spread them around for script kiddies and less people patch then get hurt because of it....


sorry guys.... :(

Quote:

---

Originally posted here by Shake
message to guus, i sent you a a message apparently asking why you gave me positive points, i did not mean to, i like the green things =) I am just new to the process and i dont know how to assign a certain value to post or how to give other people green anti points =) Sorry to intrude on the post, i just thought id clear that up, thanks guus =)

---

Yeah, I noticed :) Well, basicly, I found your post more intelligent and constructive than your gray antipoint status reflects, so I gave you some greenies to stimulate you to post posts like this more often. For future reference: these kind of questions are better asked using private messages (PM's) ;)

I must say, I agree with NetSyn... what would do better for AO would be to do group projects, similar to sourceforge projects...

If you encourage people posting exploits on this site, its gonna reflect badly on AO... we will be flooded by the SK's & Lamers...

Now, rather than having people post exploits.... what about the opposite... how about we band together to write patches or programs to tell notify you if you are vulnerable to these exploits... that would be helpful to the community, and would actually serve a real purpose that a 'security site' could stand behind...

or! we can turn AO into a porn site!!!!!!

god knows the internet dont have enough porn ;) lol

Quote:

---

Originally posted here by s0nIc
yeah.. im actually looking for people who can post security flaws and show us how to patch them.. hehe
describe to us how the flaw works.. and describe to us how the patch works..

they could mainly be coders but im sure some other skills can be used to find security flaws.. i hope no one misunderstood this post.. im not inviting people to hack/crack or do illegal things..

---

IMHO. I can see one small problem.. As soon as anybody start to talk about hacking/cracking on a higher level or asks question on the subject, and I do not mean "how to hack hotmail" they all get flamed and negative AP's and the nice reply "This is a security site".

How to learn or teach such security flaws when it's aint allowed at AO to speak about it ?

Great idea, we could all work together as a team and hack porn sites and post our treaures here :D

we can talk about subject as long as we are mature and choose our words carefully

such as instead of "how do i hack hotmail" try "has hotmail ever had a public release on being hacked? or ever haveing a flaw sploited by a "hacker""


just twist ur words in a way that u sound like u dont want to know , but still get them to tell u

Quote:

---

hmm here's my point.. AO is good.. its great.. its fast paced, and up dated..
but when it comes to dedicated hackers... we're fresh out.

---

<lame soapbox rant>
That's because most of the people at AO don't really have much technical knowledge when it comes to exploits and security flaws. I've been around here for a while now, on the forums and IRC, and I haven't met many AO'ers who have had real experience writing in Assembly and low level C (ie. exploit territory). I've met some, but not many. I don't claim to be some sort of exploit guru hacker/coder but I am a reasonable programmer, so I feel I am in a position to comment on this issue. Put it this way: I was a programmer long before I ever had any interest in networks and security.

Like most people at AO, I get annoyed when so-called lamers ask "how do I hack hotmail" type questions. But sometimes I get even more annoyed with the people who reply to these posts when it is obvious that the person replying is just as ignorant as the person who asked the original question.

My point is this:

If you know nothing about the answer to a question is don't flame the person who asked it just because it's the cool thing to do at AO.

A lot of people from other security sites view AO as a message board for wannabe do-gooders. If you don't believe me do some searching around and you'll see what I mean. Older members will know what I'm talking about.
</lame soapbox rant>

Quote:

---

we need top of the line members to help build the image of this site and so as help the newbies better

---

Ok this is going to sound like another AntiPoint bitch but I warned you so... There isn't much chance of people posting their own exploits if all the feedback they get is negative points from half-wits who haven't even touched source code before.

Don't get me wrong, I like the AntiPoint system if only for the fact that it keeps flaming down to a minimum. If you compare the "flame-level" at AO to other sites you'll see that we get off very lightly in the flame department.

But this has come at a price. If a person mentions exploits or hacking in a post, more often than not, they are "booed into submission" with negative points. They're not likely to want to share any more knowledge after treatment like that are they? I don't know what the answer is to this but maybe some other people have ideas?

Quote:

---

AO was a lot more better when i first joined here.. and im sure a lot of members would agree that AO was much better years before.. and now AO's progress is slowing down..

---

JP: The AO public has spoken and the ball is in your court to provide some direction for the masses.

I do concede that JP is trying to organise an AO wargames project which is a big step in the right direction but can more be done? Also, should all the reponsiblity be on JP to make the site better? JP has 24 hours in his day like everyone else. Maybe it's time for others to step up and take some responsiblity.

I will tell you what i think would be pretty cool. AO is supposed to be nearlyunhackable when it comes to security, right? However a person going under the alias n1non did the impossible and hacked AO, Since this flaw that led to the compromise of AO is fixed, or i hope it is anyway, i would like to know how he did it. I am sure that i am not the only curious one? I dont see the harm because this flaw has already been worked out and that method of attacking should no longer be possible, I do not agree with malicious hackers or the damage that they sometimes cause but sometimes i find myself in awe of someone who can hack a website with the reputation that AO has, i mean JP is an expert, one fo the best, has worked with the govt before because of his high level of skill. Yet there was one guy out there who had the knowledge to get passes all of the security, am i the only one who has a certain type and level of respect for people like this? Before you flame me, i dont mean respect because of what he did, i mean respect because unlike so many others, he the skill and the knowledge to accomplish what is almost impossible. I read JP's response and he said that it was 1 in 9 million, that just blows my mind to think that out of 9 million people there was only 1 guy who was good enough to do it. Just something to think about =)

Quote:

---

I will tell you what i think would be pretty cool. AO is supposed to be nearlyunhackable when it comes to security, right? However a person going under the alias n1non did the impossible and hacked AO, Since this flaw that led to the compromise of AO is fixed, or i hope it is anyway, i would like to know how he did it. I am sure that i am not the only curious one? I dont see the harm because this flaw has already been worked out and that method of attacking should no longer be possible, I do not agree with malicious hackers or the damage that they sometimes cause but sometimes i find myself in awe of someone who can hack a website with the reputation that AO has, i mean JP is an expert, one fo the best, has worked with the govt before because of his high level of skill. Yet there was one guy out there who had the knowledge to get passes all of the security, am i the only one who has a certain type and level of respect for people like this? Before you flame me, i dont mean respect because of what he did, i mean respect because unlike so many others, he the skill and the knowledge to accomplish what is almost impossible. I read JP's response and he said that it was 1 in 9 million, that just blows my mind to think that out of 9 million people there was only 1 guy who was good enough to do it. Just something to think about =)

---

I don't know if he was brave or stupid trying to hack AO but, **** yeah, I'd love to know how he did it.

Thank you smirk, i was hoping that the first response i got from that post would be a positive one, when it is negative some people tend to play follow the leader, and trash whoever posted the topic =) I dont think prosecution is likely in hacking a site as high profile as AO, that would get public attention and that is not good. It would look really bad in the news i think, on AO that is. I read somewhere that most buisnesses dont prosecute hackers for the same reason, bad reputation when it comes to security and their buisness that is. As for n1non, the guy must be some kind of genius, in my mind i get the fantasy image of his ina drak room with an evil grin hacking away like it is somekind of movie, sweat rolling of his forehead hehe( i have seen too much tv :D ) in reality the guy was probably munching on some McDonalds while he was doingit, thinking to himself, "oh man this is gonna be soooo cool" Who knows, ya just can never tell these days.

lol well.. my intention is not how to teach people how to hack or something.. my plan is to let people post findings security holes.. programming errors.. and the post better have a patch for the hole found.

i know we do this on AO at present by posting security news found on different sites.. and yes they are reliable information.. but wouldnt it be more reliable if our source are the white hats who found those wholes themselves? wouldnt be better if we know the security issues first hand rather than taking the word of websites (who could be wrong)

but yeah.. thats just my 2c.. i know this idea is risky. coz it is crossing the thin line between security and hacking.. but my intentions are noble.

Smirc has a point.....John has only so many hours in the day. Let's all step up to give him a hand :D.

Well, if anyone is using phpbb2 with the card mod, I discovered this security hole which allows any anonymous user to ban any and every account from the forums, bar admins, and also re-enable any banned users. :(

Greetings:

Well, I've certainly tried to start "Group Projects" but the response has been far less than impressive. It seems that most people in this "community" like taking from it, but aren't big on the "giving back to it" part of things.

For example. MsMittens was nice enough to take charge and start the "AntiOnline Newsletter". However, despite many pleas, we have had hardly ANY articles turned in for the past 2 issues. Oh, we get plenty of posts "I loved it, when's the next one coming out", but MsMitten's PMbox has been empty of "The newsletter is a great idea, here's an article by me to help it along".

I'm investing HUGE amounts of money and time to develop the wargame network, which will be public in the not too distant future. I'm sure litterally thousands of people will sign up to use it.

Take, take, take, take, take, take, take.

*I ask for artcles, I get nothing except "why hasn't the latest issue come out yet!#@!".

*I ask for a small donation to the MDA, I get "you shouldn't be using this site to ask people for money!@#$!" or "I'm on welfare" or "I'm on disability". or my favorite "I'll contribute any way I can to this community, I just can't give money to any charity/person because I can't afford it". Ok, where was your AntiOnline Newsletter Article then Mr. "I help out any way except financially".

Here's another one of my favorites. As you all know, AntiOnline isn't a pay-per-view website. No subscription fees, no membership fees, nothing. As you might also have guess, especially by recent upgrades, I invest a LOT of money into keeping AntiOnline up and running. I mean a LOT of money. So, obviously, I need a way to make that money back. How, you might ask? Well, advertising of course! We work hard to get big-name advertisers interested in our site, so that we can use them to help support the community. Despite all of this, I've seen dozens and dozens of posts, and discussions on IRC, and even e-mails and PMs to me, saying "I really don't care about this ad or that ad, or whatever, because I use an Ad blocker and I don't see any of them!" Great.

Take, take, take, take, take, take, take.

In the past, I've thought about updating the AntiPoints system, or come up with some other system, that will recognize people for contributions to the community. However, I decided that I wasn't going to resort to coming up with ways to "force" people into giving back.

I'm just sitting back, watching things unfold, and hoping that this community, which is a new one, will mature..............

What kinda tutorials are you looking for the next news letter?

Go JP.

SSJVegeta-Sei

I have the best Idea, we could post exploits encryped in Porn pics! A killer combo :)

We need to find l337 hackers on other fourms and convince them to come to AO.

um that probably woulod resulting in the person getting flames and made a fool of, it would be prettyc oool if it could be done though =)

Hmm.. Hopefully I won't get flamed for this, but here goes... I have thought about setting up a forum for those of us who are interested in finding vulnerabilities and either patching them or making them known, but I feel that if we did this we would attract the not so honest people out there that want to gain this info for malicious use. What I propose is a forum that will be only accesible by those of us that have a high number of antipoints, say 300 at least to be able to view or post to the forum. In this forum we could discuss various projects and holes found in programming. I know for one that I am trying to teach myself various programming languages on my own, but without having anything to actually practice it with I'm afraid I will never develope the skills needed.

I recieve various news letters from sans and bugtrac about all the new bugs, holes, etc.. I have thought about posting them but I have not because I don't want the info falling into the "wrong" hands. I think that if we had a forum like the one I proposed I would feel better about posting these holes and discussing them in more detail. I havn't been able to do anything about the holes because I lack the neccesary skills to do so. Although if we had a forum devoted to this type of exploration and discussion and actually did some programming together with others, I know my skills would greatly improve, as well as others. So that is my proposal. I would be very interested in learning more about these holes and patching them. I think we should have a forum to do so without having to be worried about being flamed or worring about them falling into the wrong hands. I would also be more than happy to moderate this forum or be responsible for getting it going.

what do you people think?

I'd love to give my services, but the only way I can hack a comp is with a pic-axe......
I'm gona do a tut on Advanced mIRC stuff, how ever...I am in the Middle of my GCSE's so I barly have time to even post....MrsMittens: U'll get it in a month of so....(Hopefully)
'c'mon ppl..... AO need's us......
- Noia
:D

LMAO at Noia, the comment about the pic axe was funny, i almost spit coke all over my monitor, i am easily amused as you can tell. :biggrinsm

Quote:

---

Although if we had a forum devoted to this type of exploration and discussion and actually did some programming together with others, I know my skills would greatly improve, as well as others. So that is my proposal. I would be very interested in learning more about these holes and patching them. I think we should have a forum to do so without having to be worried about being flamed or worring about them falling into the wrong hands. I would also be more than happy to moderate this forum or be responsible for getting it going. what do you people think?

---

I think your heart's in the right place but, the fact is, no one can teach you how to program. Sure they can help you but nothing is going to help you write , analyse and find exploits for code if you don't put in the years it takes to learn how to program competently. It's the wee hours spent hacking away (in the traditional sense) that make programmers good. I've been programming since I was seven years old and I still don't consider myself good, just reasonable.

JP made a good point:

Quote:

---

Well, I've certainly tried to start "Group Projects" but the response has been far less than impressive. It seems that most people in this "community" like taking from it, but aren't big on the "giving back to it" part of things.

---

Sad but true. We already have everything we need to start an exploits forum or any forum for that matter. We have IRC. JP has provided a centralised forum where like minded individuals (and others) can post stupid messages to each other and squabble over green dots ;). My point is that, if you really want to start this forum, you'd do it anyway, with or without JP's help.

Don't get me wrong xmaddness, the fact that you want to contribute to the community is admirable. More people should be coming forward with offers to devote their time. But is another forum what we really need or just a bit of organisation and motivation?

I see your point.. As for the programming thing I am learning and teaching myself, but if I had something to concentrate my efforts on I would learn much faster. I understand that it takes a while to learn and the only way to learn is by doing it. But up till now i havn't had any projects to focus on. I know the basics of c++ but unless i have some goal to go towards i feel i'm never gunna get anywhere.

The forum I understand what you mean. I guess I'll just try and take some initiative and start trying to patch some holes that have been seen from sans and bugtraq. Once I have hit a stopping point I guess i'll send out what i have done and what walls i've hit out to the group. I think i'm gunna start trying to find a fix for the hole in aim that also malicious code to be sent thru the use of avatars. I'll update you guys when i have something.


Any patches I do create I will post up and give the rights to Antionline.. :)

xmaddness, if you're really worried you could start posting them in the AntiOnline Addicts forum, which will deter many, but still let many who know look at it (once you get enough posts, that is).

As for myself, I haven't done much yet because I haven't reached a point in my learning where I can do much yet, though I'm getting close and should be doing so soon. As for the money JP, I'm working on getting it (have to collect a few debts first).

Quote:

---

Originally posted here by JP
Greetings:
For example. MsMittens was nice enough to take charge and start the "AntiOnline Newsletter". However, despite many pleas, we have had hardly ANY articles turned in for the past 2 issues. Oh, we get plenty of posts "I loved it, when's the next one coming out", but MsMitten's PMbox has been empty of "The newsletter is a great idea, here's an article by me to help it along".

---

Once I've finished my exams (~ 4 weeks from now), there should be one or two articles for MsMittens to consider placing in the newsletter...

Quote:

---

Originally posted here by JP

*I ask for a small donation to the MDA, I get "you shouldn't be using this site to ask people for money!@#$!" or "I'm on welfare" or "I'm on disability". or my favorite "I'll contribute any way I can to this community, I just can't give money to any charity/person because I can't afford it". Ok, where was your AntiOnline Newsletter Article then Mr. "I help out any way except financially".

---

Cheque will hopefully be in the post sometime soon, see what my bank says about it today, as for the article, well it's already written but being edited slightly. :)

Quote:

---

Originally posted here by JP

Here's another one of my favorites. As you all know, AntiOnline isn't a pay-per-view website. No subscription fees, no membership fees, nothing. As you might also have guess, especially by recent upgrades, I invest a LOT of money into keeping AntiOnline up and running. I mean a LOT of money. So, obviously, I need a way to make that money back. How, you might ask? Well, advertising of course! We work hard to get big-name advertisers interested in our site, so that we can use them to help support the community. Despite all of this, I've seen dozens and dozens of posts, and discussions on IRC, and even e-mails and PMs to me, saying "I really don't care about this ad or that ad, or whatever, because I use an Ad blocker and I don't see any of them!" Great.

---

How about some form of text ads, such as those on Google or MetaFilter? These tend to be noticed more than banner ads, especially if they're relevant to your visitors, e.g. in AO's case it would be computer-related products, especially security. An ad which says 'Click here to find out How to Hack Hotmail' would also got a lot of click throughs! ;)

Quote:

---

Originally posted here by JP

In the past, I've thought about updating the AntiPoints system, or come up with some other system, that will recognize people for contributions to the community. However, I decided that I wasn't going to resort to coming up with ways to "force" people into giving back.

I'm just sitting back, watching things unfold, and hoping that this community, which is a new one, will mature..............

---

I'm sure it will. ;)

Quote:

---

Originally posted here by xmaddness
I have thought about setting up a forum for those of us who are interested in finding vulnerabilities and either patching them or making them known, but I feel that if we did this we would attract the not so honest people out there that want to gain this info for malicious use. What I propose is a forum that will be only accesible by those of us that have a high number of antipoints, say 300 at least to be able to view or post to the forum.

---

Good idea (although I haven't got enough antipoints yet to contributing that then;)). You could ask JP to set up a private forum for you with that 300 AP's rule. We already have got private forums 'AntiOnline Addicts' (I wonder what they discuss there about...) and 'Cosmos', so why not a 'Finding and Fixing Exploits' (or similar). I don't think JP could have much against it, could he?

Quote:

---

Originally posted here by xmaddness
Hmm.. Hopefully I won't get flamed for this, but here goes... I have thought about setting up a forum for those of us who are interested in finding vulnerabilities and either patching them or making them known, but I feel that if we did this we would attract the not so honest people out there that want to gain this info for malicious use. What I propose is a forum that will be only accesible by those of us that have a high number of antipoints, say 300 at least to be able to view or post to the forum. In this forum we could discuss various projects and holes found in programming. I know for one that I am trying to teach myself various programming languages on my own, but without having anything to actually practice it with I'm afraid I will never develope the skills needed.

what do you people think?

---

A forum that can only be accessed by members with X amount of AntiPoints is a good idea, and one which has been discussed before, the only problem is that many member's APs tend to fluctuate (e.g. in my case I went from 50 AP to -7, then suddenly shot up to ~300 in the space of four weeks!), so one day you might be able to post in the forum and the next day you might not because someone's given you some neg. AP.

However, I do agree with you on the point that it would be good to have such a forum. How about if it was that if you had ever had 300 AP (at any time), and you currently had over 200 AP, then you could post in the forum. That way, we could get rid of all the idiots who post stupid comments, yet not deny access to anyone who makes sensible suggestions yet has received some neg. AP from someone who doesn't agree with them.

hmm... I have something in mind but should I post it for the newsletter or at the forum?

JP > You need to understand that certain ppl are also bussy with other things...
like where is Ennis? I'm going to have MA exams pretty soon myself and I'm sure other ppl also have 'similar activities'... However what you are saying is right.

I think the idea of a restricted forum for this kind of advanced knowledge is a good idea....as much as I hate restricted forums it would prevent a negative element from disrupting what happens in the setting...

Instead of using Anti-Points or posting ranks, how about using date signed on. Alot of the best AO posters that I respect have less than 200 (the old guy, firefemme etc.), but they have been around for a while now...if you made a 4 week or maybe a 8 week probationary period before they can access these special areas...

Just a thought...

I agree with JCM spammers can rack up large post amounts in no time at all.

Firstly, shake, i've noticed how you are posting mindlessly in this thread. Please stop.
Secondly, we all know JP puts alot of time and effort into this site, and all of us would like to put back into this site too, but we just need to find our interest. For example, atm i am trying to start up something in the Web development forum. I'm sure people who specialise in cryptography, honeypots, security holes, security events etc etc are in this community, but we just haven't grabbed their attention yet.
And yes JP, i think if you really need people to put back into this community, [#attach.flame.proof.suit] then you gotta force them in some way to do it. Other wise we'll just keep getting script kiddies who wanna download the programs, and mindless posters who just wanna reach the status of antionline member. But at the same time you need to keep it to the Open source/GPL theme, and keep it free in a way.
Well there's my 5 cents (3 more than the usual)
Cheers!
:D

I use an Ad blocker and I don't see any of them!" Great.

Take, take, take, take, take, take, take.


Good point i will never do ad blocking again at AO

I will click on the ads!

u kick ppl out who know more than the moderators, i aint doin nothin for AO, as ao does nothin for me.