Self preservation

Alright, me and a friend both have spare boxes. Were setting up a VPN connection between us and starting to get into some war games with each other for bragging rites (war games as in exploiting each others machines, bragging, then explaining how it was done. This is all being done internally and we both know the other person is doing this. Now my question to you gurus and other bored members is. If I were to ask some security related questions from an offencive perspective would I get negged for it? I would google and do my own research so my questions wouldn't be "how do I hack named" but more precise. Any thoughts?

You're a newbie in term of the site so it's certainly more difficult for you to ask these sorts of questions without getting negged.

Just be detailed I suppose, what you are doing, the exploit you are planning to use and the information you've gained on your own from google/bugtraq etc.

And don't ask how to hack hotmail, not for a while anyway:D

Might be worth recording what you are doing and in the future you could post a wargames tut.

#1 - why should site memebrs believe you that you will only use this knowledge to attack your "buddy"?

#2 - what is to stop any 3rd party by from reading your posts and replies and gathering that information to attack other peopl?

you will be better serverd if you stay around the forum, make yourself useful, help others, make some friends with the gurus and then maybe converse in private on attack methods.

Personally, I see nothing wrong with doing wargames and encourage you to do so. I like the suggestion that Aspman has put forward -- it would be interesting to see what you discovered worked and didn't work as well as what things you would do to improve the wargames experience.

I'm a firm believer in full disclosure in that you should understand how an attack feels and how it is done if are to better defend against it. (much like an immune system knowing what a germ is like -- our society is too germ-free these days). A lot of it, however, does boil down to some responsibility. Those lovely words -- "If you choose to do this for illegal reasons, you're on your own" -- are ones that you may need to pepper your posts with. :D

Best of luck.

Hi ech0,

The problem is, as rowdy mentioned, that any information posted on the forums can be used by OTHER people as well...people who may not have the same intentions as yourself...

my advice is to get yourself known...then invite people to a conference room where you can discuss this matter in private.

Eg ;)

Quote:

---

The problem is, as rowdy mentioned, that any information posted on the forums can be used by OTHER people as well...people who may not have the same intentions as yourself...

---

So, an ethical ponderance/Devil's Advocate for you: if I posted instructions on how to drive a car and someone uses that to mow down someone else (eg., think of the shows COPS, CSI, Law and Order, etc. and what they show regularly), then I shouldn't post instructions on how to drive because someone could potentially use it for illegal purposes (even if I warn that people should take precautions and drive within the limits of the law)??

Hi MsM,

Not the same thing...now if you were to compare hacking to instructions on how to build a bomb...I still say it's better done in private and not in an open forum.

Eg ;)

EDIT: I'm not saying it shouldn't be discussed...just that it should be done responsibly, in such a way as to protect people from harm.
I'm assuming that was the intent of these conference rooms...to discuss potentially sensitive or private matters.
I would not teach a 10 year old or a criminal how to build a bomb...so why should we teach them how to hack?

And how would anyone know that those in the private discussion are in fact as ethical as they claim?

Hi MsM,

You can't really know...so it's an individual judgment call...still...it's best done in private where it will do the least harm.

Eg ;)

Quote:

---

it's best done in private where it will do the least harm.

---

Well, to each their own. Personally, I think the greater risk is the lack of education to those that need to know (e.g., other admins). As I like to paraphrase Ignorance is bliss but it ain't no defense.

Hi MsM,

I understand your philosophy...however...I do not think that applying privacy to these issues would compromise education in the least...and I do not believe that not providing public access to this type of information would in any way prevent people from obtaining the information through other means...

it's a question of personal responsibility...can I stop a kid from hacking hotmail or a kid from blowing up his locker at school? NO.
But I can prevent him from obtaining those tools to do so from ME...I do not have to contribute to his deliquency...or the deliquency of others by accepting a policy that all information regardless of it's potential for harm should be exposed to all-comers.

The education can still be made available...and the conference rooms provide the best vehicle...while maintaining a semblance of social concern.

In my opinion it's a question of social responsibility.

Eg ;)

They wouldnt MsM..but if someone's willing to go to the extent of putting in a lot of time and effort into getting to know people and digging around,they've probably got a good shot at unearthing the information from elsewhere as well.It just might serve as a method to discourage the occasional(or not)script kiddie that comes along...point..if someone's willing to devote time and effort into this,they'll find out in one way or the other,what we can try to do though is make the littlest bit more sure that we arent handing them over to loose cannons so to speak..
At least,I think it's supposed to work like that?
On the whole,I'm not advocating security by obscurity in any way..we can all see where it's gotten Billy Gates and his band of not-so-merry men.I'm saying we give them a little nudge now and then.(I remember being a right ass when I first got here..I'm not so much of one now,old habits die hard though:P)..instead of just handing them the whole platter though..why not just give them hints?(toss them a bite if you will lol)

Cheers

Quote:

---

Originally posted here by MsMittens
And how would anyone know that those in the private discussion are in fact as ethical as they claim?

---

Because my halo is clearly visible ;)


O
Steve

::angel2:: <--- and yer wings? :D

Well,

I am a great believer in ass covering :D

"Educational purposes only" disclaimers are pretty lame these days.I am not too sure how they would stand up against a well lawyered-up "victim", particularly a large corporation. Not too well I would imagine?.............and I certainly don't have the time or funds to find out :eek:

Obviouly a lot would depend on your local laws in that situation.

My thoughts would be to:

1. Demonstrate that the information is in the public domain.
2. Publish the countermeasures recommended.

At least then you can play your "I am being victimised" and "You are incompetent" cards, neither of which are liked by large corporates?


:)

Agreed nihil,but wouldnt there be a possibility that you've just supplied someone with a gun and a bullet proof vest?:D

Quote:

---

Agreed nihil,but wouldnt there be a possibility that you've just supplied someone with a gun and a bullet proof vest?

---

Sure, but I would rather face a court with that, than with having just provided the gun. :D

My defence being that they could find the attack information elsewhere, and I have provided the defence. That would seem a reasonably balanced approach for a security site?

And it is my best offering to the thread title of "self-preservation" not only for the original poster, but also for the site's reputation? ;)

Lol,well said..though I'm inclined to think one of your 'well-lawyered victims' might still say that you've helped the attacker's cause,though the argument does become weaker:)
I wonder if the OP's banging his head on the wall yet,half of all this hasn't been directly related to his post:D

Hi ech0,

See...it's not just a question of whether or not people will assist your ' war games '...there's more involved than that.
It's a question of doing the right thing and how to go about it in everyone's best interest...
so...
even if we believe you have no ulterior or malicious intent...it's becomes a question of how do we provide you with this information without compromising someone else's security or the reputation of this site as being a responsible security site rather than just a hacker forum.

nihil's suggestion of providing the answer/response would help in open forums...provided the ' victim ' ever reads that post, is a member of this site, or even knows that the solution can be found here...more than likely though the ' victim ' will be a noob and will not be able to defend himself or rectify it on his own and will not have access to the solution.

nihil's suggestion is hands-over-fist better than MsM's suggestion of just post it and let the chips fall where they may...but...

It seems to me...still...the conference rooms would provide the safest security if someone were to want to assist you.

Eg ;)

i am all for education, MsM. but i don't trust peoples motives!

there seem to be a lot of experienced and ethical professionals on the forums i lurk on. but there also seem to be many geeks with too much time on their hands who may or may not have a criminal mind or intentions -- but they definatly do not seem to possess the capacity to think ahead and consider potentical consequences to their actions.

they are either too lazy or lack the resourcers to setup a test lab to play around with and would much rather launch little experinents in a live product environment. any successful experiment might probably cause some sort of network service or system disruption and the local support will have to take time out of their busy schedule to deal with it and fix it.

RY

I think you should just ask your questions in public. If you get negged you get negged. If you get them answered you get them answered. If they just sit there with no replies or negs, at least you tried. I just had an assignment about exploiting various vulnerabilities, and I'd be happy to try and answer some questions regarding the subject.

Thanks for the input guys/gals. I come to the conclusion that it is possible as long as I get a presence on AO and prove that I'm not just some mindless kid looking for a way to 'p0wn' someone on the net and do it in a private place. I just want to stress that I do have the time and the means to do this and the integrity to 'keep it clean' and legal while I try. As I said in my original post that I will be doing most of the research from a number of sources like bsrf, neworder and a host of others. I will only be asking about specific topics where I don't understand the theory of an attack or need to discuss something a little more in depth. Basically questions more so then 'w4r3 d0 1 g37 ub3r 0d4y spl0its?!' I guess my main point here is that I agree with the ideas put out there by my fellow members and agree with most of the points out there. This venture will take me some time and by then I will have hopefully have wormed up to the community and will have gotten my name out there. P.s. HI! I'm ech0 ;)

Well ech0 either you are genuine or one hell of a social engineer, because I believe you..........and I am sure that there are several members here who will vouch for my tolerance and gullibility :D

Why?

1. You asked the question of propriety in the first place, and it was not your first post.

2. You politely awaited responses without diving in and trying to "defend" yourself.

3. Your "story" made sense and you did not change it.

4. You wrote in proper, articulate, English.

:)

So what we are saying here is that we can have theoretical conversations here but actual dicussion of specifics of attacks or case studies aren't welcome?


Okay, lets not discuss what can be found here , here , or here which btw the way is the first 3 links on google for exploits .


Next arguement : But we aren't showing the how to use them which can be found here , orhere. All this can be found by searching compiling exploits.

But should we be the "devil's advocate" and contribute to this?


ummmm.....................hello!?

Quote:

---

Results 1 - 10 of about 33,000,000 for hacking

---

I mean, come on people, this is a site for security discussions. That requires "discussions".

Most of the people who would abuse this information really don't have the base knowledge to apply it anyways.

Reality check man.


Ryan

Ryan old chap:

Quote:

---

So what we are saying here is that we can have theoretical conversations here but actual dicussion of specifics of attacks or case studies aren't welcome?

---

My view is "absolutely not"..............that is why I was making the point about a$$ covering........you have just proved what I was saying by demonstrating that the information is already in the public domain? Surely it is right and proper that a security site would discuss such things?

My additional rider would be that there should be reference to mitigation/defence as well. That makes it pretty watertight, at least under UK law ;)

Hi nihil,

I agree that it's already available...

Quote:

---

and I do not believe that not providing public access to this type of information would in any way prevent people from obtaining the information through other means...

---

and I agree that a security site such as this should touch all the bases...
and I agree with your assessment of ech0...

however...

I still think this can be approached responsibly...taking into account that some may use the information for malicious purposes...is it really that difficult to utilize the conference rooms for these matters...where these issues can be discussed at length without having to worry about prying eyes?

Eg ;)

The only people who neg for asking penetration testing/wargame questions are self-important wankers who haven't a clue themselves and just wish to play thought police. These same people tend to have little concept of what actual legal considerations exist.

If all you're looking for is packaged exploits for the latest vulnerabilities, you are at the wrong site. If you wish to have a conversation about methods and considerations then you'll find a few people here with worthwhile insight, but until you know who is who, take everything with a grain of salt.

Ask intelligent questions (gotta be smarter than Google) and you shouldn't have too much trouble.

Remember it is only illegal if you outline an illegal activity in your post.

"How could I go about subverting zone alarm?" Is a perfectly reasonable question.
"How do I compromise the message board on widgets.com?" Is not.

cheers,

catch

Quote:

---

These same people tend to have little concept of what actual legal considerations exist.

---

Consider this: 12 morons good and true, a half of whom couldn't even find the I/O switch on a computer and a shower of shysters and their "Ankit Fadias" And you don't have the financial resources that the opposition do. "Do you feel lucky punk, well, do you?":)

Quote:

---

"How could I go about subverting zone alarm?" Is a perfectly reasonable question.

---

....................the hell it is!!!! that is exactly the scenario to avoid............asking information on how to attack A SPECIFIC COMMERCIAL PRODUCT? .........is what will get "the Man on yore sorry a$$".

Now, if you said "software firewall" or "does ZoneAlarm have specific design flaws or weaknesses" then you are on much safer ground, particularly with the former.............the reality of life is:

"name a product and expect to be sued"...............OK for people who make a living out of journalism and such ( it builds their self esteem if not their reputation), but not for most people on this site who have a day job, or hope to get one when they qualify. Sure you might get away with "the truth"..............I guess "public interest" would be shot to hell because of the context in which you revealed it? AO is NOT the Sans Organisation.

Laws vary from country to country...........even state to state?

But, each individual has the right to take their own decisions..............and answer for them

:)

Quote:

---

Consider this: 12 morons good and true, a half of whom couldn't even find the I/O switch on a computer and a shower of shysters and their "Ankit Fadias" And you don't have the financial resources that the opposition do. "Do you feel lucky punk, well, do you?"

---

If the act isn't illegal in the first place... you'll neer see those 12 morons.

Quote:

---

the hell it is!!!! that is exactly the scenario to avoid............asking information on how to attack A SPECIFIC COMMERCIAL PRODUCT? .........is what will get "the Man on yore sorry a$$".

---

If "the man" is stupid... attacks against a specific commercial product are not illegal... only attacks against specific organizations.

Quote:

---

"name a product and expect to be sued"

---

You'd think so... except every software product has some version of this phrase in their EULA:
"This software may contain bugs and is provided as is."
This removes some of their liabilty if the software fails, and it removes all of your liability in saying th software sucks or designing techniques to subvert the software.

It goes both ways.

cheers,

catch

I don't think nihil was referring to criminal legalities catch. More of a civil thing.

Nihil seems to agree with us in the moral/ethical arena. Its the responsibility (legal ramifications wise ie civil suit) that his concern seems to lie in. As for that, unless a Mod or someone from Jup Media steps in and condones a certain thread or mentality then I say there is no problem with it. No one here would be held responsible.


Ryan

Thanks guys, ill be sure to ask intelligent yet private questions in the future. Thanks for all the input!

Quote:

---

Originally posted here by nihil
4. You wrote in proper, articulate, English.
[/B]

---

p.s. Thank you spellcheck! ;)

I'd be very interested to see the info about your wargames. Having participated in one run by MsMittens, I've found that they can be very informative (and downright fun)!

It'll be fun for sure, it will take along time and lots of reading but that's what hobbies are for. Heh, Ill try and document everything I've learned and try to post in detail about what happened in each 'round' or something along those lines. Not quite sure, but if its an excuse for more posts or maybe a tut? How couldn't I :)

Look forward to reading it! I would say ask questions in public, if you pm someone or conference with them you will only get one answer. There is usually many ways to acheive a specific aim when war gaming, if you ask in public everyone will learn and you will get a variety of different answers/help.

Hi ech0

Good luck to you, just think about what I have said.............like if you need to name names please use PM or e-mail................

I know that I sound paranoid, but it is a bit different being a student and coming from behind a corporate legal department..................... ;) even if you felt sure you were right and would win it would still play on your mind................not a good thing whilst studying IMHO.

I have no worries on the "criminal side"..............although that is EU not USA & Canada, where there might be civil law encapsulated in criminal law?

Morally/ethically, there is absolutely no issue whatsoever :D

Cheers

Thanks nihil, I will keep in mind what you and the other members have said. I understand what your saying with the legal side of things and will take that into consideration! This thread worked out well I'd say ;)