Gunz, Lulz, and InfraGard

Being an 80s vintage hacker, I have often claimed that I don't own a hat... black, white, gray, or otherwise, although it might be proper to refer to me as a "tinfoil hat hacker" at times.

I'm just not that into hats. Or people who wear hats, metaphorical or physical.

But lately, in the people-who-wear-hats security universe, a battle is going on between the white hats and the black hats, and the black hats are winning.

As usual.

Of course, I'm referring to LulzSec vs. Everyone Else. One of their most recent targets has been InfraGard, an association of Security Tards Professionals I have had very little contact with in the last ten years.

In fact, my exposure to them has been very brief. I went to one of the first public meetings of the local chapter just to see what it was about. This was somewhere in the 2001-2003 time frame. The Guest of Honor was an alleged "FBI Agent" who never showed a badge and left a HotMail address.

Yeah, riiiight. Some credentials you got there, Mulder.

The only other thing I remember about that meeting was leaving, unimpressed. I never planned to join. It was just curiosity.

But somehow, I got on their mailing list. In almost every meeting announcement, there was usually something about going out to a shooting range afterwards to kill imaginary hackers. And sometimes the emails were only about getting together at a shooting range, to the point that InfraGard was more about guns than anything else.

Don't believe that? Try this Google search. I'm not making it up.

Then, at various Travelling Security Dog & Pony Shows in the area, I ran across the InfraGard "principals" as either participants or sponsors. The chit-chat from these clowns before or after the show was always "my new gun this" or "my new gun that" ad nauseum.

By this time—around 2005—I was firmly convinced InfraGard was just another Gun Club that had nothing to do with security (except for killing people, which I will admit is a valid security strategy, but not the only one and not among those I was personally or professionally interested in).

So I have to admit to no small amount of schadenfreud over LulzSec's recent pwnage of the Atlanta InfraGard chapter.

There's more to security than guns, fellas.

But you know that... now.

OMG WTF?

Yes, the List is down.

It will be back.

You explain away 100,000,000 open Chinese proxies and what happens?  Some people get jelluz.

lulz

You can't stop True Talent™.

Insecure Defaults In PPLiveVA Client

Insecure Defaults In PPLiveVA Client
====================================

The Great Firewall is full of holes.

From http://www.synacast.com/en/ ...

"PPLive has more than 200 million user installations and its active monthly user base (as of Dec 2010) is 104 million, i.e, PPLive has a 43% penetration of Chinese internet users. With its innovative user experiences, such as live chatting, and SNS, average viewing time per person per day has reach over 2 hours and 30 minutes, the highest stickiness among all China websites."

The Intro
=========
Anyone who has followed public proxy lists in the past year has noticed there are thousands of new open proxies listening on port 9415 listed every day. In the past year I have documented over 394,000 port 9415 proxies from these public lists. Geolocation of the IP addresses indicates they are widespread mostly in China but also in Taiwan, Macau, Hong Kong, and pockets of the US where Chinese is likely to be spoken.

I initially suspected some kind of malware. Finding nothing in Google (searching for 9415 will get you a lot of proxy lists), I eventually started searching Baidu. The results were immediate.

These proxies are built into the PPLiveVA client to retrieve an internal PAC (proxy autoconfiguration) file from the following URL:

http://localhost:9415/tudouva.pac

Replacing "localhost" with the IP of an active port 9415 proxy (if you can find one) will get you the PAC file, shown below:

function FindProxyForURL(url, host){
if(isPlainHostName(host) || url.substring(0,5) != "http:" || shExpMatch(url,"http://localhost:*") || shExpMatch(url,"http://127.0.0.1:*"))
return "DIRECT";
if(shExpMatch(url, "*.flv*") || shExpMatch(url, "*.mp4*") || shExpMatch(url, "*.m4v*") || shExpMatch(url, "*.f4v*"))
{
if(shExpMatch(url, "*hzplayer0.tudou.com*"))
return "DIRECT";
else
return "PROXY 127.0.0.1:9415";
}
else
return "DIRECT";
}

Obviously, the proxy should be listening on 127.0.0.1 only, but in practice it listens on all interfaces.

The Outro
=========
It looks like there are 100 million open proxies in China, thanks to this software. Pick a Chinese IP address, scan for port 9415. You'll get one sooner or later. I don't consider this a 0day, since it's been going on for over a year. Responsible disclosure? meh. A little late for that.

The fact is, they're pretty crappy proxies.

More Info
=========
http://proxyobsession.net/?p=1534

More Proxies
============
http://www.mrhinkydink.com/proxies.htm

Originally published 04/19/2011

Creepy Convergence

One early Sunday morning back in October, Gastonia (NC) police found a 2009 Hyundai Sante Fe parked in their own parking lot.  Inside were a pair of bodies, the victim and perp of a murder/suicide.

Tragic, but it happens every day.  On average, it happens about twice a day.  There is no avoiding it.  It happens.

This always triggers a number of events.  The police have to investigate.  The bodies have to be removed.  The crime scene has to be cleaned up.  Coroners are woken up.  Autopsies are performed.  And sooner or later the unfortunate actors of their own Final Tragedy are laid to rest.

The twist in the Gastonia murder/suicide was somewhere along the line a mortuary worker lifted a credit card from the victim.

Or, if you believe her creepy MySpace page, the mortuary manager.  (I don't expect this page to be up forever, so I have preserved it at right.  Click for a larger view.)

This particular mortuary advertises many of the services involved in the chain of events that happen after a murder/suicide, including body transport and autopsy, so it's not unusual the Gastonia police contracted with them for this incident.

Now, the mortuary has a public relations nightmare on their hands.

And they're looking for a new manager.

The cops, too, need to take a look at their chain of evidence policies and procedures.  And a second look at their dealings with this company in the past.

Then someone needs to take a long, hard look at ChelleMorticia.  With search warrants.  And maybe a cadaver dog or two.

This is not going to be the last we'll hear about her.

Disturbing Update

It seems our girl has taken her own life.

Still, this is not the end of this story.

NEW! Bot Skillz Code

From here on out, if you want to know the Bot skill level during the game, say:

HSQ!

... and the admin will tell you after a short delay.

I suppose it stands for "Hinky Skill Quotient". It must be ALL CAPS. Don't forget the BANG (!) at the end.

Of course you can always do it the old-fashioned way, whatever that is. I assume there must be a command somewhere in the UT game console, but I seldom use it, so I wouldn't know.

Auto AutoAdjust works quite well. It gives the good/cheating players a run for their money and since they usually clear the place anyway I'm not too concerned about that happening. It will always reset to Novice sooner or later, and it will not AutoAdjust when a Bot has the lead.

When it happens the best thing to do is try to hide somewhere and let the hotshots deal with it until it's over.

UPS Post-mortem

It's dead, Jim!
We had another power outage today! Did you notice? Of course not, because everything's working as intended now.

For giggles, I plugged in the old UPS and hooked it up to a power-unprotected Windows XP box. I installed the GAWD-AWFUL-UGLY software (see below) and did a self-test on the UPS.


The result?

IT DIED. THE FUCKER CHOKED. IT PUKED ALL OVER ITSELF.

And everything went dark.

I had to go back to the Old Blog to see when I installed this thing. It was officially announced in October 2005, so it lasted for four years and change. Now, it's junk.

TOXIC JUNK, since it has a lead-acid battery inside it. I suppose if I were a drunken electrician (like my dear old bald-headed Daddy, Drinky Dink) I could fix this thing, but now I have to take it somewhere and probably pay somebody GOOD MONEY to throw it in the lake for me.

For the record, I would never buy one of these again, although... ummm... I already have bought one (a different model) for my "domain services" box. That one appears to be working fine, but I do feel like I'm waiting for the other shoe to drop.

If/when I buy another UPS, it's definitely going to be an APC.

That's Gotta Suck

A nine million+ ping?

lulz.

There were a bunch of these today, up to and including a Player10. All the same guy, this fellow down in New Zealand.

A few other things sucked today as well. The power went out briefly, which shouldn't be a problem. But it was a problem! I'm not sure what the issue is. The power was blinking on and off last night, but the UPSes handled it. There was a lot of relay clicking going on but nothing went down. In fact event the boxes not connected to a UPS stayed up, so I thought nothing of it.

Then about noonish today it did it again, but this time two out of the three boxes without a UPS bounced, and BOT House died! That shouldn't happen!

But it did and it sucked.

Luckily the IP made it through the reboot, so no big woof. My biggest complaint is my latest kernel 2.6.32 fix (you may recall I disabled DMA on the hard drives) was going on four weeks without an incident. Now, testing is back to square one. Or maybe square two. Or maybe Free Parking. I dunno. All I know is I didn't pass "GO" and I didn't collect two hundred bucks.

There has also been a lot of general suckiness going on around here lately.

December was a total wash. On the 10th I had the dreaded periodontal surgery. Three teeth ripped out of my mouth and bone grafts. Nasty shit. I was living on Ensure, yogurt, and ice cream for about three weeks. After the 1st of the year the stitches finally fell out, but it sucked.

Later this year I'm supposed to get titanium implants in the new bone and after that heals, I get a pair of fake teeth to replace the ones that got yanked.

In other sucky news, I've just about had it with Ubuntu 9.10! I've done one upgrade (on a VMWare virtual machine) that went well and two fresh installs that were absolute nightmares. This is the first distribution of Linux that I simply can't recommend to anyone. The phrase "steaming pile of shit" comes to mind whenever I think about it now.

I did learn a few stupid Linux tricks in the process, like how to boot from a USB drive when your CD drive is broken and your sucky system doesn't even know how to boot from a USB drive. That alone was worthwhile.

Oh, and work sucks. Don't get me started on that subject.

In general, boys and girls, it sucks to be me lately. Usually, come January/February I chalk this kind of thinking up to Seasonal Affective Disorder, but this time around it feels real and I'm having a hard time shaking it.

So anyway usually the best cure for this is to dive into UT and kick some ass. See you there!

Loser!

Power Outage 09/23/09

Back to normal now.

I had to pull the plug prematurely on EXP4, since it has such a wimpy UPS. BOT House stayed up for about 45 minutes before it shut itself down.

Of course, we ended up with a new IP address, so all your favorites are fucked.

I've had a lot of good luck this year with the power situation (unlike last fall's 48 hour outage after the remnants of Hurricane Ike blew through town). I did notice a crew with a backhoe a couple of blocks away when I came home from work, so I'm going to blame it on them. They have their path all marked out with those little plastic flags and they have a way to go until they're done. Hopefully they won't make the same mistake twice.

RESOLVED: EXP4 is Experimental

Well, shucks, folks. It turns out my custom-built Linux kernel (based on version 2.6.28.7) was completely fux0r3d.

After fucking around with grub for way too long, during which I found a longstanding Bug That I Should Have Known ABout But Didn't, I set the box back to the stock Debian kernel ("2.6.18-6-amd64") and rebooted. Then I jumped in for a few quick rounds at Bitch House, since EXP4 is currently running on the "new" iPaq (which I have rechristened "iPunk").

The son of a bitch ran like it should. No little red network doobie flashing, no more getting killed by bots that aren't even pointing at me.

Mea culpa, mea culpa, me maxima culpa.

Fuck. Me.

Right now UT is the only thing that is running right on that box. The old kernel killed X/Windows outright, but at least ssh still works so I can get in & twiddle the bits (it runs headless on DinkNet - no vid, no keyboard).

Iptables is also fucked, or so I assume. You have to compile it against your running kernel, so right now its functionality is suspect. Ban-O-Matic is probably fucked. The latest incarnation of BOM relied on ipset, which doesn't come stock on the older kernels. Instead of using ipset, I'll fall back to the old method of letting the iptables rules grow. And grow. This is how it's set up on iPunk right now. Thank you StinkFly for helping test it out (poor schmuck, he's coming in to get banned on a third IP address as I write this).

BOT House runs an earlier kernel, v2.6.28.5, so it was not affected. And OF COURSE at the moment we're between releases for the Next Big Thing™. Kernel 2.6.30 is "stable" (right) but 2.6.31 is supposed to cure cancer (among other things) when it finally comes out.

Not that BOT House doesn't have its own problems. I discovered just before we left town to go to Rinky Dink's wedding that it doesn't work with those little gspca USB webcams I'm so fond of, but that's a minor issue at this point.

So I have all these issues to work out but right now I find myself with a severe shortage of Free Time™. Work has been a serious bitch for the last couple of weeks. I'll blog about that when I have some time to get get pissed off, but I have to keep reminding myself I'm lucky to have a job in this crappy economy.

I will probably leave EXP4 on iPunk for the time being, since both BITCH House and Classic3 get little traffic. That means if the power goes out here (so far we've been very lucky on that front), EXP4 goes down until I do something about it. BITCH & C3 will go up and down as I work on the new kernel. There's no sense sticking with the stable release so I'll hack away at one of the 2.6.31 Release Candidates until I get it just right.

Bahrain: A Year Later

Last year, I reported on a flood of open proxies in Bahrain.

Starting in April, picking up in May, and bursting at the seems in June and July, I found hundreds of open proxies listed by the various proxy lists I raid hourly (I never actually scan for proxies. I collect everything I can find online - usually through Google - test, and report).

Bahrain was awash with open proxies. Then, in August, it stopped.

In the end I had tested almost 17,000 proxies and found more than 2200 open proxies. On closer inspection, most appeared to be public access points or some type of consumer grade router. Nearly all were owned (notice I didn't say "pwned") by Bahrain Telecomm.

One by one, the open proxies eventually went dark and that was that. There were a couple later in the Fall but nothing like June and July of '08.

Today I ran across this article, which states:

Security company Trend Micro, has recently warned that Internet community in Bahrain is at high threat from the rising cybercrime. The security firm has sterilized over a million infected PCs throughout the Middle East during Q1 2009, out of which, 159,228 were located in Bahrain...

Security researchers believe that high Internet use in Bahrain is the prime reason behind the increase in the nation's cybercrime. As far as the figures by Trend Micro are concerned, Internet usage in the country has increased 525%, which indicates that currently 34.8% Bahrainis are susceptible to cybercrime.

Fancy that.