This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
in a fag pose.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six foe.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning dream cats.
You need some ISO? Let me do my hard drive rifle.
Our exchange you could never stifle.
In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattling in bones? When I tell you we just hacked out Jones?
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the cruisers.
Serial codes, source codes, ISOs, RANS, SIFS, SIS.
This is dedicated to the hackers and the crack.
Stank Dog, we're Gelada.
And Saffron.
And this is a proper British accent.
Stank Dog, you are a noob.
We for G, your leet noobness.
Warning, the following sound is adjusted.
Leet.
Hello, everyone, and welcome to Binary Revolution Radio, episode 97, coming to you on May 24th, 2005.
I am Stank Dog, and joining me this week from the dirty, dirty streets of New York City,
on this ghetto-fied edition of Binary Revolution Radio, is the one, the only, Natus in the house.
Hey, yo-yo, what's up?
Stank Dog.
And right, like, underneath or on top of the train station, it sounds like.
Yeah.
So, bear with us with the sound quality here.
We thought we'd do an on-location, as it were.
So, Natus is actually out at a payphone that we dialed in.
So, we're going to try this out and see what kind of, get the sounds of the streets in the background and the trains.
And we don't need no sound quality.
So, we're going to go with this episode, see how this rides out.
So, now, the opening clip you heard, just before you heard us come on, was a clip from Gelata and Saffron.
If you remember, a couple weeks ago, I made some jokes about my pathetic British accent,
and I told people to send me in a proper British accent.
And they, that was Gelata and Saffron who opened the show, actually, not me.
So, shouts to them.
And please feel free to send in more.
I thought that was pretty funny.
I was lolling at that one.
Pretty good.
And, you know what?
I've got a little bit of a rant to start the show off this week.
Gee, what else is new, right?
Yeah.
So, I guess bear with me a little bit, Nat.
Maybe you should hold the phone up so the people of New York City can hear me cussing and screaming about this.
But, see, something, I got an email this week that's kind of just pissed me off, quite frankly.
But, someone sent me an invitation, I guess, for lack of a better word, or wanting me to help out with a project or something.
They were working on a site, a list of security policies, actually, or something along those lines.
But, it's not, it kind of pissed me off a little bit.
First of all, they didn't send it to the radio address, so I'm not going to read it on the air, give anybody's name or anything.
But, it just prompted me to want to talk about this topic on the show a little bit.
And, that is just the general topic of hackers versus security professionals.
And, in quotation marks, of course, security professionals.
First of all, this thing, this email just insulted me, just, I was grossly insulted by the email itself, just the tone of it.
Basically, this email translated said, something along the lines of,
Stankdog, you suck.
Do you know anybody else that does not suck that would want to help me on this project?
So, on a personal note, I thought that was just downright rude.
Yeah, I'm kind of paraphrasing the email, but that's pretty much the long and short of it.
And, the project that they wanted me to put them in touch with somebody or assist, or I don't know what they wanted.
I mean, they didn't want my assistance, apparently.
But, was some kind of security standards type project, like putting together a list of security standards,
or updating an existing list, or something like that.
Something that's already been done, a lot of times, there's several different standards out there.
They're constantly updated.
Security is a big, hot issue right now.
I don't know what another one, what we need another one for.
But, okay, whatever.
I would support it otherwise, had I not been assaulted.
But, fine.
But, see, there's a bigger problem that I have with all this.
You know, the personal slight against me, I can ignore that.
That's not a big deal.
But, there's a deeper problem here.
And, it's this, I don't know, this coming together of two different groups of people.
Hackers and security professionals.
Because, quite honestly, they are two different groups of people.
Hackers like security as much as anyone else, but I don't see it working the other way around.
Most security professionals, quote unquote security professionals that I've ever met, are all a bunch of arrogant assholes that think that because they've got a piece of paper, or fucking initials behind their name, or something like that, that they're some kind of elite uber hacker because they know this security material.
And, that's, it's so wrong.
It's just, it's just so false.
It gives them a false idea that they know what hacking is all about, or they know what security is all about.
Like, the two words are interchangeable, and they're not.
It kind of reminds me, Natis, have you ever met those people that, like, they have a doctoral degree, and they insist on being called doctor?
Ha, you know?
Yeah, it's kind of funny that you said that, because, um, actually in high school, my Cisco certification teacher was a doctor, and he made us always call him doctor.
Fuck you, I'm not calling you a doctor unless you're operating on me.
Doctor, what the fuck?
Doctor of fucking basket weaving, or fucking doctor of pet psychology, or some bullshit?
Fuck you, I'm not calling you a doctor.
Call you whatever I damn well feel like it.
That's some, that's stupid, I just hate that.
Even if he has 15 certifications?
If, I don't care if he's got a hundred certifications, it doesn't mean it, it's not impressing me.
It's not impressing me.
It's a big fucking deal.
You went out and paid to take a test, and got some certification.
You went out and paid to get a piece of paper.
If anything, I think that's a little dumb, if you ask me, especially when you start getting redundant ones.
What's the point of having more than one or two security certifications?
They all start to overlap, they're all very similar.
You know, so it's actually kind of silly if you're pointing it out to me like that.
That, that, it doesn't impress me.
Just because you took a class and memorized some stuff, that doesn't impress me in the least bit.
And I get emails from people, some worse than others, where like their whole sig file is longer than the actual message itself.
It's got a list of all their titles and all their degrees and certifications.
What the fuck?
Yeah, I was hoping you were going to bring that up, because I saw that email you were talking about, and this guy's signature was pretty ridiculous.
Yeah, it's like, I mean, what, I need to buy a fucking vowel?
What, do I spin the fucking wheel again or something?
I can't even read, all this shit means nothing to me.
I don't give a fuck.
All that proves is he knows the motherfucking alphabet.
Like, I give a rat's ass, you know, that you've got all these fucking letters after your name, or before your name, or you're part of, it doesn't mean shit to me as a hacker.
And it doesn't make you a hacker, because you've got all this shit.
That's what I'm saying.
There's like this, there's no overlap, there's some overlap, that's a lie.
There is some overlap.
I've met a few people that are good at both, and that have translated from hackers into security professionals, but not the other way around.
Just because you go get this piece of paper, that's like, you know, that doesn't necessarily mean that you're a hacker.
I've got a CEH, I've got my certified ethical hacker, I've talked about it on the show before.
I don't list it on my resume.
I've been published in how many magazines, and all the projects that we do, I don't list that on a resume.
I don't list it on my SIG file, or in my emails, or in my articles.
I don't end my articles with, Stank Dog, CEH, published in blah blah blah, presented at blah...
No, what's the point?
I'm not trying to impress anybody.
I really don't understand.
The only point of putting shit like that in there is because you're trying to impress somebody.
You think that by putting all of that shit after your name...
I mean, honestly, what other reason is there?
You put all that shit after your name, you're trying to impress somebody by putting all that shit.
And you know what?
I don't give a flying monkey fuck if you're impressed about what I put in my goddamn SIG file.
Fuck off!
Anyway, I don't get security professionals in general.
Security professionals, they'll never admit this, of course.
They think they're great.
They think they're uber hackers.
But they will never get the simple fact that they're learning things that we've already done.
They're going out there and studying and taking these classes and reading these books
to find out known vulnerabilities and common ways to protect yourself from them.
It's all after the fact.
It's all reactionary.
So hackers are out there finding and inventing these exploits, inventing these vulnerabilities,
coming up with new things, finding them because we have that mindset, we have that eye to notice
where a vulnerability exists or could exist and actually executing it.
So security professionals, no matter what they want to admit, are always, always reactive in nature.
Always.
All they're going to do is put on all their security patches,
close down the ports that they don't want to use as much as possible,
lock the doors and windows, etc., etc., from known attacks.
And you can lock everything that you know down.
But what are you going to do when hackers find something new?
We find a new vulnerable window or a new vulnerable door.
All that you're going to do is react.
Now, fine, that may make you a good security officer and security professional,
but don't come telling me, sending me an email about how my writing is not standard
and not up to your expectations.
How's that for a new word?
I don't give a fuck what a security professional thinks about my show or my writing
or any of the projects that we do.
I couldn't give a fuck less.
Stop listing CISSP, ISAP, LMNOP, EIFuckingEIO.
I don't give a rat's ass.
It doesn't mean anything to us or to me anyway and hackers in general.
Hackers are not necessarily security professionals, although we could.
I've had so many offers, and I know a lot of people that, like, they want hackers
because they know that hackers know what we're doing and what we're talking about.
We could easily become security professionals, but security professionals cannot always become hackers.
They just don't get it.
They never will.
Yeah.
All right.
I'm all stressed out now.
I start off the show getting all stressed out.
How much time did I waste on this freaking thing?
Tent.
Oh, crap.
All right.
Actually, I didn't go too.
I wasn't too awful mad at that one.
I just wanted to get it off my chest because, ugh.
Anyway, I'll move on.
What else do we have for housekeeping for the show?
Oh, Natus, how about, what are we going to do for DEFCON?
I mean, we haven't really made any solid, solid plans yet.
I mean, we've kind of been talking around, but Alexis Park is sold out.
I called Sunday, Saturday or Sunday, and they're sold out of the DEFCON rates,
and the lady on the phone checked the regular rates, and she said there's no regular rooms available either.
Huh.
So that's not cool.
I mean, it's months away, and it's already sold out.
Mm-hmm.
So...
I didn't stay at Alexis Park last year, but I wanted to stay a little bit closer this year,
but I guess I won't be staying at the Alexis Park.
Yeah, I checked on, there was a couple others that you told me about,
and I checked them, and they were either sold out or way too expensive.
Oh, really?
I'm guessing the Hard Rock was the expensive one?
Yeah, there's a Hard Rock, there's a...
St. Tropez.
St. Tropez, right?
St. Tropez, I think, was sold out.
Hard Rock, I think, was real expensive.
And actually, I've got to say, the lady from the Alexis Park also said there was a Fairfield
really close to them, like next to them also.
So I did not call that one yet, but that sounds pretty ghetto.
I think that's going to be one of those ghetto, you know, cheap-ass hotels, which is fine, you know.
Pay by the hour.
Yeah, exactly.
So, well, I'm looking at just getting something up on the strip myself and just commuting, for lack of a better word.
There's a subway system there that apparently is up and running now, and it doesn't go exactly to the Alexis Park.
The closest thing it shows up at is the MGM Grand, and then you have to walk, I think, if I remember looking it up on the map, it's maybe a half a mile, so it's maybe a 20-minute walk or something like that.
20 minutes of death in the Vegas heat in summer.
Yeah, well, it's one of those things where once you get to the Alexis Park, hopefully you won't be leaving.
And, of course, worst case, I mean, if you have to, you can get a cab or something there.
But the subways are, not the subway, what is it, the monorail, excuse me.
Yeah, the monorail's probably cheaper, I'm sure.
But, yeah, if you can't get a room there, which it sounds like they're running in short supply, then, yeah, I'm going to say something up on the strip.
I'm even looking down at the other end of the strip and just ride the monorail up, so I don't know.
We'll see.
Have you booked anything yet?
No, I haven't booked anything, and I don't plan on booking anything until probably the beginning of July.
Yeah, see, I'm actually going to stay up for an extra week and do kind of the vacation thing as well.
So after the con's over, I'm going to stay there a week afterwards and go do some Vegas stuff.
So I need to, unfortunately, I'm in a position where I need to commit and make sure I have a room available for all that time.
So I'm going to have to book something in the next week or so, by the end of this week, actually.
So be aware that the Alexis Park is apparently sold out.
I mean, you might be able to call an SE your way into something.
I didn't really push my luck.
I just pretty much asked and didn't have any luck.
So, again, the other three hotels that were nearby were the Hard Rock, St. Tropez, what?
Yep, St. Tropez.
Yeah, and the Fairfield, I don't know, Fairfield Inn?
I don't know.
She just said Fairfield.
So you might want to check into those if you want to stay very close walking distance of DEFCON 13.
All right, well, did you have any housekeeping to take care of?
You still out there?
I hear people walking by once in a while.
Yeah, it's like the commute hour, so people are going to be walking by and the trains keep going by pretty frequently because it's rush hour.
Yeah, we're getting a little static, too.
Let's bear with this a little bit longer and see if we can stay on the payphone just for the fun of it.
Okay.
But first, let's do some e-mail.
All right, our first e-mail this week comes from Optics Slave.
And Optics Slave, along with some electronics advice that he sent me following up on my electronics discussion a few episodes ago,
says, first off, let me begin by saying that I think it's awesome that you welcome articles related to electronics in your magazine.
Some people seem to operate under the illusion that hacking is exclusively software-driven and underestimate the value of electronics knowledge,
but there are times when you need to integrate a microcontroller onto a board or construct a DTMF.
I think that's a typo.
A DTMF decoder.
He says DMTF.
I'm sure that was a typo.
For years, I always believed that 2600 should have included more electronic-based content.
Doing so just widens the spectrum of the hacking media.
And, yeah, I agree with that completely.
Electronics is very, very much related to hacking.
And I see it on an upswing in general because hardware hacking in general is kind of taken off.
A lot of console gaming and PlayStation and Nintendo and all this kind of stuff, people are taking these apart.
And that requires some electronic skill as well as software.
So, and Linux, of course, is always the thing they're pushing on that because it makes it pretty, I won't say easy,
but it's definitely easier than Windows trying to import Windows onto one of those devices.
But learning how to interact with hardware and electronic, knowing the electronics of the system,
I think it's on a bit of an increase.
And I think people are just now starting to tap the surface of hardware hacking.
And magazines like Make Magazine, that thing from O'Reilly, is full of good projects and stuff like that.
Again, BinRev Magazine, we've had and would like to keep putting in electronics articles.
I know Hack and Slash had that article in there about making your own LED remote control thing.
So, I think, yeah, I think people are getting that.
And, you know, a lot of the presentations, I know Astus, of course, would agree with that as well.
And that's something that I wanted to learn and have been trying to learn more of.
So, yeah, absolutely agree with that 100%.
So, there's not really much more to say except that if you do want to submit an electronic article for Binary Revolution magazine,
just send it to articles at binrev.com.
And we will gladly give it the same equal consideration we give to any other articles.
It's not all about software.
It's not all about programming and stuff like that.
Sometimes, you have to have that interaction.
And, Natus, you probably can relate to this a little bit as well because Asterisk is a software solution for what is normally a hardware-type application.
Right.
So, having a good understanding of it is very helpful.
Yeah, definitely.
I mean, electronic stuff is really, like, beyond me.
And some of the stuff people do is just really cool.
Yeah, I've just never been exposed to it.
I just, you know, I'm trying to teach myself.
And I bought that stupid kit from Rat Shack.
And it doesn't work because, well, Rat Shack sucks.
But, anyway, I've been through that before.
Let's see.
Our next email comes from Shadowfire, who says,
Howdy to all.
This is in reference to episode 83.
Wow, that's a, wow, we're on 97.
That's back a few weeks, a few months.
Reference to episode 83 and Doug and Lucky 225's discussion slash argument regarding caller ID and who should or shouldn't have it and spoofing it.
From my personal experience, caller ID blocking is rather important for some folks.
Some friends from back home had their caller ID blocked because of some nasty divorce problems.
And since my father ran a company out of our home, he had the line set so that your caller ID had to be enabled to call in.
This wasn't a problem, really, as my buddies just had to key some star 8x sequence to pass the caller ID to our phone to make the call go through.
Another example is the firehouse where I volunteer.
We don't want everyone and their brother to have the firehouse number, not only to avoid harassing phone calls, but we want them calling 911 for an emergency.
The same star 8x sequence override applies here, but most of the time I just call the people from my cell phone anyhow.
All right, well, Natus, this was that episode that Doug and Lucky 225 did when Doug took over hosting the show for a couple episodes.
And we actually had a couple, actually we had quite a bit of email following up on that because Lucky has one view on it and Doug, I guess, had a different view on it.
And I don't know, what do you think?
I don't know, spoof them all and let God sort it out.
Oh, I'm so putting that in my SIG file.
Oh, that was good.
Oh, man, you know what, Natus, I hate to say this, but I think the static is really kind of loud on your payphone there.
Really?
Yeah, as cool as it is to hear the trains go by and the people in the background, that part's kind of funny, I like.
Can you call back in from your cell phone so we can get a clear signal?
Yeah, sure, my voice is annoying enough as it is, doesn't need static added with it.
It just seems to have gotten worse or something, so I'm going to go on to the next email, just give me a call right back in.
Okay.
All right.
All right, so we're going to let Natus call back in and I'm going to move on with our email.
See, I told you this was the Ghetto-fied edition from the streets.
All right, wow.
Wow, I didn't even get started on the second email.
All right, oh, man, that's so much better.
Can you hear me?
Am I sounding clearer?
Oh, that's so phenomenally, wow, what a difference.
It makes me realize how bad, I was just kind of bearing with it.
That was a payphone, too, with a real landline, you know, it wasn't even, I don't know.
That is bizarre.
That is bizarre, the difference.
It makes it, it didn't seem so bad at the time, but now compared to that, holy cow.
All right, anyway, hopefully the levels didn't change too much.
You're a little bit louder now, but that's good.
We're going to go with this anyway.
Okay.
This email was, okay, I hadn't even started it yet.
So, our next email is from Tim, last name withheld here, who says,
Stankdog, I've caught up with Binrev Radio after being busy with study.
I found your discussion of programming languages in episode 94 especially interesting.
I know authority on programming, and most of what I know I learned on a short C programming course for math students.
I am interested in safe programming languages, that's S-A-F-E, safe programming languages.
I know it's not hacker-like of me to ask questions before trying them myself,
but could you say anything about OpenVMS scripting system, digital command language, or Oberon, Oberon2 slash component Pascal?
Oberon is, according to the website, with a financial interest in it, safer than its competitor, C, C++, etc.
I get a similar impression about DCL, apart from it being, apart from it obviously being a scripting language,
whereas Oberon is a general purpose language suitable for system programming.
But I know even less about it.
Do you know of either being used?
I doubt that I am alone among your listeners and expecting to embark upon a career soon.
Since you gave advice on which programming language are best for earning money,
could you give some more general career advice?
Would you advise us to go into programming?
What are other respectable hacker careers, and which are most demanded by employers?
Naturally, any suggestions won't be tailored to my needs.
However, people that I've met have made such general and yet interesting claims,
such as physicists earn more than chemists, and actuaries are duller than accountants.
All right.
Wow.
Let's see here.
How do I start into this?
First of all, Natus, do you...
I personally, I don't have a whole lot of experience with VMS exactly.
No, I don't.
There's this one VBS that I go to.
I can't remember the...
Like, BizTech or something?
Mm-hmm.
They do a lot of VMS stuff.
It's run by the guys at Telefreak.
The guy at Telefreak, he's kind of into the whole VMS thing.
Interesting.
Mm-hmm.
Well, I've used VMS, but it's probably been 10 years or more since I've really had anything to do with it.
VMS in general, not necessarily OpenVMS.
So I called a friend of mine who actually has worked with OpenVMS for 10-plus years,
and I asked him about safe coding.
And he really said to me that it's just kind of a strange concept to label something as a safe language
or label any one language safer than another language.
And I somewhat agree with that.
Almost any language can be safe if you use it properly.
The VMS has, and we kind of just demonstrated this accidentally,
VMS has like a security through obscurity thing going on because not many people know about it.
Not as many people are familiar with VMS as they are with, well, Linux and obviously Windows and Mac
and some of the larger OSes.
So it's got a layer of security through obscurity that helps.
So if you want to add that to being a safer language or safer environment, I guess is a better term,
it probably is.
But, of course, you never rely on that, but it certainly doesn't help to,
it certainly doesn't hurt, excuse me, that so few people know about it and have any level of depth on it.
But I really don't, I don't think I'd say anything that one language is any more or less secure than another by a large degree.
There's certainly little nuances here and there that can make them more open to unsafe coding,
like they will allow unsafe code to be written more easily.
But, I mean, I don't really blame the language exactly for that.
I blame, you know, poor coding for that.
So I think for the most part that can always be overcome.
And, specifically, I do think you might have a little bit of a misunderstanding,
or at least I'd like to clarify anyway, DCL, or any CL, which stands for control language.
Any CL, it's, you said it's obviously a scripting language.
Well, it kind of is, but it's not just a scripting language.
It's not something that you would compare to, say, Perl, which is more of a scripting language,
or, well, Perl can be a lot more as well.
Perl's a great all-around language, but it's not like shell scripting exactly.
It's very much, well, I don't know.
I've used JCL, job control language, for many years.
CL400, which is the AS400's control language.
And, while they can be used for scripting, to a certain extent,
it's scripting that's very similar to, like, a batch file,
where it's running things sequentially.
Yeah, they are, you can do some other things with them,
but I wouldn't recommend it.
They're not really designed for that.
But, generally, a control language, a CL of any kind,
is used in conjunction with another program, with a real program.
So you would write a real program in whatever language,
Pascal, you mentioned earlier, C, COBOL, anything,
you know, whatever your language happens to be,
you write the logic for, I don't know,
let's pretend you have a, you write a program that reads in data from a flat file
and then writes it out into a comma-separated file.
I don't know, I just make one up.
You don't actually put in your source code of the actual program,
those file locations and hard code, anything like that.
You just write the logic.
You just give the file a name, define what type of file it is, and that's it.
And you write the logic behind it.
Now, what a control language does,
and this is used in mostly in heavy metal systems,
and OpenVMS is kind of derivative of the old VACS VMS systems,
you're basically going to just give a generic name,
just write your logic,
and you have to have a control language to go along with it to submit your job.
Because the control language is going to hold information about where the file is.
Let's say you're reading in a file name that's .txt and you're putting out a .csv file.
It's unimportant to the actual C program or whatever program you're writing where that file exists.
As long as it can find it and read it and use it for input into the program and or output into the program,
it doesn't care about the rest of things, and that's where the control language comes in.
Your control language program, and that is what they're called, a control language program,
can be a script that may, step one, make a backup of a file or rename a file or something like that.
Step two, it will execute your compiled C program or whatever it happens to be
and tell it, okay, the file that he's calling for input file one is right here,
and the file that he's using for output csv file is right here.
So the control language is like this handshake between the compiled program,
not necessarily have to be compiled, but the program and the system or the operating system.
So it kind of hands off information, passes parameters and things like that into the program.
So it's not as simple as just clicking an .exe file or .slash and running an executable file.
There's an extra layer in there, and it's something that, like in Linux, to give a comparison,
when you compile, you may already know where a lot of those system things are.
So, I don't know, it's just a different environment and different animal control languages in general.
So, I don't know that they're exactly a scripting language.
I just wanted to kind of clarify that there can be some scripting involved,
but it's really not a scripting language.
It's more of a control language, which is obviously why it's called a control language.
So, anyway, career advice. Wow.
Yeah, episode 94, we really focused on this,
and I wanted to kind of just let people know what's out there and what we see out there.
And I've kind of been looking around lately.
You know what I'm seeing more than anything? Visual Basic Programmers.
What?
I see ads for VB Programmers more than anything.
Like, probably, yeah, probably five to one.
Anyway, so career advice.
Well, I can't talk about, you mentioned, you know, whether something's duller than other things.
I can't tell you what's dull or what's fun or whatever, because that's like a personal preference.
Like, for me, I love programming, but most people think it's boring to sit behind a computer screen in front of code all day.
I love it. I absolutely love it.
So, I can't speak to that.
Obviously, it's a case-by-case basis.
But generally speaking, you ask about what I recommend people go into programming.
Well, absolutely.
I don't see programming jobs going anywhere anytime soon.
Computers, in general, are becoming more and more commonplace.
They're replacing every little thing.
Programmers are always going to be in demand on some level as they begin to encroach more and more on our everyday lives.
You know, whether it's new computerized refrigerators that make sure they cool down more when you're coming home from work
or your smart microwave oven are all just, I mean, they're being incorporated into so many things,
and there's always going to be a need for people to program them.
So, programming as a general term, not going anywhere anytime soon.
And, I've said this before, and I'll reemphasize, in my opinion, good programmers,
and I emphasis on the word good, good programmers are always, always going to be very much in demand
and will be in the foreseeable future.
The same holds true with good system administrators as well.
There's a lot of companies out there, smaller companies, that don't want to pay for a real programmer
or a real sysadmin.
They can't afford it or they don't think they need it.
And, they'll do it themselves.
And, you'll find a lot of people start like that and then come into the computer industry
with that little bit of experience and little or no education to go with it,
and you've got a glut of, well, frankly, bad programmers and bad admins.
So, there are a lot of people that are crossing over, but there aren't many good ones.
So, there's always going to be a need for medium and large companies for good people.
Not there is, like, the perfect example right there.
That guy, like, is always busy.
He's always programming, you know?
Yeah.
Because he's on demand.
Absolutely.
He's all, I mean, when you know what you're doing and it's good stuff, you're always going
to have a demand.
And, there's always people that are going to need you.
Because, the thing is, it's frustrating sometimes to watch.
And, I've watched this.
I've witnessed this in my 15 plus years of experience in the industry.
I've watched people get hired that don't know a hill of beans about programming.
But, they have some experience from these smaller companies and they can claim they were
a sysadmin for mom and pop's grocery store, which means they installed, you know, Red Hat
on a box and got it running and that's it.
So, it's kind of hard.
And then, once they get to the job, they find out they're in over their heads and they don't
last long.
So, they hop from job to job and probably about five years ago, that was a big notch
on your resume or a big negative on your resume was people saw that you were job hopping.
It was a sign that you didn't know what you were doing enough to stick around at one place.
So, good people know always places for you.
So, as far as general advice, generally for, and I'll speak to people that are still in high
school, to young people that are in high school or just recently graduated or are not
sure about college and things like that.
If you want to get a job in the computer industry, because of what I mentioned earlier, you can
get in it, but you won't excel or get very far.
You'll get bounced around if you don't have a degree of some kind.
So, I very strongly recommend getting a bachelor's degree, whether it be computer science, computer
engineering, an IT degree, an IS degree, whatever.
As long as it's a bachelor's degree from an accredited university, that's the best case
scenario in my opinion.
And, of course, if you want to go further with that and get a master's and doctoral degree,
but don't ever expect me to call you doctor, if you want to go that extra route, that's
great.
I think that that's the best and most effective way to get out there.
Now, that doesn't mean to take anything away from, like, tech degrees.
If you want to go to a technical degree, some people just don't like the college environment.
They don't excel with college.
The tech degree is fine as well, but I personally, and this is just an opinion, it doesn't, from
what I've seen, it doesn't carry as much weight in the industry.
And certifications, everybody's buzzing about certifications now.
Certification is not something that you should get in lieu of a college education.
It's something that you should get in addition to a college education.
After you've graduated college, you can get some certifications, or while you're in college,
or while you're on the job.
Never substitute the two.
Never substitute them.
Don't think that you're going to get a certification and you're going to be able to go out to a job.
Certification without a degree backing it is still not going to get you very far.
So, those are a couple basics that I would say, and just from my experience, I've watched,
I've seen a lot of people come and go, and that's what I've seen.
So, that's just my opinion.
Take it for whatever it's worth.
As far as how to succeed, some general advice is, I know a lot of people get bored,
or it sounds boring to learn theory and fundamentals, and I know not theory, and I have talked about
this a lot, but it's very, very important that you do become fundamentally sound.
Learn the fundamentals of what happens when a program runs.
Understand the interface between hardware and software.
Understand the basic fundamentals of how a computer works, how a computer language works,
how an operating system works, the relationships of all of them,
and then your role in making all those things interact.
If you understand fundamentals and stuff like that, you can adapt to all the other superficial
things like syntax, or language changes, or architecture changes.
Pay very much attention, as boring and as dry as it may be in the earlier classes.
Learn those fundamental concepts of being a system analyst or a programmer,
and you'll be able to adapt to anything.
Now, what was that one?
Are you skateboarding?
No, it's a motorcycle on my corner right here.
All right, so let's see.
I'm glad we're not on the payphone anymore.
This stuff would have been real loud.
Yeah.
So, yeah, a lot of people call themselves programmers, and they just memorize a particular syntax, you know?
Visual Basic, I'll use that from earlier, or C programming.
And all they've done is memorized a bunch of C commands or a bunch of C functions,
and if you try to get them to adapt to Pascal or anything else, they're lost.
They can't do it because they don't understand fundamentally what's happening.
And actually, a great example of this, this is like a way I, I won't say I test people,
this is how I can really judge or understand if somebody knows what they're talking about,
is shell coding, shell injection coding, understand what shell coding is.
If you don't understand the fundamentals of memory management and how programs interface with system memory,
and you try to understand shell code, you're just, you're not going to get it.
You'll never get it.
It's just completely, you can copy other people's syntax, and that's fine.
You may get it to work, or you may be able to do it,
but you're never going to understand it enough to write your own shell injection code
if you don't understand the fundamental principles upon which it's built.
If you don't understand that interaction of how, of memory management and things like that,
it's just, I don't know, that's just an example, an application,
and probably need to move on from this letter, but there's some advice.
Take it for what it's worth, and thank you very much, Tim, for the letter.
That was a good letter, and hopefully some people found that enjoyable or interesting.
Now, let's take a look.
Hey, how are we doing on time, Stank?
That's what I'm looking at right now.
Let's see.
Let's do a couple quick emails, and then we'll move on,
because I know you're, actually, our main topic is going to be all you this week,
so I want to make sure we give enough time to that.
Let's do a quick couple of these short emails.
The next email is from Falcon Zero.
Falcon Zero says,
I've been listening for a long while, since the time before the current email intro.
Recently, the show has been teaching me new words.
It has been teaching me new words.
My vocabulary now includes words such as E-fucking-leet,
and its antonym, noobish.
Keep it up.
I think we probably both contribute to that a little bit, don't we?
Not as much as lucky.
Oh, God, no.
You know what?
I don't care what people say.
E-leet speak, I think, is really funny, as long as you don't use it,
as long as you use it in moderation, if you don't go overboard.
Once again, case in point, lucky.
Yeah, moderation is something, I don't know.
And actually, today you've had...
It's very, very low use.
It's starting to bug me more and more, elite speak.
But me and Nott, they always do it.
We always joke.
OMG hacks, total life-bearing, stuff like that.
Yeah, it's funny in small doses.
And today, I think, what was I going to say?
Oh, today I learned, I used, I think I used lolling.
Yeah, I was lolling earlier at the email.
So there's another one for you.
Yeah.
All right, um...
Are you trying to pick up a prostitute on the show?
Me?
Yeah.
How'd you know?
Because I heard her in the background.
Oh, okay, yeah.
May I shut up?
You're over here.
I'm business after.
We should get, like, some random person on the show.
Just hand the phone off.
I will.
I should.
You should call the pay phone,
and we should just tell someone it's for them.
Oh, yeah, you can stand over on the side on your cell phone,
and we can watch what's happening.
Oh, that'd be funny.
No, we'll do that.
You know what?
We'll do that in a Freak Factor one week.
Okay.
All right.
Inside Threat.
The next email comes from Inside Threat.
Inside Threat says,
I enjoyed episode 96 with a discussion on Google mining.
Lately, I've been using a tool, Google Sweep,
that uses the Google API to perform searches on each IP address
and host name in a subnet for a company or whatever.
I found interesting information on what websites people at the companies visit
from their workstations in public web server logs.
It's mailing lists, posts, policy documents, connection instructions for servers,
default password, and lots of other information.
You may want to recommend this to your readers as a good reconnaissance tool.
Well, there you go.
It is done.
And for the record, for our listeners, it's a Python-based tool,
and it is available on Freshmeat, I believe.
I think it's, yikes, I should have looked this up before the show.
I think it's googlesweep.freshmeat.net, but I wouldn't swear by it.
I'm sure you can find it.
Let's see.
I've got one more email.
It's kind of long.
You know what?
I'm going to go ahead and do it.
I'll just read it quickly, all right?
And then we'll move on.
Okay.
This email is from Snow.
Snow says,
Dear Stankdog and co-host,
I first heard about BinRev six weeks ago on the Linuxlink.net
and have been hooked ever since.
I've been listening to your shows from episode one,
and now I'm on 42.
I'm also listening to your current shows, of course.
Cool.
I just want to say that BinRev is by far the best radio show I've ever listened to.
Yeah, right.
You're a great show host, Stank,
and your show is both fun and educational.
I'd like to thank you all and all your contributors for creating Binary Revolution.
And actually, I'll take a moment to thank everyone that's helped make Binary Revolution,
because it certainly isn't all me.
It's very little me, actually.
All the co-hosts that we've ever had have helped make this show what it is,
so I'm glad that people are still enjoying it.
Okay.
Anyway, let's see.
Back to the email here.
On a side note, I've discovered something, I think, that perhaps not everyone knew.
Recently, I switched to a new host for my website,
and as I'm a person who appreciates privacy,
I decided that I didn't want my name and address to be accessible for anyone through Whois.
It just so happened that my current registrar didn't give me the option to change my name,
only my address, email, and my phone number.
So I contacted the registrar by email and explained that I would like to change my name
and the Whois database to something that can't be linked to me directly as I care for my privacy.
The answer I received was that this was not possible and is against ICANN rules.
So I'll skip a little bit, but basically he looked up the rules, and I'm going to read a couple of them from here.
I'm going to skip a couple.
I'm going to go straight to the one that I want to address here,
and that is 3.7.7.1 and 3.7.7.2, both of which I'm just going to read continuously.
The registered name holder shall provide to the registrar accurate and reliable contact details
and promptly correct and update them during the term of the registered name registration,
including the full name, postal address, email address, voice telephone number, and fax number,
if available, of the registered name holder.
Name of authorized person for contact purposes in the case of a registered name holder
that is an organization, association, or corporation.
And here's the more important.
This is 3.7.7.2.
A registered name holder's willful provision of inaccurate or unreliable information,
its willful failure promptly to update information provided to registrar,
or its failure to respond for over 15 calendar days to inquiries by registrar
concerning the accuracy of contact details, as the horn honks in the background,
associated with the registered name holder's registration
shall constitute a material breach of the registered name holder registrar contract
and be a basis for the cancellation of the registered name registration.
Wow, that was like a tongue twister.
So, anyway, he basically says he's not sure that everyone's aware of this rule,
so that's why I wanted to address this on the air.
So, thank you, Snow, for the email.
I actually thought that this was very common knowledge.
I thought that most people knew this, but maybe not,
so I wanted to spend just a second to read these on the air,
because especially the U.S. government, they were trying,
I don't know if they still are, but they were trying to make it an actual law
that people have to use real information when they register sites.
I don't know what the status of that is, if it got shot down,
if it's still ongoing or whatever,
but I thought they were actually trying to pass a law
to make it fully illegal to post false information.
Hopefully that'll never stick, and hopefully that dropped.
Honestly, I don't know what the status is,
so if anybody's familiar with that, email us.
And I even remember posting on Slashdot how much I disagreed with this,
because I also believe I have a right to privacy,
and I shouldn't have to give out that information just to have a website.
I used to use, and Addis, you're aware of this,
I used to have my real name, real address, real phone number,
and everything on my site for years,
and it wasn't until just after I started BinRev
that I finally removed my real information from the Whois records
and changed it from the registrar.
And, you know, it's those 2 and 3 a.m. phone calls
from disgruntled fucktards calling me
that'll make you want to change that real quick.
You know?
I have a right to not be harassed.
There's no doubt about that.
I don't have to put up with that.
And forcing me to put my real name in there,
I don't see how they can...
Anyway, that's a moral discussion we won't go into.
Well, there is a solution, right?
I mean, the registrar should provide the service
where it hides, it masks your information, right?
Don't all registrars offer that?
Not all of them, but most of the good, reputable ones absolutely do.
However, I have a...
And this is a personal problem.
This is a personal judgment for me.
I don't feel I should have to pay for privacy.
And that's a pay service.
And I don't believe that I should have to pay for my own privacy.
See, privacy is a right.
It is a right, not a privilege.
I have a right to privacy.
And it's not a privilege that I should have to pay for.
So fundamentally, I refuse to do it that way.
I just put...
Well, I'm not going to come out and say what I put
because I'm not going to put it on the air.
But I can tell you this.
And in the quote earlier,
here's the important part that I want to emphasize.
They rarely act on these things, first of all.
Very rarely do the registrars follow up or act on this unless somebody complains.
And if they do, here's the important part.
You have 15 days to respond to any complaint
and prove who you really are and give you real information.
As long as you provide at least one valid email address
or a phone number or something that they can contact you
when they do get a complaint, you should be fine.
Okay?
They're going to make you change your information
and make it, quote, valid or whatever.
And, of course, you should put in your real information when that happens.
You know, I'm putting real in quotation marks as well.
You put in new information when they challenge you to.
So as long as they have a way to contact you, an email or whatever,
in 15 days you can make a change and you should be fine.
If they then file another complaint,
then you can keep going on with that cycle as long as you want to.
It can get annoying if somebody wants to do that,
but there is a way to continually do that.
Or if you don't want to, then, yes, you can break down and pay.
As Natis says, they have services for most reputable registrars
that will protect you, protect your privacy.
So another thing that you can do, and I can tell you this,
I know this for a fact, I can tell you this personally,
that if they want to keep filing complaints against you,
what you can do is change registrars.
Not because any registrar is going to be different than the other one exactly,
but once you leave a registrar,
that registrar is no longer going to pursue you with any of their complaints
because you're not their problem anymore.
You've taken your business somewhere else.
Whoa!
You've taken your business somewhere else.
That was a loud horn.
They almost took somebody out.
Should I remind you?
Oh, man, if there was a wreck live on the show, that would be awesome.
We could go, like, interview them immediately and hear them cussing.
That would be awesome.
Whoa, that would be pretty cool.
Yeah.
We can only hope.
Yeah.
Go jump out in front of somebody.
So anyway, yeah, if you move from one registrar to another one,
the registrar that you're leaving, you're not their problem anymore.
They don't care what the hell happens to you.
They're not going to follow up on the complaint because you're not their customer anymore.
So that's one other trick that you can do is jump to a different registrar.
And it's going to take a little time for all that information to propagate and spread out
and know that you've gone to a new registrar.
Again, with privacy-protected information, I'll use that term instead of fake,
privacy-protected information, with your new registrar,
the person's going to have to pursue you to your new registrar,
file a new complaint with said registrar, and start the process again.
So there's a lot of different delay tactics and ways that you can move and dodge.
It depends on how persistent they're going to be.
I can tell you that that worked for me.
I was able to avoid my situation by changing registrars, changing back to a registrar.
And you can go back and forth between registrars if you want to.
So if your registrar won't let you change your name, your real name,
which he says it won't let him change at all, you need to find a better registrar.
Seriously, most registrars don't want to have to deal with pettiness like this
and worrying about little things.
They just want to churn as many customers as they can.
There's very little punishment and very little action that gets taken by ICANN to punish registrars.
So they're just trying to do as little as necessary to make ICANN happy.
So yeah, find a new registrar if they're not letting you change your real name.
All right, well, let's do, let's see, we've got about 30 minutes.
Let's do some quick show and tell, which is very quick because most of my week,
and I don't know how much time you spent on this, most of my time this week has been spent,
well, something DEF CON related it sounds like, putting the final touches on my presentation
or my presentation submission for DEF CON,
and planning for DEF CON as far as hotels, transportation, time off of work, and that type of stuff.
And other than that, we do have some software upgrades coming to the site here,
probably by the end of the week that you're hearing this.
So there will be some probable downtime,
and I don't know what kind of notice we're going to be able to give you.
It's going to be minimal, of course.
We're always mindful that we don't want to take the site down for too long,
but don't be surprised if the site goes down for a few hours.
And that's it, working on DEF CON.
And I don't know if you had anything you wanted to talk about here
or if you wanted to go straight into your main topic.
No, I don't know.
We covered DEF CON a little bit.
That's kind of...
I know you were working on, like, your presentation and stuff.
I don't know what I'm going to do about DEF CON, really.
I think I'm going to try and present with Strom and Black Ratchet,
but that's not final.
Okay, well, or maybe...
DDP will be in the house.
Oh, yeah.
For sure.
Yeah, we'll definitely be...
We'll have a little DDP party,
like the little cartoon in the first issue of the magazine.
Little stick figures with the 40-ounce Dr. Pepper.
All right.
Well, or, you know, maybe you can present on tonight's topic.
I mean, this is...
First of all, I'll go ahead and say this up front,
that I'm a little bit lost in this.
You blow me away in this area,
because I don't even know...
I have not gotten to spend a whole lot of time,
and I've said this before with asterisk
and with telephony in general,
and I'm not a big freak for the most part.
Everything I've learned about freaking,
I've learned from you guys.
So this is going to be another one of those episodes
where I'm going to be sitting back and listening
and probably asking some stupid questions
as you go through talking about...
I guess our main topic is going to be VoIP tapping.
Right.
Kind of VoIP tapping and, like, monitoring, intercepting.
I don't know.
It's not really tapping, I guess.
I used the wrong word.
Okay.
Monitoring or intercepting.
So, I don't know.
It's been, like, a big thing lately.
There's been a lot of talk.
Everybody's trying to secure VoIP.
I don't know if you saw anything about that.
Yeah, I see quite a few...
Actually, I did not really...
I've seen in my trade magazines...
Let me put a complete sentence together here.
I've seen in a lot of my trade magazines
that I get, and I get, you know,
three or four a week,
that there is a concern over voice,
over VoIP privacy and VoIP security in general.
I don't know that I've necessarily seen anything on monitoring like this,
but, yes, it is definitely a hot topic
because VoIP spreading to the homes,
which is interesting that it went to homes first
and now businesses second.
To the home, it's not quite...
People aren't quite as worried so much about security.
They just want cheap phones
because they're tired of the phone companies raping them.
But companies and businesses are very mindful of security,
and as VoIP starts to roll out in the business community,
definitely security is something that they're taking note of.
Mm-hmm.
And they need to.
Absolutely.
So, yeah, basically I've been playing with a lot of, like, software...
Sorry.
I've been playing with a lot of software and stuff lately.
Stuff that I've read about.
The main thing, the main program I've been using
is called Cane Enable.
It's actually from Oxid.it,
and it's Windows-only software,
which is kind of weird,
and I basically have Windows, like, on a laptop
just so I can use this.
Really?
Yeah.
You don't run it in a virtual window on your Mac?
No.
I don't think they're powerful enough.
Like, I don't really have, like, the fastest computers or anything.
Ah, gotcha.
So I just have some cheesy $100 Windows laptop I got,
and I've been playing with Cane Enable,
and version 2.65, I think it was.
That's what somebody told me.
Right.
It's up to 2.69 now.
But 2.65 added basically the ability to read VoIP packets
and convert them to WAV files.
Right.
It makes everything, like, really easy,
and it supports a lot of codecs.
I mean, it supports pretty much, like, all these ones I don't even know about.
All the main ones, like, G711 ULAW,
G711 ALAW, GSM, Speaks, ILBC, and there's, like, all these other ones,
but I don't even know what they are.
PCM, DVI-4, LPC.
There's two different GSM ones that supports, GSM 610 and Microsoft GSM,
L16, G729.
All right, so it supports a lot.
Yeah, it supports a lot.
And so I've been playing with that a lot, messing with different codecs,
and one thing I found out was that this is, like, the first thing that I checked, basically,
was that it doesn't work with Asterisk IX2 protocol.
It doesn't work with any of that stuff.
It kind of, like, starts to find it.
Like, it shows up as a call in the logs,
but it can't actually convert it to a WAV for you,
even if it uses those codecs.
It's a different protocol, I guess.
And I found out that it does work with H323,
but I don't really think anybody even uses that.
I mean, businesses use that sometimes,
but that's not really something people in their home use.
And what about SIP?
SIP, yeah.
SIP is, that's basically what it is.
All these protocols that I mentioned, those are with SIP.
Oh, okay.
Well, now, the IAX2, is that not working because you think it's buggy,
or they do not have proper support for it at all?
I mean, you think it's something they're working on that just is not quite ready yet, or?
I don't know.
I actually emailed them about that.
I was wondering, because I haven't really found,
I've been trying to do this stuff for a while with IAX2,
but I haven't found anything that does it reliably, really.
Okay.
Well, if we hear back from them, we'll read it on the air.
Yeah.
They have asterisks on their site, too, under the VoIP section,
so it might be something they're working on.
Okay.
Well, that was, like, the first thing I tested, basically,
and it was kind of interesting, because I'm a big asterisk fan, as you know.
Right.
But, I don't know, Cane's really cool,
because you do the whole art poisoning thing, you know, art poison routing, all that stuff.
You can basically intercept all the VoIP traffic on a network.
You poison a route, and everything goes through your computer,
and you sniff everything, and then you cannot easily convert it back to the wave.
And this is something I was doing on my own network, basically, for testing.
And I know we had a thread on the forums about it.
Right.
And a bunch of people were saying, like, yeah, wow,
it's really easy to do with SIF and everything, and it was working really good.
I just actually tested it out on some neighbor's networks, too.
With their permission, of course.
Yeah.
But, see, because my network, I have web on, and I do everything.
I was trying everything on that, and I was getting really crappy results.
It wouldn't pick up my router.
It wouldn't pick up my laptop that everything was running on.
It just wasn't finding them, and I wasn't sure why, but web has something to do with it.
Even though I'm associated with the network, it's still not finding the host,
and it's not working reliably for me.
So I had to try it on my neighbor's network, and they had web off.
And I tried that on there last night while I was, like, writing all these notes up and everything,
and everything worked fine on their network, so it was really easy.
It's something a lot of people have been talking about since this came out.
I mean, just the fact that people can go to, like, somebody's, I don't know,
just any unprotected networks now and just poison all their routes and intercept all their VoIP traffic.
Well, how difficult is it to set up and get up and running for the first time?
For the first time, it's really easy.
Somebody sent me a video.
It was, like, from Hacking Illustrated or something.
That was basically what I used to learn it the first time, but it's really easy.
Kane is, like, a really easy program to use, and so it's kind of funny.
So would it be, how likely or how easy would it be, for example,
I mean, you're right now walking around downtown New York City,
you'd have bust out the laptop and just sit down in front of some business and start to go.
I mean.
Yeah.
It could be done within, like, a minute.
It's that simple.
That's, wow.
That's pretty cold.
Yeah.
I know.
All right.
Well, now, is that the only thing out there, or are there other packages to do this, or?
No.
There's actually other programs, too.
I definitely found that Kane was the best, and I've been looking into this stuff, like,
all last week.
I was messing with it, and a lot of people have probably heard of Vomit before.
It has a really cool name.
I think it got voted, like, best application name of 2004 or something.
But Vomit stands for VoiceOver Misconfigured Internet Telephony, or Internet Telephones, basically.
And it was the first one that came out.
It was, like, the first program that did this.
I don't know if it was, like, a proof-of-concept thing or anything like that,
but it came out, like, early 2000.
Well, actually, I think one version came out a long time ago, like, 2001,
and then an updated version.
The last updated version came out in early 2004.
And compared to Kane, it's not really that good.
It only works on G711.
I'm assuming that's G711 U-Law and A-Law, both American and European standards.
That's the only thing it works?
That's the only one it works on?
Yeah.
I mean, Kane has, like, that long list of all these protocols that I don't even know what they are.
Or codecs, I'm sorry.
I don't even know what the codecs are.
Right.
But G711 is the only codec that Vomint works on.
It is Linux-based, though.
So that's kind of cool.
Now, I'm sorry.
Back to Kane.
Kane, you said, was a Windows-based?
Yeah.
It's Windows-only.
It's, like, a GUI program and everything.
Oh, it's Windows-only.
So it's not ported.
It's only in Windows.
Yeah.
Okay, and this one is only in Linux.
Yep.
Okay.
All right, go ahead.
So, yeah, it's kind of old, and it's not really good anymore.
It lacks a lot of features.
And I haven't played with it that much, basically, because it's so limited.
But I guess it worked.
Yeah, it's probably right.
It was, like, the first program, or one of the very first programs,
that would capture the Void packets
and it would be able to reassemble them into a nice little WAV file for you or whatever.
Right.
And play it back.
Yeah, it sounds like a proof of concept.
And then there is another program, too.
It's called Scappy.
I just saw this the other day when I was at Barnes & Noble,
and I was checking out Hacking Exposed 5th Edition or something like that.
Right.
And it has, like, a whole VoIP section and telephony chapter.
So I was going through that, and at the end,
they kind of just threw, like, maybe five pages together about this VoIP stuff.
And they didn't actually, I don't think they actually talked about Kane.
It might not have been out when they wrote it.
But they talked about Vomit, of course.
And then they talked about this other one, Scappy.
And the website is secdev.org.
Yeah, we'll put up all the links in the show notes afterwards.
We'll definitely put up all these links for those of you
who want to make sure you can check these out.
Yeah.
And so I haven't really played with this or anything,
and I've been trying to look at the documentation all day
and find out which codecs it supports and everything,
but I didn't find out that much.
So supposedly it's, like, an all-in-one program.
It does all this stuff, art poisoning.
It has all these, it has, like, all the stuff from Nmap built in.
Basically it incorporates a lot of features from other security programs
and utilities for one.
But I don't know.
I'm not sure how the whole VoIP thing works.
I guess I can just read the packets.
It's called VoIP Play.
The feature's called VoIP Play.
Okay.
That's about as much as I know about that.
But it looks kind of cool.
It could be interesting.
Like, they're still developing it.
So it could be an up-and-coming program.
It's obviously for Linux.
Right.
Stuff like that.
And so the thing that got me into this in the first place,
all this stuff, was about, what is it now, the end of May, almost June.
Right.
So, like, two months ago, this thing for Asterisk came out.
It's called Chanspy.
And this was in there before in the CVS, but it was only in there for a little bit,
and it didn't work very good.
Right.
And so they started, they added this on March 24, 2005, to the CVS.
And it's a pretty cool program.
Basically, under PBX, you can monitor any call that's going on at the time.
And they say that it's useful in a call center, you know, to monitor agents.
And so that's basically, it's intended use.
Right.
I mean, I found it's pretty cool.
You can just, like, put it on some random extension, dial in and listen to people.
Right.
Well, hey, we're listening in on people right behind you right now, apparently.
Yeah, definitely 15 cell phone conversations are going on behind me.
But, yeah, the call center, I mean, if you're, you know,
this call may be monitored or whatever for quality assurance purposes and whatnot.
Yeah, you never know.
There might be somebody actually sitting in there cycling through these agents' calls.
Yeah, I can tell you from experience that these telemarketing places, they have places.
Did I just say places as though it were a normal word?
Because it's not.
Telemarketing places.
They'll have, like, a manager who sits back there and just every once in a while will punch up one of the random people
and listen to them just to make sure that they're not making personal calls or making sure they're, you know,
giving their little spiel properly and whatnot.
So, that's, I mean, that is, I'm sure, what it's intended to use is something similar to that.
Well, yeah, ChansFi is really cool, though, because it does pretty much anything that works on Asterisk,
like IAX2, SIP, ZapTel stuff, which is regular telephony hardware, normal potlines and stuff like that,
normal telephones, just an H323.
It can listen to anything, like, because you're actually doing it on the system while the call is going on.
It just, I'm not sure how it works.
Like, I need to look at the source.
I want to look at the source, actually, and try and read it and see how everything works.
But it's pretty cool because it works with, like, every VoIP protocol.
Now, what is it, okay, let's, so it sounds like, listening to me, it sounds like, why would you use,
when would you use Cain versus ChansFi?
ChansFi you would do if it was, like, your own PBX, or if you somehow gained access to somebody's Asterisk.
Oh, okay, I see.
Yeah, but Cain is basically, like, you go in and you infiltrate their network and just set up ArtPoison and see.
I don't know, it's really cool, though.
Yeah, I know, yeah.
It's important to do on your own network.
If you want to monitor your own network or whatever, and you have, like, some Cisco phones or something,
I think Cain would be really good.
Yeah, very cool, very cool.
Now, what, for the one that is built into Asterisk, the ChansFi, what all can it do?
I mean, what else can it do?
Are there other things or other?
Yeah, there's, yeah, there's a bunch of things, like, it can break into a line silently, you know,
or it can play, it can announce a tone, it can do something to let people know that somebody came in there.
It can spy on bridge calls, which is, like, where you call in and you call out, stuff like that.
And you can adjust the volume, it's kind of cool, you just, like, press, I think, let's see, what is it, pound to adjust the volume.
You can get, you can, like, blast them really loud and do a thing to them, I don't know.
And, let's see, what else?
There's a thing where it enforces groups, so you can kind of limit who you're monitoring, but I haven't played with that at all.
Hmm, that's cool.
Yeah.
It works, it's really easy to use, too.
You just basically set it up on an extension, and then you call that extension, and automatically starts cycling through it.
It automatically finds the channel, if there's one open, and it breaks into it, and so it drops you right into the call.
And then from there, you hit star, look for another channel.
If there's more than one call going on, it'll just jump to the next one, and pound, like I said, that adjusts the volume and stuff.
I think it's really cool, though.
I don't know, it's a good program.
There used to be these other ones.
There used to be these other ones for Zaptel hardware only, and that was called ZapBarge.
But, like I said, it only works on Zaptel channels, normal phone lines.
Basically, you have to have the Zaptel hardware, which a lot of people don't have.
They just set it up completely VoIP with the asterisk.
Right.
It's kind of cheaper.
You don't have to buy any expensive hardware.
All right, so if you know for certain that they're using Zap or whatever.
You can still, with Chanspy, you can still spy on their Zaptel stuff, though.
Oh, okay, well then, yeah.
So there's really no need for ZapBarge anymore, even like Chanspy is that good.
Right, awesome.
Kind of cool.
I don't know, I've been really psyched on these programs, though.
It's been fun lately, messing with them.
Yeah, have you been, what else have you been doing asterisk-wise?
You got any other asterisk stuff to talk about?
Yeah, well, we did the, I don't know.
I didn't want to, wait a minute, I don't want to, I don't want to sidetrack you off of,
I don't want to pull you off of this if you still wanted to, if you had any more stuff to talk about.
No, I wanted to get into this.
I wanted to get into the whole Super Caller ID program thing.
I don't know if you saw, I don't know if you were following on the forums, but Strom basically
came up with this really cool Super Caller ID program that he has running on this terminal
in his house, and when he gets a call in his asterisk box, it just runs, it dumps the data
into his program, and then it does some lookups.
He actually has it using his LERD database, so he has like the official telephone information
and stuff about the central offices and all that, but yeah, so this program, it gets like
a bunch of information, it'll get the caller ID, the name, and then it'll use, well, his
will check the LERD, and the one I made that I put on oldschoolfreak.com, that one checks
Bell's Mind, and it grabs the data from Bell's Mind, and it grabs data from, what is it,
waypages.com too, and it puts it all into this one like screen, and so basically you
get all this information about who's calling, like a lot more than you would ever get from
the telephone company, on your little car ID box.
Cool, cool, and this is on oldschoolfreak.com you said?
Yep, oldschoolfreak.com, and Strom basically came up with the idea, and I didn't have LERG,
so I had to, I couldn't just take his code and use his, so I had to find something, some
way to make like a duplicate program, so what I did was I used bm.pl by Duel, the Bell's
Mind command line interface.
That's Perl, you said bm.pl?
I'm sorry, you broke up, did you say it was bm.pl, right?
That's Perl script?
Yeah, bm.pl, it's the Bell's Mind command line interface program that's dual made, so
I took his code because it already looked up everything from Bell's Mind, and I just
had to make some little modifications to the input that asterisk gives, that Bell's Mind,
that asterisk puts into the program.
All right.
So, and then Strom gave me some code, too, he gave me his waypages.com lookup stuff, and
we incorporated that in it, too, so it gets a lot more information, which is really cool.
I've been using that, like, I set that up on all my lines and stuff, so I have a little
terminal screen open on my laptop, and it watches the information as it comes in live.
Very interesting.
Yeah, it's kind of cool, it's a lot better than any car idea the phone company would ever
offer, you know?
All right, right, right.
I wonder, what does it show, like, from our payphone we called from earlier?
I wonder what that would show up.
Well, I called you, actually, but...
It would show the number, and then the CNAM would probably be, it would probably show
a payphone, or just the city and state, and then it would try and look it up on white
pages, and it probably wouldn't find anything, so that would be blank, but it would put it
into Bell's Mind, and it would give you all the information about the CO.
Yeah, I wonder if...
You could see the address of the CO, so you'd know, like, what part of the city it was in.
You'd see all the other exchanges that it serves.
I wonder if you could tie it into Yapple.
What's that?
I wonder if it could be tied into Yapple.
What's that?
Oh, you had another payphone list?
Right.
I wonder if it could be tied into Black Ratchet's Yapple, which I know is also integrated with
Bell's Mind.
Mm-hmm.
So that might be cool.
Yeah, there's a lot of cool stuff you could do with this now.
I don't know.
Strom had a really good idea, and I'm glad that, like, I found some way to do it without
needing LURG.
Right.
So, yeah, shout-outs to, uh, Duel and Strom for their code.
Yeah, I just, um, I just spoke to Duel the day before yesterday, and, um, trying to get
him to come up to Vegas for DEFCON.
He's not sure if he's going to be able to make it or not.
Uh, yeah, I asked him about that, actually.
I emailed him, but he hasn't gotten back to me yet.
Yeah, he's, um, got work things to deal with, so he's tied down with work, so hopefully
he can get away, but it probably will be a last-minute call.
If he can make it or not.
Yeah, that'd be really cool.
So, um...
Always good to see Duel.
Check out old...
We'll definitely have oldschoolfreak.com stickers for DEFCON, too, for all the dinner
of people that know me.
Gotta find me, I'll give you some stickers.
Yeah, I don't know what we're gonna do for DEFCON.
It's, it's ridiculously expensive to, like, set up a booth there.
I mean, it's, it's just like, they don't want...
I was blown away.
I can't believe how much they want to set up.
I mean, you can't set up just a small, people like us.
How much do they want?
Because I've never looked into it.
I don't remember offhand.
It was so much that I just said, what the hell?
And I just closed it.
I mean, it was just something outrageous.
So, I, I don't know, unless I can call up and say, hey, you know, help a brother out, you know?
Gee, man, I'm not trying to make money.
I'm just trying to spread some information and let people out there, you know, find out
about the radio show and the magazine and whatnot, you know?
Jeez, I would never make, it was, it was so much that I couldn't make enough to break
even, even close.
I mean, forget about it.
Damn, that sucks.
Yeah, I might bring a few copies and maybe carry them around with me.
Do some guerrilla marketing.
Yeah, exactly.
Do a little viral marketing or something.
I'll definitely, I mean, stickers and stuff like that, I'll definitely bring some BinRev
stickers and same, like you said, with the old school freak stickers and bring the small
stuff that I can throw in my luggage.
But, like, to print off, you know, copies of the magazine is, A, a big investment financially
for me to go get them all printed, as I've talked about before.
And, you know, having those shipped down there and having to carry around these big boxes
with no table or booth to set up, that's kind of rough.
So I might bring a few, you know, as many as I can carry or fit into my suitcase, but
they're going to be probably gone quick, so.
Do you think we'll have the new issue by then?
Yikes, you're going to put me on the spot, on the air, on the show.
I am, on the spot, I want to know.
I do not know, honestly.
I really do not know.
It would be close if we did.
I think we should work towards that goal.
I agree with you, and I will, but there will be more.
I know, we only have so much time.
Yeah, and I can't say this on the show right now, but there will be some upcoming changes
in general that will hopefully free up some time for me to work on projects like this better.
So I guess we'll leave it at that.
So let's, I guess, start wrapping up a little bit, unless there's something else you wanted
to hit before we jumped out of the main section.
I don't know, did you enjoy my topic?
Did that make sense?
Yeah, absolutely, absolutely.
Amongst all the horns and the squealing tires in the background.
Yeah, I know, sorry.
No, but actually, I think that's funny.
I'm the one that said, you know, let's do it from down to the payphone or something,
which the payphone was just poor quality.
Damn, what is it?
What is it?
Was it Verizon?
Yeah.
Yeah, figures.
Can you hear me now?
Don't know, fucker.
They need to check their cell phones.
Yeah, they do, for real.
I have no reception at all inside my apartment.
Yeah.
Nobody with Verizon, nobody with Verizon ever does in my house.
It really sucks.
This is just one more reminder that we are putting together a hacking show.
We're not using high quality stuff.
We're not using Skype.
I'm not trying to make crystal clear quality of everything.
You know what?
We're having fun doing the show.
And if that means we're in the streets of New York City when we're doing it,
or out driving around for prostitutes, or whatever the case may be.
God damn it, that's right.
We're going to do whatever it takes to make the show fun.
Oh, yeah.
Quality be damned.
Oh, yeah.
Keeping it gangster.
Keeping it old school.
That's right.
Straight from the streets.
All right.
Well, I've got a, for side of the week, I guess I'm going to,
I don't have a great tech side of the week,
but I'm going to give my side of the week is CheapoVegas.com,
because I've been on there all week, like, doing hotel comparisons
and looking up who has the best this and lowest price and customer reviews
and stuff like that.
So that's my side of the week, trying to get ready for DEFCON.
So, and, of course, we already mentioned OldSchoolFreak.com,
so we can't give that a side of the week again.
Yeah.
And shouts.
Why don't, well, I'll tell you what, I already gave my shouts earlier.
Gelata and Saffron sent in the opening clip from the show,
so shouts to them.
And, Natus, go for it.
What do you got?
I don't know.
Shouts to Nick84, Not Very Course, Doug Lucky.
Let's see who else helped me out with all this stuff.
I don't know.
Just anybody in the Asterisk community, anybody that's down with Asterisk.
All right.
And the developers of all the products or all the applications we mentioned earlier,
of course.
Yeah, for sure.
Everybody at Kane, they're working on that stuff like crazy.
All right.
Really awesome.
Everybody who contributes to OldSchoolFreak.com,
my shouts go out to you, too.
Keep sending in articles.
Yep.
The site is still putting out lots of good and interesting stuff.
I mean, the site's still going along quite well.
How's the, um...
Yeah, make sure you check out Super Caller ID.
Yeah, what, um, are we, what episode of RFA are we up to?
I know we relaunched the podcast with episode one a while back,
and what episode are we up to now?
Like, ten?
Oh, man.
Ten or eleven, I think.
Yeah.
It's got to be right up there.
And the new ones, uh, the new ones, well, the new one will be yesterday in radio time,
tomorrow in real time.
All right.
So, um, okay, email us if you have any questions, comments, flames, or dirty pictures to send us.
Send them to radio at binrev.com.
And, Natis, you have some closing music for us this week.
Yes.
This is my man, Reggie, a.k.a. the Mr. Move, with Kitty Full of Beer.
And this is, this is an, this is an internet exclusive, right?
Is this a first time, uh...
Yes, this is an internet exclusive.
This is an exclusive track my man gave me.
Nope.
So check it out, and check it, if you live in Atlanta, uh, check out his website,
because I think he's going to Atlanta and having a show really soon.
Cool, cool.
And, of course, we've closed with him before.
I'm a fan of his.
I like his stuff as well.
So, that is our closing music for this week, and I think that is the show for this week as well.
So, Natis.
Oh, yeah.
Thank you for being on once again.
Thank you for having me.
And for the ambiance and the, uh...
That one outtake is going to be hilarious.
When people hear that outtake on the, uh, on the...
Oh, Jesus.
...second year episode, that one's going to be pretty funny.
People don't realize how, uh, what got edited out of this episode,
but they'll find out on episode 104.
But, until that episode, we will see everyone again next week.
Same hack time.
Same hack channel.
I'll catch you for a comb.
Peace.
Who wants a titty full of beer?
I do, I do.
Get rid of the milk and have the broom.
True.
Who wants a titty full of beer?
I do, I do.
Suck your jug see your nipples turn blue.
Who wants a titty full of beer?
I do, I do.
Get rid of the milk and have the broom.
True.
Who wants a titty full of beer?
I do, I do.
Suck your jug see your nipples turn blue.
Oh my god, you must be a rookie
How about you go grab an A-cup and a cookie
Your bra's still full of utter butter
Once you suck down a D-cup and start to stud
An ass, the bitch was full of a natural light
Full of them mams with mine, they'd be full of butt ice
Come on, play me, grab that ass tight
But when I fucked it, just a free reboot was a fight
I guess I like my girlfriend just the way she is
But if she had a full bar to rack for being biz
I'd be feeling better about paying the date
If I could just eat from the tip, sure it'd equate
Then I wouldn't have to worry about going home
Screwing up with some girl who all has burnt foam
I'd rather do cash, stands on demand
But the girl has some souped up memory glass
Who wants a titty full of beer? I do, I do
Get rid of the milk and have the brew
Who wants a titty full of beer? I do, I do
Suck your jug, see your nipples turn blue
Who wants a titty full of beer? I do, I do
Get rid of the milk and have the brew
Who wants a titty full of beer? I do, I do
Suck your jug, see your nipples turn blue
Girl, you got a pretty face and a real nice ass
But I shoved that breastwork pass
And long last night's got it right
Should've deppin' ass, I think I'd deppin' nipples tonight
Oh, I got a new diet, blood light ain't gonna tighten
And left five months to be high, it ain't a riot
Maybe a poo, ooh, liquor when I lick her
Forget your booze, pussy gets me drunk quicker
Don't laugh, don't think her
Cause if your booze comes bigger, probably gonna pick her
Oh, your new DNA is PBR
I go to a bar when I can lift up his shirt in the back of my car
I got a gun instead of Arte Swat
Heaps his pills, a little cleavage, I don't care
She's sorry, she's like Corona
I wanna bone you, your rack of lamb
Got me one to be a poo
Who wants a titty full of beer? I do, I do
Get rid of the milk and have the brew
Who wants a titty full of beer? I do, I do
Fuck your jug, see your nipples turn blue
Who wants a titty full of beer? I do, I do
Get rid of the milk and have the brew
Who wants a titty full of beer? I do, I do
Fuck your jug, see your nipples turn blue
Everybody getting tipsy from the nipple
Who wants a titty full of beer? I do, I do
Get rid of the milk and have the brew
Who wants a titty full of beer? I do, I do
Fuck your jug, see your nipples turn blue
Who wants a ticket full of beer?
I do, I do
Get rid of the milk and have the brew
Who wants a ticket full of beer?
I do, I do
Kuck your jealousy and nipples turn blue
Who wants a ticket full of beer?
I, I, I, what I do
Who wants a ticket full of beer?
I, I, I, what I do
Who wants a ticket full of beer?
I, I, I, what I do
Who wants a ticket full of beer?
I, I, I, what I do
We'll be right back.