WEBVTT 00:00.000 --> 00:08.600 This is dedicated to all the hackers and the crackers, to the hackers and the crackers. 00:09.020 --> 00:14.680 I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you 00:14.680 --> 00:15.620 in a fag phone. 00:15.880 --> 00:20.800 In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold. 00:21.060 --> 00:25.600 I was a dick with my 56, now with my cable, I'm able to get that stable. 00:25.880 --> 00:27.900 On the out, my name is Ace and I'm a Leo. 00:27.900 --> 00:31.640 On the digital highway, my name is Neo and I'm a Nero. 00:31.840 --> 00:33.900 In a flash, I'll screw you on burning dreamcasts. 00:34.640 --> 00:37.520 You need some ISOs? Let me through my hard drive rifle. 00:37.860 --> 00:39.540 Our exchange you could never stifle. 00:39.820 --> 00:42.680 In a digital hug, you just caught the love bug. 00:43.000 --> 00:46.700 I bootlegged your CD, I caused a fight between Un and Jay-Z. 00:47.060 --> 00:51.280 Your CG, it's all gonna be free, whether we take it by force or we take it nicely. 00:51.720 --> 00:55.440 You feel that rattle in your bones, when I tell you we just hacked out Jones. 00:55.440 --> 00:59.900 And NASDAQ leaves your fight on your back, cause I am he who loves to hack and crack. 01:00.120 --> 01:02.600 Cause I am he who loves to hack and crack. 01:03.080 --> 01:05.940 This is dedicated to the hackers and the crackers. 01:06.200 --> 01:09.660 Serial code, source code, ISO, RAN. 01:09.760 --> 01:16.120 Hello, happy Pi Day, and welcome to Binary Evolution Radio, episode number 139, from March 14, 2006. 01:16.360 --> 01:17.340 I'm Strom Carlson. 01:17.340 --> 01:21.340 I'm Black Ratchet, and what's this evening is... 01:21.860 --> 01:23.440 I don't even... I've never actually shared this. 01:23.700 --> 01:25.480 Is it Dubeeve or Beeve? 01:25.980 --> 01:27.280 It is Dubeeve. 01:28.980 --> 01:29.460 Dubeeve. 01:29.540 --> 01:31.940 So we have Dubeeve with us, of Telefreak Frame. 01:34.900 --> 01:35.340 Yep. 01:35.620 --> 01:36.320 Yeah, I guess so. 01:36.580 --> 01:37.540 Yeah, Telefreak Frame. 01:37.540 --> 01:42.180 For those of you who don't know what Telefreak is, it's a... 01:42.180 --> 01:43.440 What is Telefreak? 01:43.540 --> 01:44.380 You can actually... 01:44.380 --> 01:45.180 I've never been... 01:45.180 --> 01:50.100 It's a conference and a bunch of voicemail boxes and other stuff and VoIP goodness. 01:51.080 --> 01:54.980 Actually, yeah, it's a teleconference bridge, stuff like that. 01:55.300 --> 02:02.440 It's also just a small group of us who just enjoy screwing around with Asterix and developing software 02:02.440 --> 02:07.560 and just having a good time, you know, between our small little group of people who actually 02:07.560 --> 02:08.760 run Telefreak itself. 02:10.880 --> 02:14.260 You mean there's people who don't enjoy developing software for Asterix? 02:15.540 --> 02:17.040 But how is that possible? 02:18.220 --> 02:19.060 Well, this is true. 02:19.460 --> 02:21.760 Well, I mean, we do other things outside of that as well. 02:22.800 --> 02:27.620 But, you know, just a little project, just a little group of us, you know, hacking away 02:27.620 --> 02:27.880 and stuff. 02:27.900 --> 02:28.920 General messing about. 02:30.060 --> 02:30.460 Exactly. 02:31.580 --> 02:31.940 Exactly. 02:32.440 --> 02:42.840 We are live tonight and we have Dr. Zygmunt on the phone lines waiting for your phone calls. 02:43.000 --> 02:47.280 So if you want to go call in and we're looking for phone calls tonight. 02:47.380 --> 02:48.260 I mean, we do have a topic. 02:48.660 --> 02:54.240 I actually posted in the IRC chat room today that please listen to the episodes and send 02:54.240 --> 02:58.360 us email because we got nothing and I've had two or three people say, have you found a topic 02:58.360 --> 02:59.380 for tonight's show yet? 02:59.620 --> 03:01.840 And I said, yeah, we've had a topic for a while. 03:02.440 --> 03:07.200 And people were incorrect in assuming that when I say, please email us, we got nothing 03:07.200 --> 03:13.240 to mean, please email us, we have no email instead of, please email us, we do not have 03:13.240 --> 03:14.640 a show topic tonight. 03:14.640 --> 03:16.940 So, I think snow topics are more popular. 03:16.940 --> 03:18.200 Either way, no one emailed us. 03:19.260 --> 03:20.560 Well, we have like one email, don't we? 03:21.700 --> 03:22.620 We have one email. 03:22.780 --> 03:24.260 We can always fabricate the email. 03:24.400 --> 03:24.740 That's about it. 03:25.840 --> 03:27.280 I was actually tempted to do that. 03:27.340 --> 03:31.300 I was tempted to just write like four or five emails to you, Strom, on why you're constantly 03:31.300 --> 03:34.800 picking apart people's grammar and why you never update the archives. 03:34.800 --> 03:42.620 Well, the lack of archive updates, which there are up to date now, has been due entirely 03:42.620 --> 03:46.080 to my procrastination and holy God, can I procrastinate? 03:47.680 --> 03:48.560 Like, no, you're busy. 03:48.740 --> 03:50.520 I thought I was lazy until I met you. 03:51.340 --> 03:51.620 Yeah. 03:51.620 --> 03:54.580 Like, seriously, it's just a... 03:54.580 --> 03:56.780 But we are live tonight, laziness and more. 03:57.360 --> 04:01.100 So, I probably should take an oath or something to update the archives. 04:01.920 --> 04:03.520 Oh, we already have that covered. 04:03.700 --> 04:03.800 Yeah. 04:04.180 --> 04:06.400 Trying to steal my thunder here with my oath, so. 04:07.220 --> 04:08.560 I thought we were going to do a live on the show. 04:08.560 --> 04:10.200 So, email tonight is eight... 04:10.200 --> 04:12.600 Well, we are going to do a live on the show, we're just going to do it after the email. 04:12.860 --> 04:13.540 Oh, ho, ho, ho, ho, ho. 04:14.000 --> 04:19.520 We're going to have 888-9-BINREV for your phone calling us, so, you know, call up, 04:19.520 --> 04:20.980 or call Beave, or whatever. 04:21.620 --> 04:22.980 We're looking for topics tonight. 04:23.620 --> 04:23.760 Yeah. 04:25.560 --> 04:26.040 No. 04:27.320 --> 04:33.880 Also, apparently, our phone number does work in Britain, according to the person. 04:34.020 --> 04:39.500 He emailed me today, or emailed me at some point in the past couple of days. 04:41.620 --> 04:43.260 So, that's 08... 04:43.260 --> 04:44.620 Hold on, see if I can't pull it up here. 04:44.900 --> 04:47.760 I just read this just before the show. 04:49.040 --> 04:50.200 0800, dog ball. 04:50.200 --> 04:53.100 If you remember our UK call-in number, here we go. 04:53.180 --> 04:55.200 It's 0845... 04:56.880 --> 04:59.380 Oop, and that's not it. 05:01.480 --> 05:02.960 Whatever we gave it before. 05:03.700 --> 05:05.640 0845-123-4567. 05:05.800 --> 05:06.100 Who cares? 05:06.180 --> 05:07.140 No one's listening in Britain anyway. 05:07.920 --> 05:08.680 Yeah, I'm unprepared. 05:08.840 --> 05:10.440 Go, go, go, go yell at me. 05:11.980 --> 05:13.940 Shall we just delve directly into the email? 05:13.940 --> 05:17.540 Yeah, why not, unless you've got some sort of housekeeping to take care of. 05:18.820 --> 05:20.700 No, I think that's basically it. 05:20.700 --> 05:48.600 Yeah, the UK call-in number, for those of you curious, are 0845-646-0102, which allegedly still works as of today. 05:48.600 --> 05:55.720 And what the person has been very nice and sent to us, he actually will... 05:55.720 --> 06:01.880 When you call the phone number, you will hear a recording saying that it's going through, and it will ring our call-in number. 06:02.220 --> 06:08.100 So, if you don't hear that recording, there's something messed up, but hopefully you should hear a recording. 06:08.600 --> 06:10.460 It doesn't actually say what the recording is, for all we know. 06:10.720 --> 06:12.540 It could be a busy signal. 06:12.540 --> 06:16.400 It could be, you're calling Dogballs Incorporated. 06:16.540 --> 06:17.040 Please hold. 06:17.720 --> 06:23.680 It says, I have just updated the dialing plan, so it plays a wait message before dialing the BRR number. 06:23.900 --> 06:24.940 I wonder what a wait message is. 06:25.500 --> 06:27.700 Probably something I'd please hold while we complete your call. 06:28.500 --> 06:28.780 Yeah. 06:29.260 --> 06:31.720 The following phone number is not free in the UK. 06:34.240 --> 06:36.960 So, what's our first and only email tonight there, Strom? 06:36.960 --> 06:39.960 Our first and only email is from Machinescrew. 06:41.060 --> 06:48.780 He writes, I just got a new PSP and got the 2.6 firmware, which includes an RSS slash audio podcasting client. 06:49.160 --> 06:56.420 I have many shows on the thing, but it seems that you dropped as of February 25th, because I have so many shows I listen to, I can't remember all the times the shows are live. 06:56.420 --> 07:09.420 There is, Newsreel, DL.TV, Hack.5, Twit, Twat, Linux Link Tech Show, The Source Show, Security Now, Dignation, InDigital, so please put up the dang thing. 07:10.420 --> 07:13.640 Also, in response to the DIG suing gig, that is also not true. 07:13.740 --> 07:16.260 According to him on Twit, when asked about it, he found it as a compliment. 07:18.020 --> 07:24.160 So, this actually illustrates a couple of very interesting reasons on why people should update podcasts when they have archives. 07:24.160 --> 07:28.900 A, we've updated, we've answered the Twit questions for the past three episodes. 07:29.640 --> 07:36.960 Or, not the Twit question, the, uh, the YIG slash DIG question, and we've had two or three people say, hey, it's on, it's Kevin Rose, he was on Twit. 07:37.700 --> 07:40.120 But, no one knows that, because someone didn't update the archives. 07:40.340 --> 07:45.960 And, also, we have people who are very angry with people who do not update the archives. 07:46.260 --> 07:52.140 I actually was sick and tired of receiving the hate mail, so I updated the IRC topic recently, and actually said people to talk to Strom. 07:52.480 --> 07:53.220 And, I guess it worked. 07:53.220 --> 07:54.240 And, yeah. 07:55.140 --> 07:58.000 So, my incredible guilt finally got the best of me. 07:58.220 --> 07:58.820 I guess so. 07:59.360 --> 08:04.180 So, Strom, raise your right hand and put the other hand on your computer or something. 08:04.340 --> 08:06.940 I'm going to raise my right hand and put my other hand on my telephone. 08:07.360 --> 08:08.100 Okay, or that. 08:08.180 --> 08:09.840 I, Strom Carlson. 08:10.020 --> 08:11.040 I, Strom Carlson. 08:11.480 --> 08:12.720 Will update the archives. 08:13.120 --> 08:14.500 You forgot to do solemnly swear. 08:15.280 --> 08:16.520 Well, you, I don't know. 08:17.340 --> 08:17.940 I don't do these things. 08:17.940 --> 08:19.480 Let me make it up as I go along. 08:19.480 --> 08:33.540 I, Strom Carlson, do solemnly swear to update the BINREV radio archives the night we broadcast the show, and if not, to do it as soon as humanly possible so that you, the listeners, can listen to your wonderful podcast instead of bothering to listen to us live. 08:33.540 --> 08:34.360 Amen. 08:34.360 --> 08:34.480 Amen. 08:35.140 --> 08:37.060 Well, because certain people can't listen to us live. 08:37.140 --> 08:42.020 They're not a, like, crazy person who were in Germany who listened to us live that one time. 08:44.080 --> 08:45.640 It's like 3 a.m. or something. 08:45.760 --> 08:53.200 He, he, he might be, he completely does not know that we could have read his email on air because someone didn't update the archives. 08:53.200 --> 08:54.800 But, either way. 08:55.020 --> 08:56.840 Anyway, our archives are updated now. 08:56.860 --> 08:59.600 I wish you'd just refer to me directly instead of calling me someone. 09:00.620 --> 09:05.140 Well, I'm, I'm just, I, I, I enjoy, it, it just further degrades you, I think. 09:05.760 --> 09:06.060 Aw. 09:06.680 --> 09:07.840 I love you too, Ratchet. 09:08.020 --> 09:08.500 Yeah, seriously. 09:08.620 --> 09:12.180 If this was, like, default radio and I was decoder, like, you, you'd be fired by now. 09:12.960 --> 09:14.580 How about fuck you and I'm opening a Starbucks? 09:16.760 --> 09:20.580 I think we should start taking, uh, bets on how long it takes them to, uh, update. 09:21.080 --> 09:22.500 How long it takes them to fall behind. 09:23.920 --> 09:26.440 I'm, I'm, I'm giving, I, I think the over-under should be two weeks. 09:26.540 --> 09:30.480 I mean, he, he, it won't be this week, but it'll be next week that something will go wrong. 09:31.940 --> 09:33.260 Yeah, go for a time frame, yeah. 09:33.380 --> 09:34.940 I, I think he's going to do it for about a month. 09:35.840 --> 09:40.680 And then, you know, get busy, you know, real life stuff, and then, uh, kind of fall behind. 09:41.020 --> 09:42.180 Then he'll have to take the oath again. 09:42.980 --> 09:43.240 Yeah. 09:44.280 --> 09:46.780 I don't know, what, what, what, what should be the punishment if you don't update the archives? 09:47.340 --> 09:47.620 Hmm. 09:49.120 --> 09:50.260 Something involving lube? 09:51.500 --> 09:52.320 You'd enjoy that. 09:52.440 --> 09:52.900 Look, anyway. 09:53.200 --> 09:53.440 Yeah. 09:54.440 --> 09:58.280 Okay, we're, this is just, like, completely going nuts right now, because as soon as we 09:58.280 --> 10:01.600 start talking about lube, I just, like, no, no, no, no, no, no. 10:03.200 --> 10:04.760 So, that was our one email tonight. 10:05.760 --> 10:10.100 And, uh, hopefully we'll get tons of email next week because people will listen to the 10:10.100 --> 10:14.060 last two episodes and will have questions and comments and such. 10:14.060 --> 10:14.620 So, anyway. 10:14.620 --> 10:19.720 So, uh, personal hacking stories. 10:20.720 --> 10:23.760 Strom, what have you been doing since you've had copious amounts of free time without updating 10:23.760 --> 10:24.280 the archives? 10:24.280 --> 10:25.700 Are you kidding? 10:25.700 --> 10:25.720 Are you kidding? 10:25.840 --> 10:27.020 I had copious amounts of nothing. 10:28.520 --> 10:30.000 I've been busy like crazy. 10:30.100 --> 10:31.340 I haven't done much hacking. 10:33.800 --> 10:37.500 Like, pretty much all I've done is I've done virus scans and stuff. 10:39.440 --> 10:39.600 Hmm. 10:39.760 --> 10:40.980 Virus scans are fun. 10:40.980 --> 10:45.480 Yes, and I've contemplated rebuilding my Windows box because it's gone straight to hell. 10:46.940 --> 10:49.180 You mean there was a point that it wasn't going straight to hell? 10:49.960 --> 10:55.140 Well, no, but I'm saying it's been on the journey for quite a while and now it's there. 10:55.140 --> 10:58.140 Like, it's arrived and there's no worse it can get. 11:00.700 --> 11:01.640 What's the rule of thumb? 11:01.820 --> 11:05.660 At least for NT, for me, it was you've got to reinstall the box at least once a year. 11:06.700 --> 11:11.420 Yeah, this, I think, has been since, I think, maybe April? 11:12.100 --> 11:13.200 May or May or June or something? 11:15.180 --> 11:21.360 Yeah, with 2000 it got better, but with literally, when I was running NT4, you had to install it 11:21.360 --> 11:24.220 at least once a year because it was just, it got horribly slow. 11:24.220 --> 11:25.160 At least for me. 11:26.780 --> 11:30.160 Of course, I think part of the problem was it was just fragmented to hell and there was 11:30.160 --> 11:32.260 no defrag built right into NT4. 11:33.140 --> 11:37.220 So, that was always annoying, but, yeah, so it was once a year. 11:37.320 --> 11:41.360 Basically, every June, when I started working at my co-op, I would have the same computer 11:41.360 --> 11:45.480 because I would work there part-time during the winter, but every year I would, like, 11:45.580 --> 11:50.640 June, right before I started full-time again, I would just backup everything, reinstall it, 11:50.640 --> 11:54.920 spent, like, you know, six hours reinstalling it because you had to reboot after you installed 11:54.920 --> 11:56.020 every freaking driver. 11:56.880 --> 11:58.980 And, uh, that's what I did for a day. 11:59.080 --> 12:00.100 I just reinstalled my box. 12:00.180 --> 12:04.720 By the time I started full-time again, it was nice and zippy and responsive, and then it 12:04.720 --> 12:06.520 just started the downward spiral once again. 12:06.520 --> 12:13.840 Yeah, also, I bought, like, a 400-gig hard drive to put the new install on, so that should 12:13.840 --> 12:14.140 be fun. 12:15.280 --> 12:17.740 Yes, because, you know, everyone needs 400-gig hard drives. 12:18.660 --> 12:21.740 Is just me or, like, the hard drive space just, like, getting way out of hand lately? 12:22.220 --> 12:23.560 It's just getting huge. 12:23.620 --> 12:25.860 I think that there's a decent demand for it. 12:26.200 --> 12:30.780 I mean, there's this explosion in digital media, and, I mean, pretty much if I had tons 12:30.780 --> 12:35.700 of hard drive space, I'd just have MP3s up the wazoo, and video, and don't forget, every 12:35.700 --> 12:39.800 episode of BINREV takes up quite a bit of space anyway, because I keep all the original 12:39.800 --> 12:40.180 files. 12:41.660 --> 12:46.320 I mean, that's the only thing that I can see taking it, and only that would say it's, you 12:46.320 --> 12:50.500 know, 64-bit MULAW, so, like, that's like 150 megs of pop. 12:50.640 --> 12:54.460 I mean, when you start, like, zooming it out, or what is it, or, like, stretching it out 12:54.460 --> 12:58.460 to, you know, 44 kilobits a second, it starts getting pretty hefty, but at the same 12:58.460 --> 13:00.540 point, you know, oh, whatever. 13:00.780 --> 13:01.340 I don't know. 13:01.460 --> 13:03.840 I can't foresee a use of a 400 gig hard drive. 13:04.360 --> 13:10.680 I have an 80, and I have a 160, and 160 is mostly full because I have, like, two or three 13:10.680 --> 13:14.800 computers backed up onto it that I've had to do consulting work on and reinstall. 13:15.940 --> 13:21.440 Yeah, and I also back up a lot of my DVDs and whatnot, so, of course, that takes up quite 13:21.440 --> 13:25.940 a bit of space as well, just so that I don't have to use actual DVDs and scratch them up 13:25.940 --> 13:29.500 and lose them or anything, so I always leave them on my hard drive. 13:29.500 --> 13:35.020 So I can watch them in the living room watching TV or at my computer or whatever I want. 13:35.660 --> 13:37.060 Let's not forget porn, too. 13:39.020 --> 13:41.220 Well, that's what I meant by videos and DVDs. 13:42.060 --> 13:43.580 Yeah, personally, I wasn't going to go there. 13:43.640 --> 13:51.200 I wasn't going to call him on it like that, but I guess if he admitted it himself, I'm always 13:51.200 --> 13:52.040 willing to go there. 13:52.040 --> 13:56.100 Well, technically, he admitted it to it, so it's like, I was going to say, oh, so what 13:56.100 --> 13:56.920 are those videos of? 13:59.320 --> 14:00.420 Oh, you don't want to know. 14:02.060 --> 14:07.880 Well, technically, I have an 80 gig hard drive, and I actually decided 20 of that for Linux, 14:07.980 --> 14:09.380 so I don't know what the space of that is. 14:09.380 --> 14:14.120 And I have like, you know, 50% free on it, and I actually don't know what's taking up 14:14.120 --> 14:14.760 that much space. 14:14.980 --> 14:24.540 But meanwhile, on my storage hard drive, I only have 36 gigs free out of 150, so I don't 14:24.540 --> 14:24.620 know. 14:24.660 --> 14:29.760 Most of that's like, you know, I know like 30 or 40 of that is just this one laptop, and 14:29.760 --> 14:35.040 this college student completely messed it up, and his mother gave it to me, and I backed 14:35.040 --> 14:38.840 up all the stuff, including his, like, you know, gobs of MP3s. 14:39.980 --> 14:44.040 I was actually saying, ooh, look at all these MP3s, and it was like, oh, like, you know, Jay-Z 14:44.040 --> 14:46.400 and Kanye West, and I was like, ugh. 14:47.640 --> 14:50.080 I got excited there for a second, and I was like, ooh, I could go further. 14:50.100 --> 14:52.840 Well, at least that's marginally preferable to, like, Britney Spears. 14:53.840 --> 14:54.780 Not by much. 14:55.540 --> 14:56.820 That's why I said marginally. 14:57.140 --> 14:57.680 Oh, okay. 14:59.420 --> 15:03.580 I'm about to do the hard drive shuffle and move, I think I've got a 200 gig drive that I'm 15:03.580 --> 15:07.400 going to put in the new asterisk box I'm going to build, and replace the current one, 15:07.480 --> 15:08.500 because that one's all full. 15:09.820 --> 15:13.380 Actually, speaking of hard drives, I think one of my server hard drives is going, which 15:13.380 --> 15:15.700 is annoying, because it's also my asterisk box, so. 15:16.420 --> 15:19.520 Actually, I know for a fact that two of my server hard drives are going, but those are 15:19.520 --> 15:22.100 just, I used for storage, which are in there. 15:22.180 --> 15:26.920 Sad that they're dying, but at the same point, I really can't complain, I guess. 15:27.020 --> 15:27.960 Should we take a call? 15:29.000 --> 15:29.540 I don't know. 15:29.760 --> 15:31.040 I guess we could take a call. 15:31.540 --> 15:31.760 Yeah. 15:32.440 --> 15:33.200 Take a call. 15:33.200 --> 15:33.960 Just a second. 15:34.500 --> 15:35.260 You guys keep talking. 15:36.220 --> 15:40.100 All right, yeah, so I got, like, you know, 160 gigs of storage, but it's, they're slowly 15:40.100 --> 15:45.000 dying, but my computer has recently decided to start acting very, very slow, and the only 15:45.000 --> 15:49.140 thing I can think of is either it's, it's got to be the hard drive, because I knew it was 15:49.140 --> 15:51.640 kind of randomly powering down. 15:52.460 --> 15:54.400 Making that, ooh, it's powering down? 15:54.880 --> 15:55.160 Yeah. 15:55.300 --> 15:55.620 Not good. 15:56.120 --> 15:58.060 Yeah, it was, like, I'd be saying, I'd be saying. 15:58.060 --> 15:58.620 It's viral downward. 15:59.380 --> 16:01.140 Yeah, I need to go back that stuff up. 16:01.140 --> 16:04.200 I'd actually need to find out which hard drive it is, because there's two in that box, and 16:04.200 --> 16:05.380 that could be messy. 16:06.320 --> 16:09.940 Yeah, that should probably be something you do, I don't know, directly after the show. 16:10.480 --> 16:10.900 If the drive is powering down. 16:10.900 --> 16:11.580 Yeah, I think I'm going to. 16:12.800 --> 16:16.480 Well, the drive's been powering down for a couple of months now, but it's, and I have, 16:16.560 --> 16:20.640 the stuff I have on it has been backed up, so it's just mostly, well, let me go ride 16:20.640 --> 16:22.360 this sucker into the ground, shall I? 16:22.360 --> 16:29.560 Well, I've seen bad hard drives last, like, six months, you know, or just people refuse 16:29.560 --> 16:33.800 to replace them, and then whenever, of course, and it dies, and then they bitch about, you 16:33.800 --> 16:38.720 know, they lost their data, you're telling them six months ago, hey, you're getting, you 16:38.720 --> 16:42.160 know, read errors on your drive, but, yeah, still don't want to replace it. 16:42.180 --> 16:42.800 Hey, it's still working. 16:43.540 --> 16:44.620 It's still chugging along. 16:44.620 --> 16:47.480 We have Red Rabbit on the line. 16:48.260 --> 16:50.380 Well, well, well, well, well, hello, Red Rabbit. 16:51.080 --> 16:51.440 Yeah. 16:52.380 --> 16:56.840 So, yeah, I've been talking to you, I see, for a while, and you still haven't done my 16:56.840 --> 16:59.640 iWord page, so just thought I'd call. 16:59.640 --> 17:09.340 I think he's referring, he's referring to me, and he has a wiki page for, let's see, telephony 17:09.340 --> 17:12.580 technology and stuff like that, and he's going to want me to update it, and I just haven't 17:12.580 --> 17:12.920 had time. 17:13.040 --> 17:13.280 Sorry. 17:13.280 --> 17:16.000 Yeah, it's pretty boring, just thought I'd tell you that. 17:16.820 --> 17:17.180 All right. 17:17.540 --> 17:19.220 Look at that, Colin Beavout on the air. 17:19.500 --> 17:19.860 Ooh. 17:20.360 --> 17:21.440 I know, man. 17:21.520 --> 17:23.860 This is better, this is better than WWF. 17:24.540 --> 17:25.060 And you know what? 17:25.120 --> 17:27.660 I'll get it done so much faster now, let me tell you. 17:28.300 --> 17:28.660 Yeah. 17:29.240 --> 17:32.520 Yeah, now that it feels like an obligation instead of something you just want to do, right? 17:33.560 --> 17:33.880 Yeah. 17:34.300 --> 17:34.620 Exactly. 17:35.180 --> 17:37.160 Hey, just Red Rabbit, just look on the bright side. 17:37.240 --> 17:38.940 At least Strom's not updating it. 17:40.260 --> 17:40.540 Yeah. 17:40.820 --> 17:41.280 Okay, well. 17:41.280 --> 17:45.480 Well, I did tell him that I would do it, and I just have not done it. 17:45.960 --> 17:46.760 And I do apologize. 17:47.060 --> 17:47.900 I'll get it done. 17:48.120 --> 17:49.100 Just give me a little bit of time. 17:50.900 --> 17:51.140 All right. 17:52.140 --> 17:52.480 See you. 17:52.480 --> 17:53.020 Thanks for calling. 17:53.260 --> 17:53.540 Thanks for calling. 17:53.540 --> 17:53.800 All right. 17:53.800 --> 18:03.660 So, yes, actually, getting back to hard drives, what I was going to say was actually my fiance's 18:03.660 --> 18:06.440 hard drive, which was part, I guess it was part of my personal hacking stories. 18:07.580 --> 18:12.480 My fiance hard drive, Wednesday, her computer just refused to turn on. 18:12.540 --> 18:13.740 It was just sitting at a blank cursor. 18:13.940 --> 18:16.280 I was just like, I don't know what the heck's going on here. 18:16.280 --> 18:20.680 And eventually I turned it off, turned it on, and, you know, a couple of times the power 18:20.680 --> 18:22.000 cycle ended and it magically restored. 18:22.120 --> 18:24.360 I said, you might want to back your stuff up. 18:24.420 --> 18:25.440 We'll do it this weekend. 18:25.440 --> 18:31.540 And Friday night, you know, she comes in, we're going to do it Sunday, and Sunday morning 18:31.540 --> 18:33.120 she powers it up, nothing. 18:33.280 --> 18:36.460 It just sits at the login screen and it crashes when it starts up. 18:36.680 --> 18:41.160 So I had to trudge over and salvage all the stuff out. 18:41.920 --> 18:44.120 It was a very interesting Sunday and Monday night. 18:44.220 --> 18:48.760 I was sick as a dog, yet I was still scraping stuff off the hard drive. 18:49.720 --> 18:50.560 Have fun, fun. 18:50.560 --> 18:58.460 But I would just like to send a wonderful shout-out to BARTPE, which is BART's pre-installed 18:58.460 --> 19:04.180 environment, which is, for those of you who don't know, it's like, basically it's Nopix 19:04.180 --> 19:04.780 for Windows. 19:05.460 --> 19:12.420 It's a very good bootable CD, and basically what you have to do is you have to have a full 19:12.420 --> 19:19.580 copy of Windows XP, and you can create this bootable ISO image and burn it to a CD that 19:19.580 --> 19:22.840 will boot a stripped-down version of Windows on your computer. 19:23.980 --> 19:30.020 And, you know, Nopix is a lot more full-featured, and a lot of the stuff in the Windows one is 19:30.020 --> 19:37.680 a kludge, but it's very handy for, say, removing spyware and directly interfacing it. 19:37.840 --> 19:42.640 And it's a lot handy when you're already working in a Windows environment. 19:42.640 --> 19:49.300 Say, like, for example, the hard drive is NTFS, which is a slight bear to work with, with 19:49.300 --> 19:49.620 Linux. 19:50.680 --> 19:52.520 So, BARTPE, it's the best thing ever. 19:52.660 --> 19:57.260 And I think I might, I think we should, like, do a show on, like, BARTPE and Nopix and bootable 19:57.260 --> 19:59.560 Windows and all that kind of stuff. 20:00.180 --> 20:05.500 The URL for it is tinyurl.com slash Quebec Papa Kilowatt Yankee. 20:05.500 --> 20:10.480 And, uh, as for my other person, I don't know, what else have I been doing this week? 20:10.960 --> 20:14.720 Um, I've been doing some stuff relating to the show topic, and we'll talk about that later. 20:15.760 --> 20:17.460 And, um, yeah, that's basically it. 20:17.480 --> 20:17.980 I've been sick. 20:19.280 --> 20:20.680 And I don't like head colds. 20:21.220 --> 20:27.540 One great thing whenever you lose a hard drive, especially if it has Linux on it, is a DD Rescue. 20:28.200 --> 20:29.180 I don't know if you've played with that. 20:29.660 --> 20:31.360 But, uh, that's a very useful utility. 20:31.360 --> 20:36.840 But even if the drive is physically failing, if you let it run long enough, they'll usually 20:36.840 --> 20:39.440 come back with an image that you can recover from. 20:39.900 --> 20:43.140 But you might have to let it run for a couple of days on the drive. 20:43.660 --> 20:44.940 But very, very useful. 20:45.460 --> 20:46.000 But it works. 20:46.220 --> 20:50.200 I mean, it's gotten me out of, uh, very bad situations twice. 20:50.920 --> 20:55.380 So, if you're looking for recovery tools, I'd highly suggest that. 20:57.520 --> 20:58.560 No, no, no. 20:58.560 --> 21:00.160 It sounds like you've actually done this a couple times. 21:00.160 --> 21:02.780 Have you actually put the hard drive in the freezer before? 21:03.840 --> 21:04.880 Actually, yes, I have. 21:05.640 --> 21:06.740 And has it worked? 21:07.420 --> 21:08.720 It did zip for me. 21:09.080 --> 21:15.400 See, the thing that I heard about it was that, um, the idea, at least, that I had heard, is 21:15.400 --> 21:21.200 that, uh, sometimes on a circuit board, uh, the circuit board's gone bad and you have, um, 21:21.880 --> 21:23.300 particular parts that are overheating. 21:23.300 --> 21:27.820 Um, so the idea is to cool down the hard drive so that you can get it to spin up long enough, 21:27.820 --> 21:35.860 uh, to get the stuff off the hard drive before the parts on the, the hard drive board start 21:35.860 --> 21:36.680 to reheat up. 21:36.840 --> 21:37.840 If you kind of see what I'm saying. 21:38.280 --> 21:38.800 Yes, yes. 21:38.860 --> 21:40.600 Uh, at least that's a theory that I've heard. 21:40.600 --> 21:46.140 It's, it's, I tried it twice, uh, and it never made a bit of difference for me. 21:46.140 --> 21:51.420 Well, I think it depends really on which kind of, uh, of, what kind of failure. 21:51.660 --> 21:52.780 Well, yeah, what kind of failure it is. 21:52.820 --> 21:57.780 One thing that has tended to work for me in the past is if the board goes, you get the exact 21:57.780 --> 22:02.540 same hard drive and you just replace the board but leave the same ladders and, uh, then you've 22:02.540 --> 22:03.840 got pretty much a working drive again. 22:04.560 --> 22:09.000 Yeah, actually, I have done that, uh, where I had, uh, a friend of mine who lost an eight 22:09.000 --> 22:15.640 gig hard drive, uh, a while back and it had, I think it had windows on it and that's basically 22:15.640 --> 22:20.300 what I did is I went on eBay and found the exact same model drive and then whenever, you 22:20.300 --> 22:25.400 know, it costs like five bucks and then, uh, replaced the board on the drive and got it 22:25.400 --> 22:28.080 to spin back up just long, you know, just long enough to get the data off. 22:28.120 --> 22:32.260 I wouldn't say I'd use the hard drive anymore for critical data. 22:32.800 --> 22:33.380 Yeah, of course not. 22:33.460 --> 22:35.140 It was kind of cludged together at that point. 22:35.240 --> 22:36.080 But, yeah, you're right. 22:36.540 --> 22:37.220 It does work. 22:38.020 --> 22:40.540 Yeah, don't give it, don't give it to those people who ride their hard drives into the 22:40.540 --> 22:40.740 ground. 22:41.260 --> 22:44.300 I, I actually got to say that I think I'm the only person who's ever actually said this 22:44.300 --> 22:46.520 but the, the, the freezer thing has worked for me, I guess. 22:46.540 --> 22:46.920 I don't know. 22:47.540 --> 22:48.340 Maybe I'm just lucky. 22:50.620 --> 22:54.440 And actually, I, I did say that once on MinRev Radio and no one believed me and I, that made me 22:54.440 --> 22:54.940 very sad. 22:55.400 --> 23:00.660 So, B, what have you been, uh, do we ask you yet? 23:00.720 --> 23:01.360 I'm not even sure. 23:02.060 --> 23:05.160 What's your personal show until this week? 23:05.240 --> 23:06.000 Well, let's see. 23:06.440 --> 23:11.740 Um, I've been working on iWar a little bit, uh, trying to get the next release of that 23:11.740 --> 23:19.400 done with, uh, still doing the Death Row thing, Death Row Open VMS Cluster, um, maintaining 23:19.400 --> 23:19.780 that. 23:19.860 --> 23:21.480 Nothing really interesting there. 23:21.480 --> 23:28.940 And, of course, uh, tonight's topic, uh, I've been doing a lot of work with, uh, that's 23:28.940 --> 23:30.400 been primarily what I've been doing. 23:30.660 --> 23:34.600 I just had a lot of work with iWar and trying to get all that stuff done with, so. 23:35.280 --> 23:37.420 Are we looking forward to any new features with iWar? 23:37.420 --> 23:39.540 Um, yeah. 23:39.680 --> 23:45.340 Actually, I've added in PostSQL, uh, excuse me, PostSQL, Postgres, whatever. 23:46.220 --> 23:46.500 Um. 23:46.500 --> 23:47.760 I think we established that in PostSQL. 23:48.020 --> 23:48.740 Yeah, PostSQL. 23:49.740 --> 23:50.040 Okay. 23:50.300 --> 23:50.820 PostSQL. 23:50.820 --> 23:58.380 Um, I added that in, uh, added in, uh, HTTP logging, uh, so that you can log to a web 23:58.380 --> 24:05.520 server, um, and a couple other features, uh, my big thing right now is to work on signal 24:05.520 --> 24:12.440 processing for the voiceover IP part of iWar, uh, which have not had much of a chance to really 24:12.440 --> 24:17.900 work on, but been too busy, too busy smashing bugs in the current iWar, so. 24:19.300 --> 24:20.820 Beef smash, bro! 24:22.500 --> 24:23.340 Mashy smashy. 24:24.780 --> 24:25.500 Gotta be done. 24:26.460 --> 24:29.980 I'm just picturing Beef, like, you know, trudging over the crude base with, like, you know, his, 24:30.420 --> 24:33.600 you know, all green, like his shirt ripped to shreds like the Hulk. 24:35.900 --> 24:36.260 Mashy! 24:36.300 --> 24:37.340 Don't like bugs! 24:37.340 --> 24:42.880 Yeah, that's pretty much the way I address whenever I do it, too. 24:43.300 --> 24:47.540 All right, so since, you know, we both basically referenced a topic in the past five minutes 24:47.540 --> 24:53.280 or so, um, the topic for the night is we're trying to talk about honeypots and user mode 24:53.280 --> 24:58.340 Linux, and the, the immense fun you can have just sitting there, you know, mushing about 24:58.340 --> 24:59.440 with UML and honeypots. 25:00.700 --> 25:02.960 A honeypot topic makes me sticky. 25:03.920 --> 25:04.320 Mmm. 25:05.040 --> 25:07.120 And that's the end of my bad joke for the evening. 25:07.780 --> 25:08.540 Mmm, honey. 25:09.040 --> 25:09.400 Yes. 25:10.300 --> 25:14.340 Okay, so, well, I mean, I guess it's like, you know, two or three people that might not 25:14.340 --> 25:15.180 know what a honeypot is. 25:16.580 --> 25:22.840 Honey pots are systems that are, um, basically, you want to deploy them into your network infrastructure 25:22.840 --> 25:25.160 even though they have security holes in them. 25:25.680 --> 25:30.160 I mean, they're basically boxes that no one else is going to use, and they're just going 25:30.160 --> 25:32.580 to sit there, you know, you know, badly patched or whatever. 25:32.580 --> 25:37.760 Like, for example, you know, most people, I assume, most people who know what they're 25:37.760 --> 25:41.700 doing, when they have a, you know, computer on the network, they actually want to patch 25:41.700 --> 25:41.840 it. 25:41.980 --> 25:43.140 Honey pots, you don't want to. 25:44.060 --> 25:47.300 You just want to have them sit out there with their giant gaping security holes. 25:47.300 --> 25:53.860 Um, basically, what they're used for is, you know, research, information gathering, and, 25:53.860 --> 25:56.740 um, some companies, hmm? 25:57.580 --> 25:58.040 And fun. 25:58.040 --> 25:59.980 And fun, fun, too, yeah. 26:00.080 --> 26:04.440 So, and also some companies, uh, apparently use them to distract hackers, which, or I'm 26:04.440 --> 26:05.640 sorry, not hackers, attackers. 26:07.020 --> 26:11.080 Um, and basically, what they're, what they're trying to do is they want to just set them up 26:11.080 --> 26:15.600 there on their network, and, you know, with their, with their security holes, and their 26:15.600 --> 26:20.780 badly configured, and their default passwords, and so when, if someone comes around and attacks 26:20.780 --> 26:25.480 your network, they'll see this box with all these problems, and they, they just are meant 26:25.480 --> 26:30.760 to set up to look like low-hanging fruit, like, the easy stuff that can, anyone can, you know, 26:31.000 --> 26:35.580 own with their, you know, copy of Back Orifice, and NetBus, and all that stuff. 26:36.860 --> 26:40.260 You know, they just want to be low-hanging fruit, you know, computers with very easily 26:40.260 --> 26:45.360 exploited weaknesses, and what, what the concept is, is, you know, when you have one of these 26:45.360 --> 26:49.140 computers out there, or they'll have enough holes to make it look like a badly secured box 26:49.140 --> 26:53.240 to the attacker, you know, and when they come around, it'll convince him and her to make 26:53.240 --> 26:57.440 sure that that box is, oh, God, this is going to be the simplest one ever, and I can use 26:57.440 --> 27:02.160 this for my base of operations to attack everything else, which is a very common strategy. 27:02.940 --> 27:08.420 Now, what the attacker doesn't know is the machine is heavily monitored, and basically, 27:08.760 --> 27:12.580 whenever someone tries to connect to it, because you don't want anyone else, you know, you don't, 27:12.680 --> 27:17.520 with this part of your network infrastructure, you don't want, you know, John from accounting, 27:17.760 --> 27:19.380 you know, using that as his primary server. 27:19.380 --> 27:23.800 The only reason, the only person you want to use this, have this, the only person you 27:23.800 --> 27:29.460 want to ever use this box is someone who shouldn't be using it in the first place, and if some 27:29.460 --> 27:35.900 type of traffic is flowing in or out of it, it's going to be something that is, you want 27:35.900 --> 27:36.600 to be looking at. 27:36.600 --> 27:44.920 So, I guess, personally, the thing, the first part that I ever, like, stumbled across for, 27:44.980 --> 27:49.640 like, honeypots and security, stuff like that, is, it's a very good basic introduction. 27:51.460 --> 27:57.260 It's called An Evening with Burford, and it's by Bill Cheswick, and this actually is a chapter 27:57.260 --> 28:00.220 in his book, Firewalls and Internet Security. 28:00.500 --> 28:04.380 It's, the book's by Cheswick and something else, I have a copy of it. 28:04.380 --> 28:06.980 Actually, I bet if I look at my bookshelf right now, I can see it. 28:07.740 --> 28:13.860 Uh, Cheswick, Squint, Squint, Squint, yeah, I think I have more neat glass, was, uh, Cheswick, 28:14.060 --> 28:15.740 Beldoin, and Ruth? 28:15.920 --> 28:16.400 I don't know. 28:17.820 --> 28:18.980 Down on my bottom shelf. 28:19.900 --> 28:20.920 I'm getting old. 28:21.200 --> 28:22.040 I'm very sad. 28:22.580 --> 28:23.140 Old fart. 28:23.860 --> 28:28.880 Yeah, it's a chapter in his book, um, but this, this, this actually isn't, you know, books 28:28.880 --> 28:30.500 with a Z there, it's super leet. 28:30.500 --> 28:35.480 Um, he's actually released this chapter to a public, or, I'm not sure if he's released 28:35.480 --> 28:39.380 a chapter to the public, or he released a, or he released a story before he released 28:39.380 --> 28:42.380 the book, but it's, um, actually available on the public. 28:43.140 --> 28:49.420 Um, it's, uh, tinyurl.com slash lima3echo8alpha. 28:49.980 --> 28:54.760 And you can also, I, I have a PDF copy of it on my computer at work, and it's, it's a really 28:54.760 --> 28:55.340 great story. 28:55.340 --> 29:00.240 It's basically, it's him during, you know, this is, this is like way in the origin of 29:00.240 --> 29:05.640 the internet, it's like 1991, and it's, um, a story on basically how attacked her, how 29:05.640 --> 29:07.960 attacked her, attacker, and I, I wrote this myself. 29:08.820 --> 29:09.980 Ooh, someone has a hip top. 29:10.320 --> 29:14.280 It's how an attacker is, um, you know, basically tricked, trapped, and traced. 29:14.500 --> 29:18.780 It's, it's really cool, and it's, it's, it, I, I gotta say, it's, it's a lot like a 29:18.780 --> 29:19.420 whodunit story. 29:19.540 --> 29:20.480 It's, it's really good. 29:20.480 --> 29:27.380 Um, basically, it's, you know, this Cheswick guy, Bill, he's, he's working for AT&T research, 29:27.380 --> 29:30.540 and he set up a honeypot on AT&T's internet connection. 29:31.360 --> 29:39.120 Um, and this, uh, person from, I don't know, Netherlands, Sweden, some, some sort of Scandinavian 29:39.120 --> 29:43.920 country, it's, uh, you know, he basically hopped it all the way through, like, two or three 29:43.920 --> 29:48.920 different computers, and he attacked AT&T, and they basically put him in this little jail, 29:48.920 --> 29:53.400 and they watched everything he did, including tech and other computers, and they just, you 29:53.400 --> 29:56.960 know, watched him for, I think it went on for a couple of months, so it was pretty interesting. 29:58.340 --> 30:05.040 Um, so, when, when, like, previous to, what else we're going to talk about, uh, like, back 30:05.040 --> 30:08.100 in the day, what you have to do is, you'd have to take an actual computer, like, you know, 30:08.460 --> 30:12.940 put a hard drive, put RAM, put everything in it, misconfigure it, um, and basically let 30:12.940 --> 30:16.700 it run 24-7 and wait to see what comes drifting in on the tide. 30:16.700 --> 30:23.880 Um, and really, this was the only way to do it for a while, until, like, you know, uh, 30:24.240 --> 30:27.860 computer virtualization and all kinds of fun stuff that we're going to talk about next. 30:28.400 --> 30:32.080 And, uh, while actually researching this article, I found a fun little thing. 30:32.480 --> 30:40.020 The term honeypot is often understood to refer to the bilge, the British children's character 30:40.020 --> 30:45.620 Winnie the Pooh, a stuffed bear who is lured in various predicaments by his desire for pots 30:45.620 --> 30:51.440 of honey, which, I, I, I always saw the logo, but I never actually should have understood 30:51.440 --> 30:53.980 that that was the origin of the term. 30:55.600 --> 30:55.760 Hmm. 30:56.220 --> 30:56.420 Hmm. 30:56.500 --> 30:56.700 Yeah. 30:57.400 --> 30:59.220 Yeah, I never really thought about it myself. 30:59.960 --> 31:04.400 I always thought, like, uh, it was sort of like, you know, it was a honeypot. 31:04.520 --> 31:08.280 I mean, you always, I, I always looked at it as, uh, a play on the term of, you know, 31:08.360 --> 31:10.300 you, you attract more flies with honey than vinegar. 31:11.140 --> 31:12.780 Yeah, that, that, that's what I thought about it. 31:13.420 --> 31:13.700 Yeah. 31:13.800 --> 31:13.960 Yeah. 31:14.300 --> 31:17.840 Or, I just see, like, I always saw it as, like, you know, this hacker is, like, walking 31:17.840 --> 31:22.040 around the network and he sees this, uh, you know, pot, pot of honey and it's like, 31:22.100 --> 31:22.820 woo, honey! 31:23.740 --> 31:25.820 Because, you know, who, who, who, who wants to turn down free honey? 31:27.040 --> 31:27.360 Exactly. 31:27.500 --> 31:27.700 Yeah. 31:27.940 --> 31:29.220 That's kind of the way I thought about it, but. 31:30.820 --> 31:32.180 Yeah, so, yeah. 31:32.180 --> 31:37.140 Yeah, but basically what it is, is, you know, honey, honeypot was, you, you had to run it 31:37.140 --> 31:43.620 with a, um, you had to run into a physical server and you had to run a computer and you 31:43.620 --> 31:47.660 had to keep it in your, you know, server room, closet, bedroom, wherever you want to put 31:47.660 --> 31:50.200 it underneath your bed, whatever. 31:50.460 --> 31:56.100 And, um, then, like, up until, I think, 1990, when, when did UML come out? 31:56.120 --> 31:59.840 It was, it was released around 2.2, so I'm going to say, like, 1998, 1999. 31:59.840 --> 32:04.480 Um, one of, one of the first big things for, you know, network virtualization, at least 32:04.480 --> 32:06.680 in the Linux world, was something called User Mode Linux. 32:07.600 --> 32:13.520 Now, uh, what User Mode Linux does is, basically, it allows you to run a virtual kernel on top 32:13.520 --> 32:14.620 of your existing install. 32:14.800 --> 32:19.940 So, you know, normally when you are booting up a Linux kernel, you have to have, you know, 32:19.960 --> 32:23.920 a piece of hardware to do it and you could only have one kernel running on a machine. 32:23.920 --> 32:30.760 I mean, what, what User Mode Linux did is they took all of the, uh, you know, they took 32:30.760 --> 32:35.440 the requirements of running a Linux kernel into kernel space and they made it all into 32:35.440 --> 32:36.080 user space. 32:36.400 --> 32:41.860 And for those of you who don't know what, you know, user space is, um, user space is the 32:41.860 --> 32:44.900 area in which, you know, your normal program runs. 32:44.900 --> 32:52.680 It's like, you know, Apache, uh, Secure Shell, NFS, um, while opposed to your real kernel runs 32:52.680 --> 32:53.980 in something called kernel space. 32:54.620 --> 33:00.880 Uh, basically, what kernel space is, is, uh, it allows the kernel to directly access the 33:00.880 --> 33:05.400 hardware, um, you know, low-level functions, you know, pull stuff out of RAM directly. 33:05.400 --> 33:12.360 Uh, while in, like, user space, uh, the kernel kind of, I guess you could say insulates programs 33:12.360 --> 33:14.620 when they're trying to access the hardware. 33:14.960 --> 33:20.340 Like, for example, compare it to, you know, running Linux and running DOS. 33:20.480 --> 33:25.060 DOS didn't have a kernel and therefore lockups were a lot more frequent when something happened, 33:25.060 --> 33:31.140 uh, to the program that was currently running, uh, as opposed to Linux where if you have a 33:31.140 --> 33:33.000 lockup, something's seriously wrong. 33:33.000 --> 33:33.740 Mm-hmm. 33:34.360 --> 33:35.920 Like, for example, your hard drive might be dying. 33:36.060 --> 33:36.400 Ha-ha! 33:39.280 --> 33:39.680 Um... 33:39.680 --> 33:43.360 What's interesting is I actually set up kind of a, I had an extra box and an extra IP, 33:43.540 --> 33:49.760 so I set a honeypot up, I just, uh, set up the computer with this open FTP share sitting 33:49.760 --> 33:53.680 there on the network, no firewalls or anything, and I just let it sit there for a month and 33:53.680 --> 33:54.460 no one touched it. 33:54.480 --> 33:55.260 I was so surprised. 33:56.460 --> 33:56.780 Hmm. 33:58.020 --> 34:00.080 Well, we're actually running into that problem ourselves. 34:00.080 --> 34:09.180 I think a lot of times, uh, you just have to be really patient, or just make your machine 34:09.180 --> 34:11.660 more vulnerable as you see the attacks come in. 34:12.240 --> 34:12.520 Mm-hmm. 34:12.680 --> 34:16.140 Well, you also got to be paying attention to what, you know, the, the attack du jour is, 34:16.140 --> 34:16.440 I guess. 34:16.520 --> 34:17.480 I mean, I... 34:17.480 --> 34:18.340 Really, yeah. 34:18.700 --> 34:23.380 Yeah, well, what I used to do is, uh, when, uh, we'll talk about more about this later, 34:23.380 --> 34:28.900 but I, I, I set up a, back in the day, about, oh, I don't know, a year ago or so, when I 34:28.900 --> 34:34.500 first started playing with this, I, I basically set up a nice little, um, HoneyDee install, 34:34.800 --> 34:39.620 which is a, a HoneyDee for those, we'll, we'll talk about it more later, but HoneyDee is a, uh, 34:40.060 --> 34:47.160 sort of a virtual, virtual honeypot, um, and I set it up to have a, make it look like a, 34:47.160 --> 34:51.560 a Telnet session was running on it, and it, I, I mean, I programmed the hell out of this. 34:51.560 --> 34:55.180 You could Telnet in, you could give it passwords, it would make it look like it was compromised, 34:56.180 --> 34:59.500 you know, you could enter, like, one of, like, you know, three or four different accounts, 34:59.740 --> 35:03.880 and it'll respond to it, and give you a login prompt, and then, you know, not respond to 35:03.880 --> 35:08.560 it, and then it would lock you out, but, but no, no one would log in, because no one uses 35:08.560 --> 35:16.960 Telnet anymore, and I was, I was, I, that made me sad, but, yeah, and I, it's just basically 35:16.960 --> 35:18.680 what it boils down to is the attack du jour. 35:19.480 --> 35:21.000 What, what are people running right now? 35:21.000 --> 35:26.420 I mean, the, I, I, meanwhile, I actually set up a, something soliciting on, uh, port 35:26.420 --> 35:31.580 4444, which was the, I forget what that was, it was the, what, what virus did that? 35:31.660 --> 35:34.320 My Doom on Windows that would send the shell out to that? 35:36.000 --> 35:40.120 Or one of, like, the, it was like a, a spat of viruses. 35:41.580 --> 35:45.060 You know, it would bind a, uh, Windows command shell out to a certain port, and I set that 35:45.060 --> 35:48.300 up there, and I would get hammered, like, you know, 100 hits a day on it. 35:48.300 --> 35:49.180 The blaster worm. 35:49.840 --> 35:51.060 Blaster, that's it, thank you. 35:52.000 --> 35:57.000 One of them, it was like, way too many, and then I think Nimda did it too, basically because 35:57.000 --> 35:58.980 Nimda used blaster as a piggyback. 35:59.620 --> 36:00.540 That was very interesting. 36:00.540 --> 36:09.600 So, um, what, uh, what UML basically allows you to do is, you know, you can run buggy software 36:09.600 --> 36:15.120 on an actual quote-unquote Linux server, um, or a Linux kernel install. 36:15.460 --> 36:20.080 Uh, you can jail certain services, so if, you know, if, if you're running a real computer 36:20.080 --> 36:26.080 and you're running, like, a real Apache website, you can, um, set up, so Apache runs on your 36:26.080 --> 36:32.740 user-mode Linux box, and if Apache gets hacked, say, for example, um, your, you know, your, 36:32.740 --> 36:37.280 your main box will get hacked, your, your super-leap porn won't get spoiled out on the internet. 36:38.040 --> 36:42.860 Um, you can also use user-mode Linux to, uh, limit access to hardware for certain programs, 36:42.860 --> 36:48.980 um, and generally just basically provide a, uh, level of redundancy for the systems that 36:48.980 --> 36:49.320 you run. 36:49.920 --> 36:54.920 Uh, like, for example, if something happens to, say, your Apache program and your, you 36:54.920 --> 37:00.480 know, that virtualization gets taken down, your, your Samba will still be fine, and it's 37:00.480 --> 37:05.800 just, it's just a way of, you know, redundancy for the sake of redundancy, I guess. 37:07.120 --> 37:12.840 Um, essentially what user-mode Linux does is it provides a nice little way to, uh, run a 37:12.840 --> 37:17.300 virtual instance of a server within your existing server, and, uh, actually I found this pretty 37:17.300 --> 37:22.140 interesting, um, I completely forgot of this, forgot about this until someone mentioned to 37:22.140 --> 37:27.840 me, uh, there's, there's a couple of web hosting providers out there that have, uh, are actually 37:27.840 --> 37:32.740 starting to provide user-mode Linux-powered servers for, like, you know, 10 to 20 bucks a 37:32.740 --> 37:38.640 month, where in reality you get this, uh, complete virtual server, you know, full root access, um, 37:38.900 --> 37:42.820 in what appears to be your own system, while in reality it's only one physical computer, 37:42.840 --> 37:47.140 and it's shared by many people, um, I, I forget the provider that it actually does 37:47.140 --> 37:49.520 this, um, the one that I actually use. 37:50.240 --> 37:53.840 Yeah, apparently there's a lot, I did a search for it, I, I, I remember when it first came 37:53.840 --> 37:57.280 out, and me and a couple other people were basically saying, wow, this is the coolest 37:57.280 --> 38:02.820 thing ever, and, uh, one of them that actually, one of my, one of the people that Strom and I 38:02.820 --> 38:07.380 know actually still uses theirs, it, it, it, it really, I mean, I played on it, and for 38:07.380 --> 38:10.720 all intents and purposes, you can tell that you have a, you know, real Linux box, 38:10.720 --> 38:15.960 since, unless you really start poking at it, you, you, you won't discover that it's just 38:15.960 --> 38:18.380 sitting in someone's, uh, virtual space someplace. 38:19.340 --> 38:19.560 Right. 38:21.560 --> 38:29.440 Um, yeah, well, the UML first came out around, uh, for 2.2 kernels, uh, I think it was like 38:29.440 --> 38:38.420 98, 99, um, and as of Linux 2.6, it's actually got integrated into the main kernel source tree. 38:38.420 --> 38:43.040 Um, it's pretty cool, actually, I didn't actually know it was a part of 2.6. 38:43.480 --> 38:51.340 Uh, for a lot of people with 2.4, um, still using that, I'll aid of you, um, it's going 38:51.340 --> 38:55.260 to be a bit of an issue, because apparently, uh, sadly enough, development hasn't actually 38:55.260 --> 38:58.180 done much since two, since late 2004. 38:58.180 --> 39:00.340 I was... 39:00.340 --> 39:08.200 Yeah, but, and actually, ironically, for UMLs, I find the 2.4 UML kernel better to run, because 39:08.200 --> 39:14.900 it supports some features that the 2.6 yet, has yet to, uh, have integrated into it, which 39:14.900 --> 39:15.460 we can get to later. 39:16.020 --> 39:21.520 Yeah, well, actually, I, I think 2.6 is mostly developed by the Linux people, and not actually 39:21.520 --> 39:25.300 the UML people, or, I, I'm not exactly sure. 39:25.320 --> 39:26.320 We're still developing that. 39:26.820 --> 39:28.400 Yeah, I don't think, I don't think... 39:28.400 --> 39:28.760 Oh, really? 39:28.860 --> 39:29.340 Well, I don't know. 39:29.620 --> 39:33.100 It's just, it's just odd the way everything kind of works out, because, I mean, I was running 39:33.100 --> 39:40.020 user mode Linux, uh, with Debian binaries, and I basically, you know, I started running 39:40.020 --> 39:42.040 it, and I said, oh, I wonder what version we're running in. 39:42.080 --> 39:47.540 It said, like, 2004, you know, July 7th, and I was like, oh, crap, man, these, these binaries 39:47.540 --> 39:51.400 are lagging way behind, and I was like, okay, let me go uninstall them, and I'll go grab 39:51.400 --> 39:57.620 the source, and I go to the website, and I'm like, 2004, July 7th, wait a minute, I was 39:57.620 --> 39:58.540 very confused for a second. 40:01.060 --> 40:05.880 So, you know, we talked about honeypots, we talked about UML, um, and I'm sure all of 40:05.880 --> 40:08.720 you are just sitting on the edge of your seat, wondering how you can put two and two together 40:08.720 --> 40:14.380 and make this super cool UML honeypot, um, to involve cheese. 40:14.380 --> 40:18.800 Um, well, I don't know, I guess when you're setting up your honeypot, you can have a nice 40:18.800 --> 40:24.460 little, you know, bottle of Chianti, and a nice little, some wine there, maybe a nice 40:24.460 --> 40:25.320 little white Zippendel. 40:27.740 --> 40:29.220 Linux cheese and wine. 40:29.480 --> 40:30.160 Yeah, there we go. 40:31.300 --> 40:35.640 Actually, I found it amusing, I got into Linux World, and I was looking at some of the stuff 40:35.640 --> 40:38.540 you can go to, and apparently there is a cheese and wine party. 40:39.700 --> 40:41.080 A Linux cheese and wine party. 40:41.080 --> 40:44.960 Yeah, I know, I was like, whoa, okay, that's going to be pretty interesting to watch. 40:47.020 --> 40:52.440 Um, so, anyway, what, uh, what makes user mode Linux pretty good for honeypots is that 40:52.440 --> 40:57.460 it basically allows you to run a badly secured Linux box on top of your well-secured Linux 40:57.460 --> 41:03.880 box, and, yeah, if the badly secured box get rooted, your main box is fine, and there's 41:03.880 --> 41:08.300 no really way for them to, hell, if you actually pull it off well enough, they shouldn't even 41:08.300 --> 41:12.180 know they're in a virtual instance, and if they do realize they're in a virtual instance, 41:12.320 --> 41:18.220 they, there's no real way to, uh, piggyback off the user mode Linux image and attack your 41:18.220 --> 41:19.420 well-secured machine. 41:20.380 --> 41:24.140 Well, as you're pointing out, I mean, well, as you're pointing out, and let's assume that 41:24.140 --> 41:28.480 there is some way to do that, you can even run, you're actually running the UML kernel 41:28.480 --> 41:29.740 within user space. 41:29.800 --> 41:31.780 You can actually run it under a standard username. 41:31.780 --> 41:37.640 So, even in the event that they do get out of it, pretty unlikely, you can still kind 41:37.640 --> 41:42.180 of even jail it down even more by, of course, you know, not running your UML instance as 41:42.180 --> 41:43.580 root, for instance. 41:44.560 --> 41:45.600 You know what I should do? 41:46.140 --> 41:51.720 I wonder, I should run my user mode Linux, my badly secured user mode Linux, inside a well-secured 41:51.720 --> 41:53.960 user mode Linux, inside my host machine. 41:54.720 --> 41:56.000 Ooh, I wonder if you can do that. 41:56.320 --> 41:58.600 I don't even know, but I'm going to, I'm going to find out. 41:58.820 --> 41:59.920 Double stuff paranoia. 41:59.920 --> 42:05.200 I've heard people running user mode Linux and then running bServe, which is another 42:05.200 --> 42:09.400 kind of emulation kind of thing, within user mode Linux. 42:09.500 --> 42:14.780 I couldn't quite figure out why, but I was watching a, yeah, exactly. 42:15.320 --> 42:19.140 It was like a user mode inside of a bServe mode, okay. 42:19.780 --> 42:23.600 But I guess if you're really paranoid, you could do that. 42:23.600 --> 42:31.020 What you should do is you should use, like, you know, your host machine, then QEMU, and 42:31.020 --> 42:37.540 then VMware, running Zen server, running user mode Linux with your badly secured box, and 42:37.540 --> 42:39.300 there are like eight different ways. 42:40.180 --> 42:44.920 That way, when they actually log in, it'll be kind of like, hey, why am I using a 386 that 42:44.920 --> 42:46.260 claims to be a Pentium 4? 42:46.260 --> 42:47.060 I'm not, yeah. 42:47.740 --> 42:48.180 Right. 42:48.920 --> 42:53.240 Well, actually, I was fooling around with VMware, because I wanted to, because they released 42:53.240 --> 42:53.980 their free version. 42:54.920 --> 42:57.700 We're completely getting dragged off the main topic here, but we're kind of talking about 42:57.700 --> 42:58.240 virtualization. 42:58.460 --> 43:05.340 And all of these products were mentoring VMware, QEMU, Zen server, and what was the one, the 43:05.340 --> 43:07.040 B, Bware, whatever it was? 43:08.500 --> 43:08.900 Bserve? 43:09.500 --> 43:09.860 Bserve? 43:10.360 --> 43:10.760 Bserve? 43:10.880 --> 43:11.040 No. 43:11.640 --> 43:12.460 What were you talking about? 43:14.040 --> 43:15.300 Oh, oh, Bserve, yeah. 43:15.300 --> 43:16.540 Bserve, sorry, yeah. 43:17.200 --> 43:21.960 All of these are virtualization things, and you can basically use all of these programs 43:21.960 --> 43:24.380 to do exactly what we're talking about. 43:24.900 --> 43:30.040 Basically, just hosting a badly secured machine, making a virtual network instance, and running 43:30.040 --> 43:32.020 it on top of your existing server. 43:32.840 --> 43:38.560 Well, actually, what's interesting about that is I found user mode Linux to be better for 43:38.560 --> 43:39.140 honeypots. 43:39.480 --> 43:44.440 Because, for instance, like in Bserve, it's really easy to, again, figure out you're in a Bserve 43:44.440 --> 43:46.860 environment because it runs under the existing kernel. 43:47.260 --> 43:53.280 It just makes a new security, it makes a new context for your virtualization to run in. 43:53.320 --> 43:54.720 You actually don't run a different kernel. 43:55.060 --> 43:59.540 You're under the exact same kernel as the host system, if you kind of see what I'm saying. 43:59.540 --> 44:08.440 And then I also looked at stuff like VMware, especially Windows honeypots, kind of easy to figure out. 44:09.960 --> 44:15.460 Anyways, all hands pointed for me to UML because they've actually put in a lot of time and effort 44:15.460 --> 44:22.440 into making UML a honeypot-friendly kind of environment because you can actually change 44:22.440 --> 44:29.060 the way the system looks, you know, so that it's harder for the person to detect that they're actually 44:29.060 --> 44:30.400 within a UML environment. 44:30.900 --> 44:37.380 Yeah, I mean, yeah, UML is basically all of the, you know, honeypot people over there, 44:37.540 --> 44:39.940 like, they all sing to places with UML. 44:39.940 --> 44:42.660 But, for example, UML won't run Windows. 44:43.620 --> 44:48.740 So, if you want to run VMware, you can, you know, you can run VMware on a Windows, you can run 44:48.740 --> 44:51.640 a VMware on your Linux machine running a Windows image. 44:51.720 --> 44:55.880 You have to have quite a powerful machine to do that, of course, as I found out. 44:56.580 --> 44:58.720 You can also do it in QEM, too, so. 44:59.320 --> 44:59.700 Oh, really? 44:59.780 --> 45:00.760 I didn't know you could do that in Windows. 45:01.260 --> 45:02.140 Yep, you sure can. 45:02.500 --> 45:02.740 Oh. 45:02.960 --> 45:04.300 You can run Windows in QEM. 45:04.700 --> 45:07.140 Yeah, I was actually fooling around with my Linux box. 45:07.140 --> 45:12.000 I said, oh, I will run a virtual, you know, Windows 2000 server on here, and we'll just 45:12.000 --> 45:12.760 see how it runs. 45:13.180 --> 45:19.680 And, but I sort of, like, gave up when VMware, you know, started up and started booting the 45:19.680 --> 45:23.260 Windows, and my load eventually topped out around 17. 45:25.420 --> 45:28.120 And I said, okay, I don't think this is going to work. 45:28.540 --> 45:33.740 I mean, the virtual network instance started responding to pings, but, like, you'd see, you 45:33.740 --> 45:36.400 know, you know, two milliseconds, three milliseconds. 45:37.140 --> 45:37.340 Wow. 45:37.340 --> 45:38.060 30 milliseconds. 45:39.380 --> 45:41.800 4,527 milliseconds. 45:41.940 --> 45:43.960 And I was like, yeah, I don't think that's a good ping time. 45:44.480 --> 45:45.820 We've got a caller on the line. 45:47.460 --> 45:47.940 All right. 45:48.140 --> 45:50.120 We've got May Bufo from the RC Channel. 45:50.160 --> 45:51.720 He's got a question about what we're talking about. 45:52.220 --> 45:52.580 All right. 45:53.480 --> 45:54.000 Yeah, hi. 45:54.160 --> 45:56.780 You guys are talking about running honeypots on Linux. 45:57.360 --> 45:57.660 Yes. 45:57.660 --> 45:59.060 And I'm just, I'm just curious. 45:59.240 --> 46:01.620 Wouldn't one on Windows attract a little more people? 46:03.140 --> 46:06.360 Well, to me, that's, that's the question. 46:06.520 --> 46:10.340 But, of course, with user mode Linux, basically, you're, you're, you're basically limited to 46:10.340 --> 46:10.760 Linux. 46:11.460 --> 46:11.820 Well, right. 46:11.820 --> 46:14.020 But at the same point, we were talking about VMware and everything. 46:14.200 --> 46:17.640 And, I mean, you can run a honeypot with VMware for Windows. 46:17.640 --> 46:21.740 But at the same point, yeah, it's questionable. 46:22.040 --> 46:25.500 You can't, and actually, and actually, one, one problem that I kind of had with it, because 46:25.500 --> 46:32.880 I originally wanted to run a Windows-based honeypot, and instead went to UML with Linux, 46:33.240 --> 46:39.980 because the UML team has put a lot of effort into, you know, things like logging and stuff 46:39.980 --> 46:40.300 like that. 46:40.340 --> 46:43.360 So, even if the person SSH is in, you can still log their sessions. 46:43.920 --> 46:44.080 Right. 46:44.080 --> 46:48.400 Whereas, VMware, it gets a little bit more tricky about how you're going to log the 46:48.400 --> 46:53.160 sessions, you know, and see what the actual, the person who penetrated the system, what 46:53.160 --> 46:57.160 they're actually doing, aside from, like, taking the image down and doing, like, post-mortem 46:57.160 --> 46:58.180 on the image or whatnot. 46:59.440 --> 47:00.760 That was the reason I went with it. 47:01.420 --> 47:01.680 Okay. 47:03.140 --> 47:04.240 That's pretty interesting, though. 47:04.920 --> 47:05.220 Yes. 47:05.460 --> 47:09.080 Well, we'll actually cover it about how to, like, set it up and all this wonderful, cool 47:09.080 --> 47:09.840 honeypot stuff. 47:10.280 --> 47:13.260 Actually, we should talk about it now, because they were right at the, part of the, 47:13.260 --> 47:15.460 notes where we should be talking about it. 47:15.700 --> 47:15.900 Yeah. 47:16.200 --> 47:16.480 Okay. 47:16.900 --> 47:22.120 So, the three things with UML that made it so well is, basically, we're talking about, 47:22.120 --> 47:23.660 you know, TTY logging right here. 47:25.500 --> 47:29.880 And, well, do you want to talk about TTY logging, because you just, you know, basically did this 47:29.880 --> 47:30.740 for about a week or so? 47:32.740 --> 47:33.460 Yeah, sure. 47:33.460 --> 47:42.400 And, well, the only bad thing is, in the 2.6 kernel of the UML stuff, they don't include 47:42.400 --> 47:43.260 TTY logging. 47:43.520 --> 47:46.380 So, you have to kind of resort back to a 2.4 kernel. 47:46.940 --> 47:51.540 And what it allows is, anything that goes on within your UML, you can log it. 47:51.680 --> 47:56.960 So, it doesn't matter if the user has actually SSH'd in, or pretty much how he gets into a 47:56.960 --> 48:02.620 system, it creates a log file that you can later go through and actually even play back 48:02.620 --> 48:07.900 in real time, just like the person who's sitting there, you know, typing it in. 48:07.960 --> 48:11.480 You can actually play back the log file and watch what they're doing in real time. 48:12.380 --> 48:15.180 Unfortunately, 2.6 kernel, they don't have that for it to over. 48:16.040 --> 48:20.380 So, but that was like a definite, you know, that's a pretty big advantage to me. 48:20.440 --> 48:23.120 I like to watch what's going on in the honeypot. 48:23.120 --> 48:28.260 And, when he's talking about, like, playing it real time, you're playing it in real time. 48:28.920 --> 48:33.620 It's eerie how, like, how it looks when you actually start playing it back. 48:34.300 --> 48:35.820 You can see typos in everything. 48:36.960 --> 48:37.340 Exactly. 48:37.340 --> 48:44.100 And, what's interesting is, from the intruder's standpoint, it's very difficult for him to 48:44.100 --> 48:47.980 detect that the logging is going on, because there's no additional network traffic. 48:47.980 --> 48:53.380 Because, really, I believe the UML Linux is just passing the information back over to 48:53.380 --> 48:54.100 the host system. 48:54.360 --> 48:56.040 So, there's no real extra traffic. 48:56.180 --> 49:00.320 So, like, let's say he decides, you know, to see if there's some sort of extra traffic, 49:00.400 --> 49:02.760 to see if, like, syslogging, remote syslogging is going on. 49:02.920 --> 49:03.860 He's not going to see it. 49:04.400 --> 49:06.280 So, that also makes it more entertaining. 49:06.680 --> 49:09.720 You know, makes the intruder feel more safe that he isn't being watched when he actually 49:09.720 --> 49:10.060 is. 49:10.060 --> 49:18.500 And, also, with the, one of the other things they put in is HP PFS, which is basically 49:18.500 --> 49:24.440 a, basically a way of just running this complete, like, dumbed-up proc system. 49:24.920 --> 49:28.120 It may, because when you're normally logged into a user mode in Linux, if you look at the 49:28.120 --> 49:32.580 proc system, for those of you who don't know, proc basically gives you a lot of internal 49:32.580 --> 49:34.740 operating system statuses in Linux. 49:35.600 --> 49:39.460 If you look at proc, you can see, oh, you know, if you look at it, you say, oh, look 49:39.460 --> 49:40.460 at that, I'm in user mode Linux. 49:41.860 --> 49:46.740 But what you can do with some tools that they give you is you can basically make the proc 49:46.740 --> 49:48.360 look exactly like it's supposed to. 49:48.560 --> 49:53.280 And what HP PFS stands for is the Honeypot ProcFS. 49:55.160 --> 49:59.780 You can, you know, have certain proc entries added, deleted, modified. 50:00.120 --> 50:04.120 Basically, you can make it look like you're running this, you know, super eight-way, 50:04.740 --> 50:07.680 X86 processor, for all they know. 50:08.380 --> 50:08.760 Right. 50:09.500 --> 50:10.760 Really heavily loaded down. 50:12.500 --> 50:13.520 Yeah, it's really slow. 50:13.620 --> 50:14.200 I don't know why. 50:16.160 --> 50:17.380 It's got eight processors. 50:18.960 --> 50:19.800 Processor host. 50:19.800 --> 50:28.300 And they also have something called SKSS mode, which is basically a separate kernel address 50:28.300 --> 50:28.640 space. 50:29.540 --> 50:34.580 And if you're making, basically what it just does is it kind of, if you're looking at how 50:34.580 --> 50:44.720 the user space and kernel space stuff is allocated within the memory on the UML host image, you 50:44.720 --> 50:51.460 can, you can notice that it's following certain rules and it'll look like, if someone knows 50:51.460 --> 50:53.860 what they're looking for, you can tell, oh, okay, it's user mode Linux. 50:53.980 --> 50:59.960 What SKSS does is it kind of obfuscates that and does not make it look like it's supposed 50:59.960 --> 51:00.200 to. 51:01.380 --> 51:02.460 So it's camouflage. 51:03.360 --> 51:04.740 It makes it look exactly like a real system. 51:05.140 --> 51:07.820 I actually haven't played with that, so I'm not a complete expert in it. 51:07.820 --> 51:10.940 Are you still on the line, Mibufo? 51:11.560 --> 51:12.200 I am. 51:12.800 --> 51:13.400 All right, cool. 51:13.460 --> 51:14.140 Any more questions? 51:16.240 --> 51:17.420 No, not really, though. 51:17.600 --> 51:18.140 All right, cool. 51:18.240 --> 51:21.680 I've got another call I'm going to grab, so I'm going to drop you off. 51:22.220 --> 51:22.900 All right, no problem. 51:23.300 --> 51:23.820 Thanks, man. 51:24.420 --> 51:24.740 Sure. 51:29.560 --> 51:32.740 So our next caller is Potrillo23 of TWAD. 51:32.740 --> 51:38.740 Because apparently someone leaked the topic tonight for tonight's MinRev episode, and 51:38.740 --> 51:40.200 I get a message on IRC. 51:41.120 --> 51:43.360 My God, did you get inspired by my TWAD episode? 51:43.560 --> 51:45.020 I'm like, what? 51:46.180 --> 51:52.320 And apparently, like, something like last week or the week before, he did a HottiePod episode 51:52.320 --> 51:53.560 on TWAD. 51:53.760 --> 51:58.440 So if you want some little more information than maybe coloring stuff that we're not covering, 51:59.040 --> 52:01.500 like, for example, I think he talks about VMware and such. 52:02.740 --> 52:04.280 And go to TWAD. 52:04.320 --> 52:05.440 I think it's, like, episode 80. 52:06.160 --> 52:08.500 And let's Potrillo talk about Honeypots. 52:09.740 --> 52:10.620 What's up, guys? 52:11.420 --> 52:11.680 Hey. 52:11.980 --> 52:12.280 What's up? 52:13.320 --> 52:13.880 All right. 52:13.960 --> 52:16.800 I'm just calling him over here from L.A., over here near you, Strom. 52:17.620 --> 52:17.880 Sweet. 52:17.880 --> 52:24.220 I was doing some research earlier last week on Honeypots myself and found some pretty interesting 52:24.220 --> 52:25.700 stuff on VMware. 52:25.700 --> 52:32.260 It turns out that VMware assigns certain MAC addresses to its virtual host, so somebody 52:32.260 --> 52:38.260 on the LAN could, it could lead to the assumption that there's a Honeypot hosted. 52:38.720 --> 52:39.200 So I don't know. 52:39.240 --> 52:40.460 I just thought that was kind of interesting. 52:40.800 --> 52:41.820 I thought I'd share that with you guys. 52:42.660 --> 52:44.540 Well, does it necessarily mean that the Honeypot's there? 52:44.620 --> 52:48.280 Does it more mean that it's actually a VMware instance? 52:49.220 --> 52:50.020 Well, yeah. 52:50.260 --> 52:53.540 It doesn't necessarily mean that it's a Honeypot there, you know what I mean? 52:53.580 --> 52:53.680 Yeah. 52:53.680 --> 52:56.600 But it could just, like, tip you off, you know what I mean? 52:57.260 --> 52:57.580 Yeah. 52:57.660 --> 52:59.280 Like, for example, if... 52:59.280 --> 53:00.220 Mm-hmm. 53:00.460 --> 53:04.800 Were you about to say whenever they load the, like, the video drivers for VMware? 53:04.800 --> 53:14.540 Because that's another, like, tip-off for people hosting VMware-based Honeypots is, of course, 53:14.580 --> 53:20.520 whenever you boot up normally, if you don't install the VMware drivers within the VMware 53:20.520 --> 53:24.260 environment, the graphics are really bad. 53:24.620 --> 53:28.340 You know, you get, like, 256 colors, and it just looks like crap. 53:28.340 --> 53:33.280 But you can load all these drivers for VMware that will actually, you know, make the machine 53:33.280 --> 53:35.740 respond and act fairly decently. 53:36.020 --> 53:39.880 The only problem is if you're running that as a Honeypot, then if people see those drivers 53:39.880 --> 53:46.600 loaded, like the VMware video drivers loaded, and it's pretty much a key off that, oh, this 53:46.600 --> 53:50.720 is a Honeypot, never mind, you know, versus a VMware-based machine. 53:52.520 --> 53:53.120 That's cool. 53:53.280 --> 53:54.540 I've never heard of that before. 53:55.060 --> 53:56.420 I'm going to look into that a little bit. 53:56.420 --> 54:02.240 You might be able to get around it by just not loading those drivers, but, of course, 54:02.320 --> 54:05.580 your display's going to look like crap and whatnot, but... 54:05.580 --> 54:08.180 Well, to be honest with you, if your display looks like crap, I mean, you're not going 54:08.180 --> 54:08.960 to be using the bloody thing. 54:09.040 --> 54:09.600 Let them suffer. 54:10.060 --> 54:10.600 Right, right. 54:10.680 --> 54:11.200 That's true. 54:15.400 --> 54:17.080 So I guess I can see it from both sides of the coin. 54:18.960 --> 54:26.060 Yes, but, I mean, both Beve and I are actually, we're playing with Honeypot today, this week, 54:26.060 --> 54:29.620 and that's what we were talking about when we were talking about the show topics, and I'm 54:29.620 --> 54:36.620 actually, for a while, I was getting probed by Verizon out of all people, and, like, this 54:36.620 --> 54:46.140 entire slash 16, just random wind servers were trying to connect to my computer, and my snort 54:46.140 --> 54:47.740 protection log were picking them up. 54:47.740 --> 54:51.040 And I couldn't tell what the hell was going on, and what I really wanted to do is I wanted 54:51.040 --> 54:56.120 to just fire up VMware, just have something that was, you know, not my real Windows box, 54:56.220 --> 55:00.160 you know, have a Windows server instance, you know, fire up a Windows server, have it unpatched, 55:00.200 --> 55:03.000 and let's see if I get, you know, owned by something, and whether or not they're actually 55:03.000 --> 55:08.200 just trying to send out harmless packets that look kind of suspicious, because I didn't 55:08.200 --> 55:12.120 ask for them, or actually whether or not they're sending out some type of worm of some 55:12.120 --> 55:12.760 sort, so. 55:13.540 --> 55:20.000 I mean, VMware does have its place, but at the same point, it's not as easily camouflaged 55:20.000 --> 55:21.600 as user mode Linux. 55:22.700 --> 55:26.840 Yeah, I've often wondered if QEMM, or whatnot. 55:27.000 --> 55:30.100 Quick QEMM, you're dating yourself there. 55:30.740 --> 55:31.700 Yeah, I know, thanks. 55:33.100 --> 55:35.660 Yeah, I got more conventional memory out of that. 55:35.760 --> 55:37.180 God, I remember QEMM. 55:37.180 --> 55:41.180 Um, quick, quick pop quiz, what does QEMM stand for? 55:42.060 --> 55:43.160 Oh, my God. 55:43.500 --> 55:45.160 The Quarterdeck Expanded Memory Manager. 55:45.220 --> 55:45.740 Oh, that's right. 55:45.820 --> 55:46.100 Oh, man. 55:46.100 --> 55:49.140 When I was going to say Quark Express Memory Manager, I'm like, no, that's not it. 55:50.120 --> 55:52.340 Okay, B, you can keep on going, we'll start back on topic. 55:53.300 --> 55:58.460 Well, anyways, I'm wondering if you'd be better off running it in something like that 55:58.460 --> 56:01.220 than, say, VMware. 56:01.220 --> 56:04.380 I wonder if it'd be easier to camouflage, but I don't know. 56:04.720 --> 56:06.800 I was just thinking out loud, I guess. 56:07.180 --> 56:10.640 Well, I think we're going to have to look at QEMU here, or QEMM. 56:12.240 --> 56:15.600 I actually had no clue that I could actually win Windows, which is really interesting. 56:18.280 --> 56:22.580 All right, so, you know, basically what the advantage of running a virtual network instance 56:22.580 --> 56:25.880 is, you know, you don't need a separate computer to run it. 56:25.960 --> 56:30.520 It has less power consumption, it has less cost, you know, less space is taken into your rack 56:30.520 --> 56:32.980 or your server room or your bedroom, for that matter. 56:33.680 --> 56:37.940 And all your monitoring software can be on your host machine there. 56:38.800 --> 56:42.760 So all the stuff that's actually, you know, looking at this stuff and monitoring it, 56:42.800 --> 56:44.620 making sure nothing mean happens. 56:44.620 --> 56:51.580 All your stuff is, like, you know, right on your host machine, so, you know, it'll notice 56:51.580 --> 56:54.560 that it's no type of, like, you know, ARP spoofing or any type of crazy thing, 56:54.640 --> 57:00.300 because if your host machine mysteriously goes offline, so won't your honeypot. 57:02.080 --> 57:03.360 Sorry, Petrillo, but are you still here? 57:04.180 --> 57:04.920 Yeah, I'm still here. 57:05.260 --> 57:06.280 All right, do you have any more questions? 57:07.100 --> 57:07.740 No, I'm all right. 57:08.100 --> 57:11.280 Yeah, I just completely forgot to mention you there. 57:12.180 --> 57:12.720 That's all right. 57:14.000 --> 57:14.320 Okay. 57:14.920 --> 57:16.400 All right, well, thank you very much for calling in. 57:16.960 --> 57:17.860 All right, I'll see you guys. 57:18.380 --> 57:18.760 See you later. 57:18.940 --> 57:21.920 And that's, oh, by the way, that's, that's, that's, that, um, oh, I guess not. 57:22.220 --> 57:23.660 I think that's TWAT episode 80. 57:23.760 --> 57:25.920 I figured that he would know, but I guess not. 57:27.160 --> 57:30.000 Okay, so, um, setting one up is really simple. 57:30.000 --> 57:37.720 I had one about, um, 10 minutes running on Debian, and it was, it was insanely simple. 57:37.740 --> 57:40.340 It was, basically, this guy has wrote this very nice tutorial. 57:40.540 --> 57:44.960 It's about, like, you know, I, I think it's, like, five packages you have to install. 57:45.660 --> 57:52.940 Um, and once you do that, it's just a matter of downloading the kernel image, um, popping the, 57:53.400 --> 57:55.720 making a root file system for it, and then running it. 57:55.980 --> 58:03.180 And the, uh, Debian one, for those of you running Debian, is, uh, tinyurl.com slash MikePapaUniformGolfRomeo. 58:03.180 --> 58:13.320 And, um, the only thing that I had to fix was a couple of his URLs, because this one was written in, uh, 2003, 2004. 58:13.680 --> 58:21.960 But, um, either way, the version of his Debian was, um, an older version, which actually works out quite well if you're running a honeypot, 58:22.040 --> 58:23.480 because you don't want to run up-to-date software. 58:23.580 --> 58:25.120 The hell's all the security holes patched? 58:25.120 --> 58:32.100 Um, and, uh, I just had to change a couple URLs, because his URLs were bad. 58:32.260 --> 58:38.220 But other than that, everything seemed to work fine, and, um, it, it turned out fine. 58:38.460 --> 58:43.220 Oh, yeah, and I couldn't install SSH, because it was trying to grab the, uh, my current version. 58:43.540 --> 58:49.800 Which was, it was, it was under the assumption that, uh, the version of Debian I was running on my computer, 58:49.800 --> 58:55.720 and the version of Debian I was installing onto the honeypot was the, uh, same version, which was incorrect in this case. 58:57.280 --> 59:02.320 And, how long did it take you to, you, you, you run Gen2, we won't hold that against you, but, uh, 59:02.800 --> 59:04.040 how long did it take you to set that up? 59:04.040 --> 59:04.200 Well, we're going to mention it, please. 59:05.120 --> 59:07.540 Um, actually, I rolled up my own image in that case. 59:07.880 --> 59:09.060 I actually have a couple other images. 59:09.240 --> 59:14.960 I have a, uh, Slackware 10.2 image, and, um, not very long at all. 59:15.040 --> 59:17.860 Gen2, of course, you build in a change root environment anyways. 59:17.860 --> 59:26.520 So, really, all you have to do is make, and user mode Linux, uh, the file system is kept as a, as a file, 59:26.840 --> 59:28.180 basically, on the host system. 59:28.580 --> 59:28.700 Yeah. 59:28.820 --> 59:38.860 So, um, uh, building it really was basically DDing out the image, uh, about the size that I wanted, 59:39.320 --> 59:45.960 formatting it, you know, uh, change rooting into the environment, doing the normal Gen2 install, in that case. 59:45.960 --> 59:50.100 Um, and just proceeding like a normal, just install, really. 59:50.820 --> 59:57.180 Um, uh, there are also a lot of images that you can find that are even pre-built. 59:57.420 --> 01:00:03.640 If you go to, I think it's, uh, user-mode-linux.sourceforge.net. 01:00:03.640 --> 01:00:09.700 Um, and if you look through their front webpage, they actually, there's a guy who has images out there that you can actually download. 01:00:09.900 --> 01:00:17.160 So, if you want to run, you know, Slackware, or he even has, like, Slackware 4.0, you know, as a Honeypot image. 01:00:17.580 --> 01:00:19.780 Yeah, he basically has a Honeypot image. 01:00:20.340 --> 01:00:22.940 Right, he's already rolled out a lot of these images for you. 01:00:23.260 --> 01:00:25.980 So, um, you can just even grab those or build your own. 01:00:25.980 --> 01:00:28.880 Um, it's not that hard to really roll out your own image. 01:00:29.400 --> 01:00:37.920 Um, it, it took me, I don't know, well, I don't know, several hours to build up my image. 01:00:38.320 --> 01:00:43.600 Really, I spent more time putting vulnerabilities into my images than anything. 01:00:44.660 --> 01:00:45.760 Maybe we'll put back. 01:00:45.820 --> 01:00:47.680 He's got another Honeypot question for us. 01:00:48.320 --> 01:00:48.920 Oh, okay. 01:00:48.920 --> 01:01:09.820 Yeah, I'm sorry to bug you guys again, but I'm just wondering, uh, if you leave certain processes open to, well, susceptible to attack, you know, like, things like Telnet or NetBIOS on Windows, would you notice, um, people going after the machine faster, depending on what's open and what's not? 01:01:11.580 --> 01:01:14.940 Well, I mean, that's, that's, that's a good question. 01:01:14.940 --> 01:01:21.680 Well, actually, um, in my case, uh, as I said, I've been running my Gen 2 image, uh, for a little while. 01:01:22.180 --> 01:01:25.940 And, as I said, I'm probably gonna, I'm probably gonna switch images several times. 01:01:26.220 --> 01:01:40.360 But, um, from Snort, I really haven't noticed any, other than a lot of, uh, uh, Microsoft SQL probes, uh, a lot of, a lot more attacks that would have been targeted toward Windows. 01:01:40.360 --> 01:01:47.880 Now, I don't know if that means that my upstream provider is maybe blocking some ports to keep me safe, uh, which would be kind of a pain in the ass. 01:01:48.120 --> 01:01:52.220 But I really haven't noticed that it would get attacked any faster. 01:01:53.140 --> 01:01:54.800 What about you there, Black? 01:01:55.800 --> 01:02:04.860 Um, I have noticed, in my case, it's, a lot of the stuff that you see for, like, automated probes are just, like, worms. 01:02:04.860 --> 01:02:15.160 Like, for example, um, I, I've seen a boatload of, uh, like, Microsoft Slammer, uh, SQL server probes. 01:02:15.160 --> 01:02:15.940 That's what I've seen, yeah. 01:02:16.300 --> 01:02:16.480 Yeah. 01:02:16.840 --> 01:02:18.480 And, like, uh, gobs of them. 01:02:18.600 --> 01:02:25.280 And, uh, my, the other, the other big hit was the, uh, look, I, I think it's either, you know, it's Verizon's Win servers doing something to me. 01:02:25.300 --> 01:02:26.460 I'm not exactly sure what it is. 01:02:26.820 --> 01:02:32.880 But, I, I, I mean, if you, if you're running services that are vulnerable to certain worms out there, you'll, you'll catch the worms. 01:02:32.880 --> 01:02:36.580 Which, I guess is my, you know, if you're interested in that, go right ahead. 01:02:36.920 --> 01:02:42.160 But, at the same point, I, I'd be much more interested in having someone, you know, real and live at the other end of the line. 01:02:42.960 --> 01:02:43.160 Right. 01:02:43.400 --> 01:02:43.680 Right. 01:02:46.320 --> 01:02:47.380 Well, that's pretty interesting. 01:02:47.820 --> 01:02:48.040 Yeah. 01:02:48.180 --> 01:02:51.980 And, it also comes back to what we were talking about before was the, you know, what's, what's the attack du jour? 01:02:52.600 --> 01:02:57.640 I mean, you can have a Telnet box open, but if not, you can have a Telnet port open, but if no one tries Telnet anymore, you're hosed. 01:02:58.640 --> 01:02:59.520 Yeah, that is true. 01:02:59.920 --> 01:03:00.140 Yeah. 01:03:00.140 --> 01:03:16.920 So, basically what it is is just, yeah, just, what I would do personally is I would, you know, just watch, start watching full disclosure and, you know, bug track and say, you know, if, if there's a giant, you know, open SSH flaw that just got posted, you know, run open SSH and see what happens there. 01:03:16.980 --> 01:03:23.120 Because, you know, people will start, you know, scanning for it and looking for it and all the skitties will be out, you know, checking them out. 01:03:23.120 --> 01:03:35.820 And, also, another thing I did for, especially, you know, not necessarily Apache vulnerabilities, but add-ons like, you know, the AWStat or AW, God, I can't remember the name now. 01:03:36.520 --> 01:03:45.820 Anyways, was just go through my, my, my good working web server logs and see what's been hitting it, you know. 01:03:45.820 --> 01:03:48.900 So, I'd see, like, lots of AWStat PL requests. 01:03:49.420 --> 01:03:49.540 Yeah. 01:03:49.540 --> 01:03:51.340 Well, that's probably a good thing to add in, you know. 01:03:51.620 --> 01:03:57.880 I mean, of course, it didn't work on my, on my regular web system, but it gave me a clue as to what people are looking for. 01:03:58.100 --> 01:04:10.840 So, then I'd go and say, okay, let me find a good old archive copy of, you know, this crappy program or, you know, this program that has lots of holes in it and then throw it up there to kind of speed things up. 01:04:10.840 --> 01:04:11.740 So, yes. 01:04:12.000 --> 01:04:12.340 Right. 01:04:12.600 --> 01:04:16.340 Yeah, and that comes back down to the attack du jour. 01:04:17.600 --> 01:04:18.320 Exactly, yeah. 01:04:21.560 --> 01:04:22.000 All right. 01:04:22.020 --> 01:04:25.560 You have to factor in, of course, though, how popular the exploits are. 01:04:25.680 --> 01:04:31.000 I mean, are there certain types of things that are more popular? 01:04:31.000 --> 01:04:40.100 Like, I don't know, things running on, say, like you guys were talking about Apache, things like that, certain more popular programs over other ones? 01:04:40.840 --> 01:04:47.100 Well, I mean, what it boils down to is what is most likely to receive a hit. 01:04:47.240 --> 01:04:50.980 I mean, people are scanning for vulnerabilities that will most likely be unpatched. 01:04:52.040 --> 01:04:52.120 Right. 01:04:52.340 --> 01:04:56.360 I mean, the AW, people will be scanning for them. 01:04:56.380 --> 01:05:02.920 When I say people, I mean real people, as opposed to, like, we're talking about Slammer over here, and Slammer's been around for, what, two or three years? 01:05:02.920 --> 01:05:09.260 And that's just, you know, worms that people who haven't patched their systems yet, and they're infested with the virus. 01:05:10.420 --> 01:05:13.620 People will be scanning for vulnerabilities that just haven't been patched yet. 01:05:13.620 --> 01:05:30.100 So, for example, if you see tomorrow that, oh, there's a huge hole in Apache, you know, 1, 3, 3, 4, you will, you will, if you're running, people will start looking for Apache 1, 3, 3, 4, and start hitting it with this exploit. 01:05:31.940 --> 01:05:36.920 Can they scan for newer exploits and the older ones at the same time, or does it work? 01:05:36.940 --> 01:05:38.340 Oh, yeah, they can scan for whatever they want. 01:05:38.340 --> 01:05:42.480 If you want to, like, start banging against it, you can start trying for all kinds of things. 01:05:43.600 --> 01:05:43.800 Okay. 01:05:45.660 --> 01:05:46.580 Well, thanks, guys. 01:05:47.220 --> 01:05:47.600 All right. 01:05:47.800 --> 01:05:48.060 All right. 01:05:48.680 --> 01:05:49.740 I think we answered your question. 01:05:49.860 --> 01:05:50.560 I hope you did a good job. 01:05:51.180 --> 01:05:51.300 Yeah. 01:05:51.400 --> 01:05:52.620 Glad I could give you something to talk about. 01:05:53.240 --> 01:05:53.480 Mm-hmm. 01:05:53.600 --> 01:05:54.460 Okay, any time, man. 01:05:55.120 --> 01:05:55.640 All right. 01:05:56.220 --> 01:05:56.660 Take it easy. 01:05:57.160 --> 01:05:57.500 Later. 01:06:01.860 --> 01:06:05.980 Okay, so you have your user mode Linux set up, and you have it full of exploits. 01:06:05.980 --> 01:06:12.180 I guess the next question with the honeypot, the other part of the honeypot you need to set up is you need to find out a way to monitor it. 01:06:13.540 --> 01:06:23.920 And the way with user mode Linux, you know, we talked about TTY logging, which is, we discussed that already, and that's basically your first line of defense, 01:06:24.000 --> 01:06:27.260 because basically you'll have a nice little log of whatever the person did. 01:06:27.260 --> 01:06:35.220 And programs you can run on your host machine, for example, there's Snort, which is an intrusion detection system. 01:06:35.220 --> 01:06:44.280 And it's not the, you know, primo, you know, IDSs to end all IDSs, but it's free, and it runs on Linux. 01:06:44.440 --> 01:06:45.800 And it's fairly okay. 01:06:46.460 --> 01:06:49.180 It's available at www.snort.org. 01:06:50.400 --> 01:06:58.860 And if you're running Snort, there's another add-on to it that provides all their alerts and everything with a nice web interface to it. 01:06:58.860 --> 01:07:02.540 And that's, it's called BASE, or ACID-BASE. 01:07:03.820 --> 01:07:07.980 ACID stands for Analysis Console for Intrusion Detection. 01:07:08.700 --> 01:07:11.160 Yeah, I think they took that over. 01:07:11.740 --> 01:07:16.620 I think it now stands for Basic Analysis something, it stands for something different. 01:07:17.100 --> 01:07:17.940 Oh, they actually merged? 01:07:18.980 --> 01:07:20.160 It ended up forking. 01:07:20.160 --> 01:07:22.760 Oh, well, I know BASE installed, yeah. 01:07:23.720 --> 01:07:31.280 Yeah, basically ACID wasn't being maintained anymore, so actually a local group here in town ended up taking it over 01:07:31.280 --> 01:07:35.300 and started rewriting it and adding new code and making it better. 01:07:36.720 --> 01:07:42.420 Yes, and they forked it, and then all the ACID people said, hey, use BASE, it's so much better now. 01:07:43.260 --> 01:07:43.940 Right, right. 01:07:43.940 --> 01:07:50.440 Well, I mean, nobody used, well, as I said, you know, BASE or ACID was pretty much non-supportive anymore. 01:07:50.540 --> 01:07:53.880 I mean, it wasn't getting updated, and I think that's the reason why BASE came about. 01:07:54.140 --> 01:07:54.720 But, yeah, yeah. 01:07:55.620 --> 01:08:00.820 Yeah, and that's available at tinyurl.com slash papaecho9whiskey8. 01:08:02.380 --> 01:08:08.220 And also, there's everyone's favorite, TCD dump, and that's basically going to give you a nice little raw PCAP capture 01:08:08.220 --> 01:08:11.500 of everything that's going on over on your computer. 01:08:11.500 --> 01:08:20.280 Which, actually, I do, I write out PCAPs for pretty much the entire session that I have the honeypot up. 01:08:20.680 --> 01:08:28.340 I write out PCAPs for, because then I can go back if I want to and use, like, TCP replay or something like that if I want to, you know, 01:08:28.420 --> 01:08:34.180 and basically regenerate the attack or whatnot and just basically grab all the information, 01:08:34.340 --> 01:08:38.620 all the traffic that happened while the attack was going on or whatnot. 01:08:41.500 --> 01:08:43.560 All right. 01:08:43.740 --> 01:08:49.280 So, now, the other question, I guess we could sort of, like, go on to our own little favorite stories here, 01:08:49.380 --> 01:08:51.020 because we're kind of running short on time. 01:08:51.020 --> 01:09:00.900 Actually, I have one other thing that I also do, just real quick. 01:09:01.380 --> 01:09:01.640 Oh, sure. 01:09:02.260 --> 01:09:05.700 I'm sure a lot of people are familiar with, like, Tripwire, things like that. 01:09:06.340 --> 01:09:06.500 Yeah. 01:09:06.500 --> 01:09:10.840 There's a program called Aid, and I actually made a tiny URL for it. 01:09:10.900 --> 01:09:17.740 It's tinyurl.com to Sierra Sierra to Oscar, because it's kind of a long URL. 01:09:17.740 --> 01:09:19.640 And it's very similar to Tripwire. 01:09:19.800 --> 01:09:27.520 And what I do is, before I put my image online, I make a snapshot of it using something that is very similar to Tripwire, 01:09:27.940 --> 01:09:33.940 so that whenever the system gets compromised, I can take the image offline, rerun it, 01:09:34.160 --> 01:09:39.060 and then see what files have changed, and then, you know, kind of mark what exactly has happened. 01:09:39.520 --> 01:09:39.740 But anyways. 01:09:40.580 --> 01:09:41.580 That's actually a good idea. 01:09:41.660 --> 01:09:42.600 I should have done that beforehand. 01:09:42.600 --> 01:09:43.140 Oh, well. 01:09:45.420 --> 01:09:51.960 Because, personally, I just set up my – I finally released my UML image out to the world this afternoon. 01:09:53.180 --> 01:09:58.900 Actually, I finally finished just the last bit right before the show, being like 845 rolls around, 01:09:59.080 --> 01:10:02.860 and I'm on the call with Beave, and I said, okay, well, SSH is up now. 01:10:02.860 --> 01:10:11.140 Just to have a quick other thing, for those of you who aren't interested in running user mode Linux, 01:10:11.340 --> 01:10:17.600 there's another program out there called HoneyD, which is not quite a full-fledged honeypot, 01:10:17.760 --> 01:10:23.720 but it allows basically – it allows you the ability to emulate most of the features of a honeypot. 01:10:24.600 --> 01:10:29.360 HoneyD is a daemon that runs on the server and eliminates a separate machine on the network. 01:10:29.360 --> 01:10:34.760 And, basically, you can configure this, you know, faux machine to respond any which way until Sunday. 01:10:34.920 --> 01:10:45.260 You know, like 100-millisecond latency, 10% packet loss, you know, return TCP fingerprint of a AX 4.2 server, etc. 01:10:45.420 --> 01:10:48.240 It's very interesting what they did with it. 01:10:48.840 --> 01:10:53.060 And, basically, also what you can do is you can also configure it to point the services hosted on your own machine, 01:10:53.060 --> 01:11:01.800 say, like Apache, or you can do what I did, and what they also tell you you can do is run a bunch of scripts 01:11:01.800 --> 01:11:05.840 that emulate broken services so you can take a look at how people are probing you. 01:11:07.120 --> 01:11:11.000 I have a ton of scripts that just emulate a very badly secured machine. 01:11:11.080 --> 01:11:12.440 Like, I was talking about my Telnet script. 01:11:12.440 --> 01:11:21.340 I have a web script that looks your HTTP request, and if it looks like you're returning a CodeRed attack 01:11:21.340 --> 01:11:29.260 or something like CodeRed or NimDir, one of those, it will return you a response of, hey, it worked, 01:11:29.380 --> 01:11:30.600 so you can try to connect to it. 01:11:30.880 --> 01:11:32.000 It was pretty interesting. 01:11:32.000 --> 01:11:42.700 One of the things I actually did was set up a script that looked like an open relay for spam connections, 01:11:42.960 --> 01:11:48.400 and if you would send a spam connection and the person would connect to it and try to send a relay message out, 01:11:48.480 --> 01:11:51.340 and it would accept it, and it would log it to a file for me. 01:11:52.120 --> 01:11:55.080 And when I had, like, gobs of amount of bandwidth, when I was on Speakeasy, 01:11:55.220 --> 01:11:59.880 what I would do is I would send their probe message back to them when I was bored, 01:11:59.880 --> 01:12:03.520 and I'd watch them connect and start relaying messages through me, 01:12:03.560 --> 01:12:05.500 or what they thought was relaying messages to me. 01:12:05.580 --> 01:12:07.740 In reality, it just gets logged to my hard drive. 01:12:08.860 --> 01:12:14.220 So it was a fun feeling, you know, sitting there watching them waste their time and effort 01:12:14.220 --> 01:12:18.780 and me just, you know, taking a bullet for the Internet for me. 01:12:18.940 --> 01:12:19.320 That's me. 01:12:19.560 --> 01:12:19.920 Exactly. 01:12:20.120 --> 01:12:20.920 Getting back at them. 01:12:21.100 --> 01:12:21.240 Yeah. 01:12:23.600 --> 01:12:24.140 Look at me. 01:12:24.240 --> 01:12:25.100 I'm so nice. 01:12:25.280 --> 01:12:26.640 Someone should nominate me for a saint. 01:12:26.640 --> 01:12:30.520 Ratchet, I nominate you for a saint. 01:12:31.120 --> 01:12:32.060 Oh, thanks. 01:12:32.240 --> 01:12:33.160 The Church of Strom. 01:12:33.300 --> 01:12:33.500 Ratchet. 01:12:33.880 --> 01:12:34.140 Yes. 01:12:34.980 --> 01:12:38.080 He's going to nominate me, but he'll just procrastinate it, and it'll never get done. 01:12:40.420 --> 01:12:41.920 You're never going to let that down, you know. 01:12:42.480 --> 01:12:42.920 I know. 01:12:43.140 --> 01:12:43.480 I know. 01:12:45.080 --> 01:12:48.560 So, while we were talking about stuff that we did with, what we noticed for the Honeypot, 01:12:48.660 --> 01:12:53.180 what, you know, you were talking about your slammer request and your other things. 01:12:53.180 --> 01:12:56.020 Is there any, if you've gotten, have you gotten owned yet? 01:12:56.320 --> 01:12:58.360 Any, any super elite Chinese hackers? 01:13:00.280 --> 01:13:01.220 No, not really. 01:13:02.660 --> 01:13:07.720 I've, I've had a couple of, a couple of things I've come across where they were close, 01:13:08.080 --> 01:13:10.860 but didn't really get to where I wanted them to get to. 01:13:12.140 --> 01:13:13.620 What about, what about your friend's Honeypot? 01:13:14.720 --> 01:13:16.620 Now, my friend's Honeypot was another matter. 01:13:16.620 --> 01:13:25.260 Actually, what had happened to him is he saw somebody trying to do, I believe it was the 01:13:25.260 --> 01:13:30.460 AWStatPL, one of those old bugs that had been out there for a while, and basically he was 01:13:30.460 --> 01:13:37.940 going out and trying to grab a Perl bot to, you know, take, well, basically download the 01:13:37.940 --> 01:13:43.660 Perl bot and run it as Apache and join this particular IRC server so that they could pretty 01:13:43.660 --> 01:13:46.340 much control the machines from the IRC server, basically botnet. 01:13:48.160 --> 01:13:55.080 And what he decided to do was he was looking, even though it didn't actually get on the 01:13:55.080 --> 01:13:59.340 actual Honeypot, he looked through and pulled down the bot code and saw that there were two 01:13:59.340 --> 01:14:01.860 administrators for the botnet. 01:14:02.580 --> 01:14:06.320 And one of them was called Dock, I believe, and one of them was called Timer. 01:14:06.320 --> 01:14:13.180 So he actually used Tor to connect to the IRC server that the person was controlling the 01:14:13.180 --> 01:14:19.460 botnet from and connected up and saw that, sure enough, that Dock was logged in, D-O-C-K. 01:14:20.500 --> 01:14:25.100 And realized, wow, he's not using his other administrator account. 01:14:25.760 --> 01:14:31.620 So after chatting with the guy for a little while, who was evidently in Romania, which I've 01:14:31.620 --> 01:14:36.800 typically found, I run into a lot of botnet guys who are in Romania, I don't know what's 01:14:36.800 --> 01:14:43.880 up with that, but he saw that he wasn't using one of his admin accounts, so he kind of waited 01:14:43.880 --> 01:14:47.560 around, talked with the guy for a little while, the guy ended up, I think, taking him off the 01:14:47.560 --> 01:14:51.980 channel, whatnot, but waited around, figured the guy had to go to sleep at some point in 01:14:51.980 --> 01:14:56.820 time, and then ended up joining the channel and then changing his nick over to Timer, which 01:14:56.820 --> 01:14:59.120 was the other botnet controller. 01:14:59.540 --> 01:15:03.900 The guy had actually de-voiced the channel, so he couldn't send, I guess he thought that 01:15:03.900 --> 01:15:10.860 he couldn't send commands to the botnet, but he could PM, private message, each individual 01:15:10.860 --> 01:15:12.980 bot that was connected. 01:15:13.980 --> 01:15:20.860 So his big plan and his big Robin Hood move, I guess you could call it, was to tell each 01:15:20.860 --> 01:15:30.400 bot to, considering he had known what exploit he had come through, was to change mod 0, 0, 0, 01:15:30.400 --> 01:15:35.020 0, 0, AWStats PL first, leave the log... 01:15:35.020 --> 01:15:36.040 So make it not executable. 01:15:36.920 --> 01:15:37.440 Exactly. 01:15:38.600 --> 01:15:43.800 And then leave a little syslog message with the logger command, you know, echo, hey, your 01:15:43.800 --> 01:15:48.200 machine's been owned, please upgrade AWStats or whatever you're using. 01:15:48.200 --> 01:15:54.960 And then proceeded in going through each particular bot and taking each one offline. 01:15:56.020 --> 01:16:00.500 Basically just going through, considering, I mean, he had the same control as the botnet 01:16:00.500 --> 01:16:06.980 owner, so he would just go through, send the botnet, like, first PS, and then it would 01:16:06.980 --> 01:16:13.160 PM him back, like, the process list, and then going through and just killing off each process. 01:16:13.160 --> 01:16:18.280 And so he would see each bot that was connected actually disconnect. 01:16:19.040 --> 01:16:20.980 So then he got it down to where... 01:16:20.980 --> 01:16:24.620 So he finally got the channel down to where there was no more bots left. 01:16:24.920 --> 01:16:27.520 And, of course, the original owner of the botnet wasn't around. 01:16:28.220 --> 01:16:35.620 And then pretty much just killed off everything that he had left behind. 01:16:35.620 --> 01:16:42.320 The only problem is the legalities of that, you're, you know, you're kind of, at that 01:16:42.320 --> 01:16:47.360 point, even though you're trying to, you know, do something noble, and I guess you could 01:16:47.360 --> 01:16:52.780 say, you know, make sure these machines aren't vulnerable again, you're still, you know, 01:16:53.040 --> 01:16:55.340 modifying machines that are not yours. 01:16:55.900 --> 01:16:59.080 But, you know, he kind of had, like, the Robin Hood complex thing. 01:16:59.080 --> 01:16:59.520 Exactly. 01:17:00.480 --> 01:17:04.560 I think Robin Hood was a very, very apt, I don't know, simile? 01:17:04.840 --> 01:17:06.040 Or was it an analogy? 01:17:06.260 --> 01:17:07.120 That's what I'm talking about. 01:17:07.240 --> 01:17:07.360 Metaphor. 01:17:07.360 --> 01:17:07.720 Metaphor, yeah. 01:17:07.720 --> 01:17:08.680 Metaphor, thank you. 01:17:09.340 --> 01:17:10.500 But leave it to the frame or nothing. 01:17:11.420 --> 01:17:12.700 Yeah, don't leave it open. 01:17:12.900 --> 01:17:13.700 Kill it all off. 01:17:13.940 --> 01:17:18.520 And then, you know, sure, it might give the admin a little bit of headaches, but at least 01:17:18.520 --> 01:17:21.360 they'd know, and at least the machine wouldn't be owned anymore. 01:17:21.360 --> 01:17:27.500 Because, you know, I mean, let these guys turn around and use them for spam or whatever 01:17:27.500 --> 01:17:30.120 they can, you know, get away with at that point. 01:17:30.340 --> 01:17:31.880 So that was, like, pretty much his idea. 01:17:33.080 --> 01:17:38.800 Well, essentially what your friend did to the admins was your, it's opposed to, you 01:17:38.800 --> 01:17:42.260 know, taking a Band-Aid off slowly or just ripping it off and dealing with the consequences. 01:17:43.040 --> 01:17:43.240 Mm-hmm. 01:17:43.440 --> 01:17:44.700 You know, deal with the pain. 01:17:44.840 --> 01:17:45.020 Exactly. 01:17:45.020 --> 01:17:48.080 You're not going to have to fix it or anything, or as opposed to, you know, letting it fester 01:17:48.080 --> 01:17:49.260 there and... 01:17:49.260 --> 01:17:50.460 Right, right. 01:17:50.460 --> 01:17:54.380 But, I mean, legally, that's a whole... 01:17:54.380 --> 01:17:55.540 Yeah, exactly, exactly. 01:17:56.580 --> 01:17:59.820 I mean, as noble as it is, it probably isn't the best thing to do. 01:18:00.080 --> 01:18:04.580 And actually, he was using Tor because one of the big things, you know, he didn't want 01:18:04.580 --> 01:18:11.080 to connect up and then have the bot that owner know exactly where he's coming from because 01:18:11.080 --> 01:18:12.560 of a company he didn't work with. 01:18:13.020 --> 01:18:17.100 Exactly, for, you know, you know, the guy might get pissed and do, like, denial-of-service 01:18:17.100 --> 01:18:17.860 attacks on him. 01:18:18.020 --> 01:18:19.740 So, you know, Tor's a nice thing in that case. 01:18:19.740 --> 01:18:26.260 And a lot of these networks that run botnets are just really small networks or just machines 01:18:26.260 --> 01:18:27.520 that they've set up themselves. 01:18:28.240 --> 01:18:30.460 So, kind of interesting. 01:18:32.140 --> 01:18:32.460 All right. 01:18:32.520 --> 01:18:35.660 Well, we've got about five minutes left, so... 01:18:36.660 --> 01:18:38.240 Do we have announcements? 01:18:38.820 --> 01:18:40.060 No, we have announcements this week. 01:18:40.740 --> 01:18:42.180 Let's do DC2 and 3 this week. 01:18:42.180 --> 01:18:45.120 Don't forget Layer 1 in April. 01:18:46.340 --> 01:18:47.220 Layer1.info. 01:18:48.020 --> 01:18:51.960 I'll be going to Linux World April 3rd through 7th in Boston. 01:18:52.360 --> 01:18:55.180 So, anyone in the general Boston area, I think I'll be there. 01:18:55.260 --> 01:18:56.140 Koresh will be there. 01:18:57.000 --> 01:18:58.200 Red Nerd will be there. 01:18:58.200 --> 01:19:04.300 I think my work has managed to give me all four days off, even though I only asked for 01:19:04.300 --> 01:19:04.580 one. 01:19:05.160 --> 01:19:09.220 So, I'm not sure what the heck I'm going to be doing all those days, but I will be, you 01:19:09.220 --> 01:19:11.420 know, living on the convention floor, getting free stuff. 01:19:11.880 --> 01:19:12.240 Partying. 01:19:12.900 --> 01:19:13.260 Yep. 01:19:13.980 --> 01:19:15.180 Having my cheese and wine. 01:19:15.300 --> 01:19:15.800 There we go. 01:19:16.120 --> 01:19:16.400 Mm-hmm. 01:19:17.000 --> 01:19:17.280 Yep. 01:19:17.280 --> 01:19:22.060 Steve, do you have any announcements that you would like to make? 01:19:22.900 --> 01:19:23.640 Oh, man. 01:19:23.960 --> 01:19:25.300 Not really right off. 01:19:26.900 --> 01:19:27.340 No. 01:19:29.340 --> 01:19:32.020 Next week's show will be about Interzone. 01:19:32.220 --> 01:19:38.140 So, if you have Interzone stories or, you know, gripes or whatever, send them in on the 01:19:38.140 --> 01:19:42.080 show, and hopefully, you know, Strom will actually post this up to the archives so people 01:19:42.080 --> 01:19:43.380 will be able to listen to this. 01:19:43.620 --> 01:19:44.580 It'll be up tonight. 01:19:45.320 --> 01:19:46.080 It'll better be. 01:19:47.280 --> 01:19:48.800 Um, Shouts! 01:19:48.960 --> 01:19:49.840 Steve, do you have any Shouts? 01:19:50.820 --> 01:19:55.540 Oh, yeah, definitely the Telefreak crew, all my buddies over at Telefreak, the Death 01:19:55.540 --> 01:20:01.000 Row Cluster, the OpenVMS Death Row Cluster, all those guys who use that machine every freaking 01:20:01.000 --> 01:20:04.240 day, or those machines, I should say, it is a cluster. 01:20:05.800 --> 01:20:06.680 That's about it. 01:20:07.980 --> 01:20:12.120 Seriously, we'll have to, like, have you come on and talk about VMS and, like, the three 01:20:12.120 --> 01:20:13.640 people that use it that use the cluster. 01:20:14.220 --> 01:20:15.420 Oh, dude, you should get on. 01:20:16.100 --> 01:20:17.080 You've never seen a cluster. 01:20:17.080 --> 01:20:19.380 We have so many people use the cluster. 01:20:20.000 --> 01:20:20.320 Really? 01:20:20.400 --> 01:20:23.440 Everybody thinks it's, like, three people, but if you get on the middle of the day, we 01:20:23.440 --> 01:20:27.820 always have, like, I don't know, 40, 50 people logged in to the cluster. 01:20:27.900 --> 01:20:30.520 Are you sure it's, like, not only three people with, like, tons of Tor clients? 01:20:30.520 --> 01:20:38.520 It could be, I don't know, but most of these feet now, most of them are in there because 01:20:38.520 --> 01:20:44.960 we have a BBS on the Death Row Cluster, and some of them just get on for the BBS, some of 01:20:44.960 --> 01:20:50.320 them just get on to use the machine for email, some of them write code, actually write code 01:20:50.320 --> 01:20:52.160 for VMS, believe it or not. 01:20:52.160 --> 01:20:52.800 All right. 01:20:53.460 --> 01:20:55.080 The sick, sad folks that they are. 01:20:56.180 --> 01:20:56.520 I know. 01:20:57.240 --> 01:20:57.680 I'm sorry. 01:20:57.680 --> 01:20:59.140 I shouldn't be knocking VMS people. 01:20:59.340 --> 01:21:00.420 I've never actually... 01:21:00.420 --> 01:21:00.920 I was going to say, don't... 01:21:00.920 --> 01:21:02.580 Aren't you a big AS400 guy? 01:21:03.920 --> 01:21:04.600 Stank is. 01:21:05.900 --> 01:21:08.960 Stank will be sitting there going, like, listen to this going, oh, man. 01:21:09.620 --> 01:21:10.400 VMS guys. 01:21:11.080 --> 01:21:14.160 You know, people use VMS for, like, child molesters and... 01:21:14.160 --> 01:21:18.240 Yeah. 01:21:19.100 --> 01:21:19.540 Okay. 01:21:20.180 --> 01:21:20.700 All right. 01:21:21.840 --> 01:21:24.060 But, yeah, that's about the end of my shout-outs there. 01:21:24.740 --> 01:21:25.620 Strom, do you have any shouts? 01:21:26.060 --> 01:21:29.720 Shouts to Mibufo for asking totally awesome questions and... 01:21:29.720 --> 01:21:30.300 Indeed, indeed. 01:21:30.300 --> 01:21:33.960 And shouts to the Auto Club of Southern California. 01:21:35.140 --> 01:21:36.400 Did you break down lately? 01:21:37.460 --> 01:21:40.300 No, they make dealing with the DMV much easier. 01:21:41.200 --> 01:21:41.760 Oh, okay. 01:21:42.760 --> 01:21:46.760 I'll send a shout-out to Petrillo, too, for showing out there. 01:21:46.860 --> 01:21:52.560 And I guess if you want to talk about honeypots on VMware, go listen to his TWA Tech episode. 01:21:52.760 --> 01:21:54.380 That's twatech.org. 01:21:56.120 --> 01:21:56.780 I don't know. 01:21:56.940 --> 01:21:58.700 Shouts to you, Beaver, coming on. 01:21:59.340 --> 01:22:03.340 He's basically turning me on to this whole user-mode Linux thing, which I've never actually... 01:22:03.340 --> 01:22:09.300 I played with Lightly in, like, 2003, but beyond that, I was never ever even thought of actually setting it up like this. 01:22:10.220 --> 01:22:10.820 Silly me. 01:22:10.820 --> 01:22:11.180 It's not fun. 01:22:11.760 --> 01:22:15.780 The site of the week is www.honeyd.org. 01:22:15.860 --> 01:22:17.640 H-O-N-Y... 01:22:17.640 --> 01:22:18.280 No, sorry. 01:22:18.440 --> 01:22:19.160 I could spell you that wrong. 01:22:19.300 --> 01:22:19.680 Oh, man. 01:22:19.700 --> 01:22:20.020 I'm tired. 01:22:20.360 --> 01:22:22.980 H-O-N-E-Y-D dot O-R-G. 01:22:24.320 --> 01:22:24.680 Email. 01:22:25.080 --> 01:22:25.940 Please email us. 01:22:26.040 --> 01:22:26.380 Come on. 01:22:26.520 --> 01:22:30.820 Email us your Interzone stories or anything over the past three or four weeks that people have missed. 01:22:30.980 --> 01:22:34.280 We have completely discussed the YIG slash DIG topic to death. 01:22:34.360 --> 01:22:35.080 Thank you very much. 01:22:35.600 --> 01:22:37.080 Radio at binrev.com. 01:22:38.060 --> 01:22:39.180 As always. 01:22:39.760 --> 01:22:40.880 Strom, what's closing music tonight? 01:22:40.880 --> 01:22:44.700 Closing music is something from OC Remix. 01:22:44.840 --> 01:22:49.560 It's actually a pretty sweet remix of some music from Mario Paint, surprisingly. 01:22:51.400 --> 01:22:52.040 All right. 01:22:52.200 --> 01:22:53.540 Well, we'll be looking forward to listening to that. 01:22:53.940 --> 01:22:54.220 Yeah. 01:22:54.220 --> 01:22:57.180 So, as always, we will see you next week. 01:22:57.680 --> 01:22:58.460 Same hack time. 01:22:59.040 --> 01:23:01.480 Same hack channel. 01:23:01.720 --> 01:23:01.900 Bye-bye. 01:23:01.940 --> 01:23:02.520 Bye-bye. 01:23:02.620 --> 01:23:02.900 Bye-bye. 01:23:03.260 --> 01:23:03.880 Bye-bye. 01:23:04.080 --> 01:23:04.380 Bye-bye. 01:23:04.380 --> 01:23:04.800 Bye-bye. 01:23:04.980 --> 01:23:05.080 Bye-bye. 01:23:05.280 --> 01:23:05.380 Bye-bye. 01:23:05.400 --> 01:23:05.980 Bye-bye. 01:23:07.540 --> 01:23:07.900 Bye-bye. 01:23:07.900 --> 01:23:08.800 Bye-bye. 01:23:11.440 --> 01:23:12.180 Bye-bye. 01:23:12.180 --> 01:23:12.660 Bye-bye. 01:23:13.040 --> 01:23:13.640 Bye-bye. 01:23:14.300 --> 01:23:19.400 Bye-bye. 01:23:19.440 --> 01:23:20.400 Bye-bye. 01:23:20.400 --> 01:23:20.920 Bye-bye. 01:23:20.920 --> 01:23:21.220 Bye-bye. 01:23:21.260 --> 01:23:21.480 Bye-bye. 01:23:21.580 --> 01:23:22.000 Bye-bye. 01:23:24.500 --> 01:23:25.740 Bye-bye. 01:23:25.740 --> 01:23:27.780 Bye-bye. 01:23:27.860 --> 01:23:29.340 Bye-bye. 01:23:29.340 --> 01:23:30.420 Bye-bye. 01:23:30.420 --> 01:24:00.400 We'll be right back. 01:24:00.420 --> 01:24:30.400 We'll be right back. 01:24:30.420 --> 01:25:00.400 We'll be right back. 01:25:00.420 --> 01:25:30.400 We'll be right back. 01:25:30.420 --> 01:26:00.400 We'll be right back. 01:26:00.420 --> 01:26:30.400 We'll be right back. 01:26:30.420 --> 01:27:00.400 We'll be right back. 01:27:00.420 --> 01:27:30.400 We'll be right back.