This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned, in your digital stance getting firewalled ho, cause I'm riding the net in
my six-fold, I was a dick with my 56, now with my cable I'm able to get that stable,
on the out, my name is Ace and I'm a Leo, on the digital highway, my name is Neo and
I'm a hero, in a flash, I'll screw you on burning dreamcast, you need some ISO, let me through
my hard drive rifle, our exchange you could never stifle, in a digital hug, you just caught
the love bug, I bootlegged your CD, I caused a fight between Un and Jay-Z, your CG, it's
all gonna be free, whether we take it by force or we take it nicely, you feel that rattling
your phones, when I tell you we just hacked out Jones, and NASDAQ leaves your fight on
your back, cause I am he who loves to hack and crack, cause I am he who loves to hack and
crack, this is dedicated to the hackers and the crackers, serial codes, source codes, ISOs,
RANs, SIFs, SIFs, this is dedicated to the hackers and the crack, we are back once again
this week ladies and gentlemen with Binary Revolution Radio, I am Stank Dog, fully recovered from
my off week last week, I had the bird flu or something, I don't know what I had last
week, but we did not get a show out last week, however today, March 6, 2007, you are going
to get two episodes for the price of one, and considering that one is free, so are two, double
header episode this week, that will keep us back on the path, keep us on track as far
as keeping a weekly release of the show out, even though we all know that that's an out
and out lie, and I am a son of a bitch for even saying that on the air, but what are
you going to do, and this is actually going to be kind of an interesting week for the
show, because the back to back episodes that we are going to do, again this is 188, and
we have a new first time co-host on episode 188 with me, and that co-host is Mubix, welcome
to the show, and Mubix and I have been chatting with, chatting in IRC and actually here on Bell's
line quite a bit lately, and we came up with some cool stuff to talk about for the show
tonight, so we are going to get into that a little bit later on, but the other reason
this double header is a little bit interesting is this is kind of a Hack 5 double header spectacular,
if you will, because the second episode, episode 189 coming up, is from our good friend Droops
who recorded an episode with the gang over at Hack 5, so stay tuned for that in about
an hour and a half from now.
What else do we have in housekeeping?
We are going to, oh we made some forum changes, once again controversial forum changes, it seems
to be anything I ever change is controversy, but made some changes to the forums, basically
we've, you know, I think a lot of our regular listeners and regular visitors to the forum
know that we've had some problems where we've just outgrown our hardware, we've upgraded to
new hardware, and I'd rather not have to upgrade again, so what I'm doing is kind of cracking
down and getting a little bit more efficient with the system and the hardware that we have,
so every little minor change along the way that can help me keep the server running smoothly
for our actual registered users, the users that we want to serve most, the users that
actually care and show support, we want to try to provide the best experience that we
can, so to that end, we have basically taken the biggest forums that we have and still kept
them publicly available, we want information to be free, we want people to be able to find
it, Google and that sort of thing, which is great, so we put all of the big forums out
there, the top five forums, and made them publicly available just as they always have
been, anybody can browse and read that information, but what we've done is we've taken all of
the other forums, the smaller ones, the more focused forums where they're actual members
working on things together and sharing information on specific topics, and we've made it so that
you have to register with the forums to get access to those, so even to browse them or read
them.
Now, I don't see why that's a big deal, it's not like we're charging money, anybody can register
for free, that's not a big deal in my opinion, but there's some people out there, ironically
registered members, who don't seem to like this, so I'm not sure what to tell you about
that, but in the long run, it's going to help a lot of different things, it's going to have
less traffic from people that are finding some of the code that we're working on, a lot of
the projects down there are being discovered while they're still in progress, while there's
work going on, so they're getting shut down quickly and they don't work anymore, so a lot
of these projects are getting ruined because people are coming from nowhere, finding them
or stealing the work and taking it somewhere else, which is something we don't want to
do, so it's just kind of like, I don't know, there's several different reasons in my mind
to do it, and the bottom line is, you know, if you're visiting the site so much that you're
frequenting all of those other forums, then I don't see why it's a big deal to register,
I mean, show some support, register for the site, doesn't really change anything, it's
just, basically, it's what it is, showing support, I've seen a lot of other forums out
there that require registration to access anything at all, period, so, you know, we're
still giving out the majority of information in the top five forums, which is easily 75% of
the content of the site, still out there for anybody to access anywhere, anytime, which
is great, the only other thing that was brought to my attention is that somebody said they
don't like to log into the servers from a public location, they don't want to send their
password, plain text, or any of that kind of stuff, so that I certainly understand, and
that's a valid concern, we are in the process of putting a self-signed SSL certificate, actually
we already have one, we're just in the process of slapping that on the forums so that people
can log in securely from anywhere as well, so that should alleviate that problem, so
if that's the only concern, that is something that is certainly fixable, but if you want
to access all those other forums, hey, just register and everything's fine, everything's
honky dory, so the information's free, no matter, you know, either way you do it, just
register and show a little support, I'm tired of seeing at the bottom of the forums, we
have 120 users, or 120 people browsing the forums, but only, you know, 14 registered, you
know, we've got all these people that are just putting a load on the server, well those
14 people that are registered to me deserve a little bit more respect and support from
us, so I want to make their experience as good as possible, as fast as possible, I'm
not going to let those other hundred and some people slow the server down for them, they're
welcome to come browse the information in the top five forums, but I'm not going to let
them go in there and research and get down to the details, if they're not even going to
show the courtesy to register for the site, so I understand some people aren't going to
like it, but, hey, what can I tell you, deal with it, what do you, I got a real quick
point, for the person who doesn't have, doesn't want to send their password over clear text
to the server, until you have SSLs there, later on in the school, that's a really easy
way to do that from a public location, cool, very cool, well then that's a good timing to
do the show, we'll talk about this subject, which is a bunch of useful applications that
you can put on your USB tool, that's going to be our main topic, a USB key, a bunch of
useful tools that you can carry around with you, and that serve purposes just like that,
a very specific purpose, and that you can use from anywhere, anytime, but, if you didn't,
unless you had some housekeeping as well, no, no housekeeping, first time, so, why don't
we move into some email, and our first email this week comes from NJAC, I guess that's a
name, is that an acronym, N-J-A-K, N-J-A-K, N-J-A-K, I'm going to call him N-J-A-K, all right,
N-J-A-K, I have, or N-J-A-K, no, it's just N-J, whatever, N-J-A-K, who says, I wish to
ask, I love, I love just trying to figure out the names of people that are right in, N-J-A-K,
it can't be that hard, but I'll make it complicated, because that's what I do, N-J-A-K says, I wish
to ask the question, why don't computers encrypt using images, sound, touch, taste, and even
smell, figure that in a key, you don't have to use any characters and symbol, what takes
the place of characters, can look like, wait a minute, what, look like the same to the human
eye, can look like this, can look like the same to the human eye, so why not just assign
A to Y equals M, and then give it a color value, pound 0000XX, where XX is 1Z to 33Z, Z is a
random integer between 1 and 3. Next, do the same with B and so on, every character in theory
could be Y equals M, with a color value of, pound 000001, then a picture could then be
displayed with an interval based on character. So, if you encrypted the name StankDog, quote
unquote StankDog, to a computer, would read it as Y equals M, comma, pound 000001, comma,
at X equals X plus 0.3 seconds, that would be the T, I guess, if I'm following him here,
Y equals M, comma, pound 000001, at X equals X plus 1 second, and I'm not going to read all
these so on as Sunforth, but to an end user, that is just one black line. I see there being
a lot of possibles given this mode of thinking. Now, I could go way deeper into this, but for
now, why can't StankDog equal 12 pixels, bark, quote bark, smooth, bitter, and mint? Just throwing
out an idea in Jack. I think you're, you're saying that you're smooth, you're bitter, and
you're minty. And minty? Yeah. And stank at the same time somehow. Yeah. Well, I'm not, I've
got to be honest, I'm not quite sure I'm exactly following you. I mean, let's, okay, let's back
up a little bit. We've talked about a topic, steganography, on the show a few times in the
past. So, anytime that you're hiding information inside of other file types, most commonly images,
but it can certainly be a music video or anything like that, the term is steganography, and you can
hide data in there in multiple different ways. Usually, it's a, it's a matter of, of least
significant bits, but, gosh, I can't go, I don't want to go into too much detail, because it would
take a whole show in and of itself again, and I think, again, we've done that before.
Um, but, there are a lot of ways that you can hide data in images, and the person on
the other end would have to know the algorithm, or the way that you put that data in there,
and it's something that you can't really see. It does not sound like that's what you're
describing here in Jack. It sounds like what you're describing is, I don't know, I'm not
quite sure I can see how the computer could easily encode, and then subsequently decode
this. I can see how a human might be able to decode this if they know the pattern or
if they know the detail of it, but I'm not sure how easy this would be to, to automate
and write a program to do this. Am I, am I interpreting this email right? Are you, are
you on the same page as me, or do you, are you seeing something different here?
Obviously computers can't tell smells, and tastes, and touch, and things like that, so
those are kind of sort of out of the question. I'd use the graphics example that he talks
about. I mean, you could say if this pixel has this color in it, then it represents this
letter, and things like that, but I'm just not sure. You still would have to have a pattern
to know, you'd have to have some kind of key to tell it which pixel is worth which value,
so you'd have to have some sort of key. So in that aspect, it's not really any different
than simple or basic public key encryption. So I'm just not quite sure I understand it.
So in Jack, I guess the best thing, I'm not sure really. I would think that this is a little
bit too complicated to answer in an email, especially with the specifics that you're talking about
here. I think this might be something good to open up on the forums, start a thread in
the forums, because it is definitely an interesting idea. And let's see maybe if it'll come across
better with a little bit more detail, typed out in a little bit more detail, maybe some
examples. So I think that's probably the best way to go with that one. Let's see, how about
we move on to email number two from, actually from Wiccan2, W-I-C-C-A-N-2. Oh, that would
be my Windows Vista box over there blinking at me in the background, if anybody heard that.
But they're going to have to wait. Wiccan2 says, just thank Dog and co-host, you said in
episode 187 that technology such as body enhancements is going to be available generations
from now, but it is actually closer than we think. I saw a seminar last November called
Upgrading Humans, where Professor Kevin Warwick had designed and built an implant that allows
him to interface his nervous system to a computer. During his experiments, he was able to use
ultrasound to detect objects by using a baseball cap fitted with ultrasound sensors, and he was
able to remotely control a robotic hand across the internet. His nervous system was assigned
an IP address, hand, he was situated in America, and the hand was situated, and he was situated
in America, and the hand was situated in the UK. Just by thinking about moving the hand, the
hand would respond. He was also able to use a limited form of communication with his wife
on a nervous system to nervous system level. Through his work, he claims to be the world's
first cyborg and believes that computer, that human computer enhancements will be available
in the not-too-distant future. From the work that is being done around the world, body hacking could
become reality sooner than we think. And he gives a couple links at the end of this email,
kevinwarwick.com, Professor Warwick's site, it's K-E-V-I-N-W-A-R-W-I-C-K.com, and there is also a
Wikipedia entry for Kevin Warwick as well. Keep up the good work at the DDP Wiccan 2.
Well, thank you for the email, Wiccan 2. I appreciate it. Just to clarify, though, I don't
think I said, I know I said last week that it is generations off, but just to clarify, I'm saying
that it's not going to be publicly available for a few generations. It's going to be quite a while
before this is something that's rolled out and you can go into the hospital and get. It's going to be at
least a full generation, if not probably even more. That's not a comment on the technology. I
think there's actually several people out there. All right, maybe not several, but a few, a handful,
that are doing things like this to themselves and volunteers on a very small scale and developing a
lot of this stuff. I think we said that a lot of this stuff is actually garage development type stuff.
But what I was really more commenting on was the price of doing these things and the relationship
with our health care system and our insurance system, which is a horribly, horribly corrupt
system. And the prices are mandated and controlled by the American government anyway, has got their
hands tied into this. So what I was trying to say anyway was that this is probably generations
off before any normal everyday person is able to go into a hospital because they have headaches
and get a chip in their brain that's going to prevent headaches in the future or something
like that or permanent vision correction by putting like a cybernetic chip or some kind
of lens in their eye to permanently correct their vision. These type of things, I think,
are still a ways off because there's just too many hoops that you have to jump through in
this country to get those things rolled out. But I mean, that's my opinion. But what do
I know? I mean, Mubix, have you heard any stories of people like this or do you know any
cyborgs? That's a funny question. You know, I do not know anybody, but this scares me. It
brings back flashbacks of Johnny Mnemonic and like people going crazy with this stuff. And
you know, I don't even have any tattoos because I don't like changing my body because I think
it does stuff. But you know, putting technology in you is not something I am looking forward to at
all. Just personal opinion there. Well, and you know, there's a whole nother topic that we won't go
down this road of, you know, hacking the human body that's been upgraded in cyborg. I mean,
planting a virus and controlling. What if I hacked into this guy's, whatever is the IP address of the
hand? And I start choking. Or a virus system. Yeah. Or I grab this remote hand over the internet
and start choking his wife with it. I mean, I mean, there's a lot of, I don't know, it's all kind
of fiction right now. And it's funny to say, but you just don't know what the future holds. I mean,
and that's again, another reason that it's going to take a long time before this stuff kind of rolls
out to the public. All of these things have to be taken into consideration. But yes, I'm with you on
the, I don't have any tattoos. And yeah, I'm not, I don't know. I mean, there's, there's,
who knows what the future holds as far as that stuff goes and what decisions you'll make. If
there's a technological solution, make me a cyborg if it'll save my life or if it'll enhance my life
when I'm, you know, in some extraordinary way. I'm not completely opposed to it, but I'd have to be
convinced pretty hard. I'm not going to get my, this LASIK surgery or anything to cut my eyes open with
either because I don't feel comfortable with it. So, so I feel you on that part of things.
Yeah, don't get me wrong. I'm not completely against it. I just, I'm afraid, like, I would
love to jack into the internet and see it visually and all that stuff, but I definitely am not
looking forward to the hacking aspect of it.
Right. Of course, we could get like an implant for Savant and Black Ratchet where, put a little
chip in their brain so that when they're...
Can they tell a difference?
Well, probably. Well, they got nowhere to go but up, if you know what I'm saying.
Oh, come on. I love you guys. Give me a break. No, but we got to, we got to put a chip in
there that does nothing but synchronizes to IMDB so they have that movie database in their
head so they don't screw up any more movie quotes. If they ever on the spot and they're
recording the show and they want to do a movie quote, they can just kind of real quickly
hit imdb.com or look up on the global interweb, if you will, or Wikipedia, even better, a better
source of misinformation. But I digress.
All right. Our last email this week is actually, it's one of my favorite emails in a long time.
Email is from Bushwick. Bushwick says, well, first of all, the following demonstration was
crafted by a listener of BinRev Radio. The host nor the co-host, that would be you, condone
any activities of this nature. This demonstration is for educational purposes only. So, first
of all, he put that disclaimer in the top of the email, so I'm going to go ahead and read
it and put it out there.
Well, I don't know anything that doesn't get me in trouble, so you're fine there.
There you go. There you go. And we'll address this email. We'll address this email specifically
because it is actually very interesting. And there's still nothing illegal in this country
yet, thank God, about talking and discussing things. You know? Luckily, education is still
not banned.
Exactly. So, and truthfully, this is not really, there's nothing necessarily bad. This is an
interesting idea that, well, let me go into the email.
Greetings, Stank Dog, Black Ratchet, and or other co-hosts. Okay, let me start again.
Greetings, Stank Dog, and Muvix. There we go.
I'm a noob to BinRev Radio and IRC Chat, and I just got done listening to episode number
186. With a discussion about responsible disclosure, something came to mind, and I wanted to see
what you two thought about this thought process. Companies, financial institutions, and various
universities don't want their security flaws disclosed to the public, obviously, and various
hackers, let's say black hats, don't want to follow in the footsteps of the two geniuses
who thought they could extort News Corp by going to MySpace in person to reveal a hack
for money. Now, that's brilliant. Assuming that the exploit allows the black hat access
to private information, name, phone number, social security number, etc., etc., what could
stop a black hat from maybe not disclosing it to the companies themselves, or to try extort
them directly, but maybe disclose the information to someone who could be directly affected negatively
if the information were to fall in the wrong hands. A black hat could say, you know, you
could profit from my discovery. A good case could be made for negligence here, and you
can sue XYZ blank blank blank company here for a good chunk of change. Maybe if I reveal
this to you and you take them to court, you could cut me in on a portion of the judgment.
Let's go one step further. Let's assume that a group of black hats were working together
who would intentionally go out and register personal information on a myriad of websites,
and a few of them intentionally go out and exploit those same sites to see if they could
retrieve that same personal information. Then the black hat themselves go after the businesses,
schools, individuals, etc., for obvious negligence. Assuming that it could be proven in a court
of law, that could be a pretty hefty payday. How long would it take for companies, schools,
individuals to change their policies regarding having security flaws disclosed? Great show, guys,
and thanks to the BinRev IRC community for welcoming me in with open arms, even though my thought
process is out there. Well, thank you for the email, Bushwick. I appreciate that. It's actually,
this is a very good topic, a very interesting scenario, if you will. So, I'm actually with you.
You know, let's throw out the disclaimer earlier. I'll just come out and say, I'm with you up to the
part about disclosing privately to the affected companies and individuals. Okay, and let me, let me,
I need some story time music or something to throw in here. Let me, let me share a little story here
that I've never shared before. I'm going to keep it as pretty vague as possible, though. I found
actually a flaw one time on the particular credit card company's website that gave me access to one
person's account. It wasn't like it was a big widespread problem where I could access everybody's
account and all these docs are dropped or anything like that, luckily. But it was a flaw that basically
it was someone else at that credit card company that had a same, a similar real name to mine. So
their, their, the name on their account was very similar to mine. So it was just a kind of a silly,
simple flaw and it was easy to fix. I actually knew exactly how to fix the flaw. So going back to 186,
what he's referring to here is we talked about disclosure, you know, how do you go about
disclosing something like that? And, you know, again, my tendency is to keep my mouth shut and
not say anything to anybody because of the fear of, of legal repercussions and I don't know,
judicial, you know, repercussions, going to jail or anything like that. But in this case, I, again,
I was hesitant to bring it up, but what I finally did was I chose to go ahead and call since it was one
customer. It was totally accidental how I stumbled across this and I knew how to fix it. I decided to
go ahead and contact this person. So what I did is I chose to call that individual customer whose
account I had accessed accidentally. I called him from a safe phone, which means basically that I
dialed in from my own caller ID spoofed phone. And even with that, I did a pass through through
another caller ID spoofing service and did an out dial to this customer. And again, I had that
customer's private information in front of me. That's where the phone number came from, along with
a lot of other information, as you can imagine. So I kind of routed through, you know, back in the
old days, they used to call it telnet hopping from one box to another. I phone hopped through a couple
different boxes, spoofing different numbers along the way. I called him up and basically explained to
him what had happened and in as little detail as possible. And obviously he was very shocked at
first. I mean, he was just, he didn't even know if this was a prank or a joke or whatever. So I,
you know, I basically told him what the situation was and how he could easily fix it. I gave him some
of the information from his account to prove that it was, you know, that I was really seeing it.
And I even told him, you know, call the credit card company and complain about it because this is a
pretty serious thing. I showed, you know, I told him that I hadn't changed anything, you know,
it was nothing like that. And I was logged out of it, never going to do it again. I walked him
through changing it and everything. And that was the end of the story. I never followed up. I never
heard anything more from it. That was it. End of story, as far as I know anyway. So why did, why do I
bring that story up? Well, the point of the story is going back to what, um, Bushwick said in his
email, disclosing the information to a third party who was affected. In this case, this individual
person, he was a third party person who was affected by this. His docs were dropped, a privacy
violation. Well, some people would say that that's actually the whole point of disclosure. That's who
you're serving when you disclose this information. You're not necessarily, I mean, it's noble that you
want to help the company. That's great. But I don't think that's really so much, at least in my
opinion, my motivation, it's to help prevent all of those innocent, let's use, I don't, I guess I can
use the word victims safely here. Those victims who didn't know that their, their identity is being
so easily dropped out there or so poorly protected. So that's who you're serving. You know, keep in mind
the goal. The goal is not to save the company from getting sued. The goal is to save people's
privacies, at least in this case, you know, enhance people's security. That's the ultimate goal. So,
you know, disclosure, depending on how you look at it, you're always helping a third party, whether
it's an individual or a group. Did that make sense at all? Are you following me there?
Yeah, I'm following you. You know, this discussion, in general, has been a big buzz across the net.
And as we did a Spoilcast episode on it, there's been numerous talks everywhere, just on every
level of this topic. And I put my brain power to it. And the only thing that I can think of
to effectively solve this problem so that you can disclose something without having repercussions
is having an intermediary. Basically, having a non-profit organization that everybody submits to,
they check it, and they submit it to the company. That way, they have like a non-disclosure agreement
so they don't disclose who submitted it, and they don't submit it, or they don't disclose it to the world
as full disclosure. The company has to react on it in, say, 30 days, or a year, or whatever.
And then it goes public, or something like that.
Yeah, that's not a bad idea at all.
I just don't think the one-on-one works.
Yeah, that's not a bad idea at all, actually. The problem with that would be finding third-party,
independent companies that are trusted by both parties. If they're going to be basically puppets
of the corporations or the companies, then the hackers are going to be like,
why should we participate and disclose to you? We're going to do it the same way we've always
been doing it. And if it's an organization set up by hackers, programmers, open source people,
whatever, whatever you want to call them, the companies probably aren't going to trust and
support it, because to them, they're not getting any necessary benefit out of it. There's a lot of
trust going on. So it's a good idea. I would love to see that idea pursued, and see if they
could pull something off that's at least some sort of compromise in between. The other thing,
Jennifer Granik, I know, has spoken about this from the Cyberlaw, Cleveland Cyberlaw Connects,
talked about easing up some of the laws to make it not as dangerous for people to disclose things.
But that's a touchy subject, too. I mean, the whole subject's touchy. And again, go back to
episode 186, it was all about this topic, and it's something that comes up on multiple episodes of
the radio show over the past four years that we've been doing it. It's come and we've touched
on it so many different times. So it's basically, at this point, it's a personal decision. Everybody's
going to have to find their own line at this point. Now, speaking of that line, to get back
to this email, this is where I kind of start to disagree with the email, is when it crosses
from that line, you know, disclosing to third parties that people are affected, that's great.
I support that. I agree with that in most cases. I can't think of any cases where I
would not support that. But you cross a different line when you amount, when you cross, you cross
a different line when you basically commit what is extortion or blackmail, which is the
scenario he described. Anytime you ask to be cut in on money of any kind, whether lawsuit
or asking to be paid to not disclose or selling information, information that could be used
in a bad way, selling it to someone whom you know is going to use it for ill intent.
You're crossing a whole different, and to me, very clear and simple ethical line there.
The second, and here it is, it's very simple in my eyes, and by all means, I would welcome
any email that wants to say otherwise. I'm not saying it's right, but to me, it's so clear
cut. The second that you try to profit off of any of the information, you've committed
a crime. It's extortion, it's blackmail, it's so many different names to it, and ethically
speaking, it's wrong. That is not what the hacker ethic is all about. The hacker ethic
is about releasing that information and trying to help the people involved. It's not about
using it to make money or using it to your own ends. So, and frankly, legally, that's ethically
speaking. Legally speaking, the second you committed a crime, the second you access the site
without permission, or the second you started doing the research. Again, that's a whole
other topic for another time. You know, we've beaten that horse to death, actually, on the
show, of why is it necessarily illegal just because you did this, just because you poked
around there. The way the laws are written now, they're unfortunately not in our favor for
doing basic research. But I don't see that changing. I completely agree with you there. I mean, there is
that, you know, we, most people don't understand this like normal population, but hackers do have
lines where they have a set of ethics. Sure, there is a hacker ethic. So that definitely goes beyond even the
hacker set of ethics. Yeah, there is definitely a hacker ethic. And it's, that's this whole
misconception. I mean, I wish, I would love to see a local news story instead of doing some story about
hackers committing ATM fraud, or hackers stealing your credit card information, or hackers blah, blah,
blah, which of course is basically they're using the word hacker as thief. I would love for them to do a
story saying about hacker ethics. Maybe if they did one story like that and understood hacker ethics,
they'd not make so many of those other stories. But anyway, I'm going to get off the soapbox on
that one. We've beaten that horse to death too, and you're getting me fired up now, and I'm running
out of iced tea. And actually, that's the last scenario that he poses in the email is a very
interesting one. Insofar, from a research standpoint as well, and that is registering for a bunch of
sites. Now, he's saying a black cat group or something. I'm just going to leave the terminology out of
it. But registering for a bunch of sites to see or prove, if you already know, if they're vulnerable
raises a whole other interesting issue. Anytime you find an exploit, you have to be able to prove
it. You have to be able to recreate it and show that it wasn't a fluke or an accident, that it's
something that can be reproduced over and over again. And the term for that is usually a proof of
concept, whether that's a bit of code, whether that's an outline of a process that you go through to
get from A to B. So making a proof of concept is something that's very common. When we find an
exploit and you want to prove it to everybody, you release all this exploit code out there, this
proof of concept code. And that's probably the most common when you think exploit. That's the most
common thing you see out there. It's people who've written a script to take advantage of the exploit
or the vulnerability. Now, it's, again, back to the hacker ethic. It's kind of morally against that
hacker ethic if you do this under the intent to somehow make money or capitalize on this information.
Once again, it's about releasing the information and helping and saving people. If you go, if you have
the intent to sue someone or start a class action lawsuit against someone, to use the example from the
email, yes, you've crossed a whole different ethical line. But I think all of our listeners
probably are knowing right now that not only is it ethically wrong, but you don't have a legal leg
to stand on a case like this because, well, and maybe people don't know this, but it's different
when you are an innocent third-party victim who had no knowledge or understanding that this could
happen. You have an expectation of privacy with these companies, like let's say a credit
card company, for example. You have an expectation of privacy that they're going to do their due
diligence to protect your personal information. But if you go in there and create accounts and put
your information out there with the intent and the goal to release an exploit later on only so that
you can get caught up in a class action lawsuit or so that you can sue somebody using an exploit
that you were aware of or you discovered, you're not an innocent third-party victim getting caught
up in a negligence case. You knew the system was negligent and you chose, willingly chose to
participate. I don't think that would last 10 seconds in court. Now, I think, now to go back to the email,
I think he said, he does say, assuming that it could be proven in a court of law. So I'll give
you, I mean, he did say that in his statement, but I don't think that would be all that difficult
to prove in a court of law because all this stuff is logged on these servers. As soon as it happened,
they could easily go back in there and find out where did this come from, who did it, oh, isn't it
interesting that he created an account two weeks before the exploit happened or something like
that. There's a lot of ways that they could find this kind of stuff. So, again, totally unethical.
Just a second. Yeah. I do forensics on computers all the time and users are amazed every day
at what I can find and dig up on servers, logs, computers, just to point out to the listeners
that even though you might think you're being really sneaky with what you're doing, you can
get caught just as easy.
Oh, yeah. I think all of our users are well aware of that. That's why we've done episodes
of wiping your hard drive out with how many passes, seven passes DOD standard and 21 passes
and all that kind of good stuff. We've definitely made it clear. Now, of course, it's not something
I'm going to wipe my drive every single time I use it either. That's kind of ridiculous.
So, you know, it's plausible deniability comes into play and so you might want to make some
sort of a pattern of it so that you can maintain that excuse. And, well, anyway, I digress.
We could, again, go into that on another show sometime that we have in the past. So, again,
thanks for the email. That was really, I think that was really in-depth. No disclaimer necessary
because, again, learning and understanding and discussing these things. And hopefully we'll,
you know, hopefully people agree with me. I mean, people who really understand and get
the hacker ethic that are real hackers, I think should agree with that or understand
that. And there's nothing wrong with thinking from a different point of view or thinking
from the other side, if you will, because that helps you understand where you might be missing
something, where holes might be, et cetera, et cetera. So, Bushwick, thank you very much.
That was one of the most interesting emails in a long time. And everybody, actually, really
good feedback on the show this week. However, in lieu of making an entire email show again,
let's move on and do our main topic for the week, if you're ready, sir.
I am, actually.
All right. Well, and we kind of alluded to it earlier. We talked about the main topic is
going to be, we're going to kind of go through a list of several and discuss several different
software packages that you can throw on a USB key, stuff that's useful to hackers and in
some cases useful to anybody. And that's something that you have some experience with, right?
Right. I actually am quite popular for my USB applications, the ones that I think I don't
write them, at work and across the net. So, the first one that I want to talk about is
TCP view. It's by Sysinternals.
Well, wait a minute. Wait, wait, wait, wait. Hold on. Before we go into some of the detail
of it, let's talk about, let's talk about just some general, like, I mean, obviously
our users are technically savvy. They know what a USB key is, right? And, you know, the
most useful feature, at least for me, is just moving files from one system to the other.
That's mainly what I used it for. But, not only can you keep handy and useful software
on there, there's some software that's even designed these days to be portable, to be
run from a CD or a floppy disk or a USB key, right?
A lot of applications, believe it or not, don't make any registry changes. Don't make
anything like that. So, you can actually turn them portable. They're not already made that
way. Now, portableapps.com has all kinds of portable applications that are made to do
it, like portable Firefox, portable Thunderbird. But, there's also any executable that only
has maybe a configuration file in the same folder, or just this simple executable can
be made portable, and you can take on your USB stick wherever you want.
Right. The Unix way of doing things, where all your files are right there in the folder,
self-contained for the most part, with, you know, exceptions, obviously. But, just a comp
file, or an INI file, or whatever you want to call it, in the same directory with your
executable, and you're off and running.
Yeah.
Now, the other question, though, is, like, and I know from experience, I can say, I've
had problems with USB drives where I've pulled it out of my laptop bag, and it was just completely
DOA. I'd lost everything that was on it. You've been using these quite a bit, like you
said, at work. You're a popular guy at work. It sounds like when somebody wants to recover
or needs anything, have you had any USB drives go bad? And, is it a matter, like, the brand
of USB drive? Are any better than the others? I mean, generally speaking, I mean, can you
recommend one over the other, or is there any handling tips? I mean, have you ever had
one die on you, I guess, as a place to start?
I've actually had many die on me.
The thing that makes them die, I guess, easier is the environment or how you use them. If
you're looking for a USB thumb drive and it has, like, a flip-top stick where the USB
comes out, or basically the dongle is what dies the most, not the data on it. All it is
is flashed. There's no moving parts. So, you've got to get one that, it's kind of ruggedized.
It doesn't have something that, if you look at it, easily break. That's the most easy way,
or the way that my USBs have died the most. One time I went swimming with one. I guess that
would be considered dying. Yeah. But, not a good idea to go along with USB sticks.
Hmm. I wonder if they, someone probably invented a waterproof USB stick, but I digress. So,
so, that being said, then, would you recommend, because the, because they are volatile and because
it may crash, it's like anything else. I guess you probably should have a backup somewhere,
throw it to a CD or something, so if you ever buy a new USB, when one dies, you can
restore easily, or? I actually use a, one of my, um, applications, one of my, uh, USB
applications is Dursync, D-I-R-S-Y-N-C. And what I do is, it's running on my computer all
the time. So, whenever I have my iPod, which is where I back up all my, um, USB sticks to,
mm-hmm, and they're numbered, like, this is my one gig, this is my eight gig, whatever,
512. Right. Um, it goes, as soon as I plug in both, it sees that both are plugged in as
it backs up to my iPod. So, I always have a backup of my USB sticks at all times, if one
goes back. Well, and this also makes it easy, like, if we meet up, you can give me a copy
of one of them easily, too. That's true. Restore it over to someone else's drive, so that's
kind of handy. That's a cool thing to take to the BINREV meetings or 2600 meetings or
whatever and swap some of this stuff with other people. That's pretty awesome. All
right, so, also then, yeah, and in that same mindset, then, would you recommend people just
get the cheapest one they can get because they're all volatile in some way? Would you
just say get the cheapest one? Don't invest a lot of money in a, you know, some particular
name brand? I mean, they're all, for the most part, the same? Yeah, I would definitely
get the cheapest one, and again, just make sure, however you plug it in, the USB part
of it, the end of it, make sure that it's not easily broken because I put these through
a lot of strength tests, basically, from day-to-day use, and I'm sure other people who do as well,
they don't take care of them. So, that would be the one point that I would look for in a
USB stick. Okay, cool. All right, well, now that we kind of talked about that a little
bit, let's go into the details of some of the apps that you have found useful in your
experience. All right, the first application that I got is a TCP view, which is from system
channels, which, you know, got bought out by Microsoft. Microsoft, right. I got the app
before, they got bought out, so it's still, I guess, tarnished. Un-Microsoft. So, un-Microsoft,
there's a good term. Yeah, un-Microsofted.
If you've ever been doing troubleshooting on a computer and you do a net stat just to
or you have a virus and you want to know where it's going or what it's doing, basically, net
stats real time is what TCP view is. And so, I can watch as connections get established or
put into time weight or what ports I'm listening on, all kinds of stuff. And it shows me what
application is doing that at the time, what protocol, what the local address is, or what
the remote address is. It even does a DNS lookup on the remote address to tell me exactly where
I'm going. All on the fly. Great tool. All actively and real time. And this particular
tool is this one we referred to earlier where it's just having pretty much an executable and
a configuration file and you can just execute it from the USB drive? It's a zip file that
you get from Microsoft now. But, um, you just export it and you're set. I'm curious, did
you, have you tried the Microsoft one yet? I have not. I refuse. I wonder how, I just,
just from the curiosity of how much, how different they are. Well, you're going to have to wait
for a listener to try because I refuse. All right. All right. Well, and Sysinternals
actually made quite a few cool things before they were bought. Well, maybe that's why they
were bought out. But, um, and that's also, we, we've, we've talked about in the past on
the shows too. And it's, this is definitely worth bringing back up. Like I know one of the
sites I used to like was, was called oldversions.com, but I'm sure there are several others now
and probably just through word of mouth and, and, uh, bin rev forums, places like that finding
older versions of software before they get destroyed or back when they were freeware,
but when they've now become, you know, charge or shareware or pay for, you know, however,
whatever their pricing scheme has changed, but it might've been free at first. So there's
certainly a reason to keep older versions. There are, there's reasons not to keep them,
obviously, if there's security problems or bugs or flaws, but there's certainly some
reasons to keep these old, stable, good, useful applications around for a period of time.
You don't always have to upgrade to the latest and greatest thing all the time.
Oh, definitely. And there's, there's a couple of tools that I've kept around for a long time,
um, coming up shortly, but to get onto our next tool, it's called Smart Sniff and it's by the
NER, uh, NER CMD or NER soft guys. And this was really helpful to me because I was constantly
going through ethereal captures and, or doing an ethereal capture on a computer. And I know I'm
going to get flamed for this, but it's difficult going down packet by packet and looking and trying
to, trying to sort them and filter it how you want it. Well, what Smart Sniff does is basically,
um, it groups your packets together. It says this local, there's this remote address in this port
is the same. So we're going to put it on. And it even has a quick preview on the bottom
in ASCII. So I can say this, uh, local address, this remote address, and here's the git statement.
Oh, it's an HTTP. Got it. And I see the git statement, the accept language all visually right there in
front of me, even the packets going right after it. Great tool. I mean, I can, I can not say enough
about how easy this makes my life. Right. And, and ethereal, of course, now known as Wireshark,
it, it does, there's a little bit of a learning curve to that. And you, once you get the hang of
it, you can, of course, combine the, the streams together. It'll put all the packets together
for one request or one, uh, communication. So, you know, it's got some power there, but it is
definitely got a, a bit of a learning curve to it. And Smart Sniff, again, is, is very portable.
Very portable. Um, it's a single executable, no configuration, you know, uh, I mean, you can
configure it and it, it stores the options on a file or registry setting, but, um, no extra files
initially. And actually, yeah, you, you kind of bring up a good point there too. Earlier we talked
about, you know, they don't always have to write registry entries and stuff like that,
but it's actually worth mentioning and keeping in mind, you actually should watch to make sure
that, that it does not create registry entries. That's a thought to keep in mind as well, because
let's say that your goal is to slip in a USB key, and I think we might talk about this later
if we have time as well, to execute something covertly, quietly, without being discovered. You
want to swap a, slap a USB key into someone's computer, run something, and then get out of
there and not leave any signs. You want to be careful that your app isn't quietly, without
your knowledge, writing a, a, a registry key out there, so that when you leave and think
you've left no footprint, that it might have, in fact, put something out there in the registry.
And hopefully nothing too incriminating or, or personal or anything like that, but even
if you leave, I don't, can't think of an example, if let's say Ethereum, which is not
the case, but throws a, a, a, a key out there for Ethereum or Smart Sniff or TCP or any of
these, which again, they're bad examples, because I can't think of one, but if you leave a key
there, that's going to potentially draw interest from somebody saying, wait a minute, something's
fishy here, I've never heard of this software before.
Actually, there is a program that you can use, that I use all the time, which is in
our show notes, so we can add it later, registry monitor by sysinternals.
Every time I get a new application, USB, the application, say it again, is, I throw it in, run
it, and using registry monitor with the filtering on for that specific executable, it tells me
exactly what query, what set value, what create value, everything that it does in the registry,
I can see what it does, and I audit that before I start using it, because I don't like my registry
all gunked up.
Right.
Yeah, and there's lots of registry cleaner things out there on an unrelated note, but yes, that
was another cool sysinternals tool.
All right, what else you got on there?
All right, now, I might get flamed for this, but the next one up is PSPAD.
The thing I like about PSPAD, again, I'm a very lazy person, so anything that makes life
easy is what I use.
The reason I use PSPAD is I can drag and drop any executable I want, and it's now turned
into a hex editor.
I can drag and drop any HTML document, and it's turned into an HTML editor.
And the thing that's nice about it, to add on to it, is that on the left-hand side, I
can open up a FTP client right there.
I can have my favorite directories and folders, and I can save my settings locally so that
I can bring this whole thing around to on my USB key and have my settings have where
my FTP server is located.
All this just makes life easy.
Again, I can't say enough about it.
Yeah, and it will, is it context-sensitive insofar as you said, like if you wanted to
edit HTML or Perl, is it context-sensitive or syntax-sensitive so that it would actually
highlight and colorize so it makes it a little bit easier to edit, or is it pretty much just
black and white plain text type editing?
No, it does do colorization and highlighting.
It's not as good as it doesn't do all the ones that are available out there.
I've seen other tech centers that can do a myriad of ones, but they have the majority
in PSPAD.
Okay, well that's good.
I was kind of curious why you put that one on there, because I do use a lot of different
ones, and they're certainly better out there from a programming standpoint that I use frequently,
but for overall ease of use and portability, PSPAD, PSPAD, right?
Correct.
Okay, cool, cool.
So where do we go from there?
Now the next one up is System Information for Windows, or SIW.
Now this one doesn't really, it's like the Space Monger of information.
Space Monger was a tool that really didn't get much media, because it was released really
not very much.
I'm sorry, can't find the words today, but...
Hey, my world, and welcome to it.
It's like every episode of BinRev Radio I've ever done, I stumble over everything I say,
so it's not like...
Our listeners are definitely used to hearing it from me, so you're doing pretty darn good.
Okay, since it just doesn't get that much media attention, but it should.
It is a must.
I give it to all my other admins where I work, and in order to operate efficiently, you have
to use this tool.
What it does is it gives you so much information on the computer you're currently on.
Everything from a breakdown of your system information, what ActiveX modules are installed, any open files
currently, even your LSA secrets, it dumps those.
Now, from Windows, of course.
Now, this is not picked up by any virus scanner or anything, because it's not a virus.
It just tells you all your...
Basically, it's not a hack tool.
It tells you the information about this computer that you're currently on, and it needs administrative
reps.
So...
But that's not it.
That's not all it does.
Down in the network section, it has a hardware or software and a network section on this information.
In the network section, you can issue a network neighborhood scan.
So I can find out all the computers in my network neighborhood.
I can then, after that, scan that network neighborhood for FTP clients, HTTP clients, NetBios clients, Oracle.
And it goes on.
So what I can also do, the same thing with TCP view is, it's a lie, but it shows me a dump of all the NetStat information.
A dump of it?
You can also, with this...
I'm sorry, with this tool, you can export all the information into an HTML document.
So, this is just basically your quick and easy audit of a computer, and it's free.
Yeah, and that's a utility designed for, you know, people that are running labs or in charge of maintaining computers and stuff like that.
It's probably who it's originally designed for, but it does a great job of footprinting, it sounds like, and telling you a lot of information.
Definitely.
And have you ever had a computer where you had to rebuild it and drivers were?
Of course.
Or couldn't find the...
Well, this thing outputs the driver as well.
So, I do this on any new computer I get.
I really quick open up SIW, hit export, about two minutes later, because it does all these nice little utilities on the computer itself.
I export it, I save it to my USB stick, and I'll never have to try and guess what's in my computer again.
Cool, cool.
Now, just to re-clarify, because it pretty much says it right in the description, it's called software information for Windows.
So, this is a Windows.
Is it bound to any specific versions?
I mean, does it work all the way up to XP?
I'm assuming it's not supporting Vista yet?
I have not tried it on Vista.
However, I have tried it on XP and 2000 and Oryx on both.
Okay.
So, that's something...
See, that's one of the ones where you probably would want to update it as new releases come out,
because it's going to have more information about different versions of the operating systems that you want to deal with,
or pulling more information.
So, that sounds like a pretty useful one as well.
And this next one actually is very familiar in name anyway.
And what is that one?
Bear Grip.
And this is another one that's little known to the community.
Grip is known across the world.
Right.
Everybody knows what Grip is.
But, when it comes to Windows, you really don't have a Grip solution.
You got Fine.
Does Fine really do what you want it to do?
Not really.
Say I have a log file.
I'm trying to find who hacked my website.
And I'm all pissed off.
Ha-ha, your website got hacked.
Yep.
I'm on Zone H.
I'm defaced.
I'm pissed.
I want to find out who.
Well, these hackers aren't smart enough.
They didn't erase the logs or whatever.
They didn't have access to them.
And I have a 200 megabyte text file of logs I have to go through.
Now, Grip on a Windows Linux machine would do this without sweating.
But, find or opening a notepad and doing Control-F, not going to happen.
Bear Grip solves this.
It even allows you to do multiple files very easily.
Right now, I have it open.
And I have the old folder or old drive selected.
Files are star dot star.
And I can just start typing.
So, I start typing, like, smart or Mubix.
If I start typing Mubix, it will start finding, before I even finish, any file or folder with Mubix in it.
Now, say I want to audit my whole network.
For anybody who stores their password on their My Documents or whatever,
I can set up my folder to say, hey, this shared drive or this computer or these sets of computers
and search for any text with password in it.
Right.
And I've done that.
I mean, very, very fast, very useful.
And the output is file-based.
So, it says, in this file, on this line, and it shows you the line.
You can use full regular expression support, invert match, and ignore case.
I love it.
All right.
Well, we're, you know, we're talking about a lot of these are, like, useful from multiple viewpoints and things like that.
What about some other things that are a little bit more specific in purpose, I guess, for lack of a better word, a little bit darker?
All right.
So, most people have used or heard of Netcat.
It's a Swiss Army knife of TCPIP, basically.
All right.
Well, what people don't know or don't realize very much is it's portable completely.
I have it on my USB stick, and for those who don't know, Netcat can't listen or talk on any port or protocol with simple, and it works under Windows.
And I hate Windows, but it's just industry standard, so it's easier to use anywhere.
But I use Netcat for all kinds of file transfers.
I can use it for file transfers or trying to fuzz a specific attack or protocol or traffic.
It's just a great tool that you can use for anything, basically.
Well, it is what it is.
I mean, it's Netcat, but, yeah, just the idea of using it portably is kind of interesting.
And, actually, you and I were talking about this next thing you had on here.
I'm sorry.
Go ahead.
I was saying the next thing that you were going to talk about here, we were talking about offline before for protecting the information on there.
So, I'm sorry.
Go ahead with what you were going to say and apply it to what we were talking about, how you kind of protect your own USB stick with it.
All right.
So, I might – so, TrueCrypt is a way of making encrypted volumes either in a single file.
I mean, I can encrypt a load of data or applications or whatever and put them encrypted and it will look like a single file.
But, I mount it just like Linux and it will look like a drive to Windows.
Right.
Or Linux.
TrueCrypt is both Linux and Windows.
So, how I use this is more to the point.
When, like I said before, Portable Apps has something called Portable Thunderbird.
Well, with Thunderbird, you have Enigma.
Enigma is a plug-in that adds on PTP or GPG to be precise.
So, being with that, there's keys.
You have your public and private key.
Well, I don't want to be without my public and private key so I can send and receive email.
Well, am I going to keep two USB keys and drag them around everywhere just so I can be portable with my email?
Not very efficient way of doing things.
Well, how I tie TrueCrypt into this is I make a file, which is a TrueCrypt volume on my USB key,
and I put my keys inside that TrueCrypt volume.
So, when I take my USB key around, I don't have to worry about losing it and then my keys are invalid
because I know that, one, I have it backed up on my iPod.
One, two, anything that I have that's important that can get those keys or my private keys available to them
is encrypted beyond the point that a normal person without a supercomputer can get at.
Right.
So, point being, if you lose it, you're not necessarily in any trouble, really.
Right.
I don't have to worry about it at all.
I don't like losing USB keys, but I'm not scared that any information on there is going to be disseminated.
Right, but, you know, if it fell out of your trunks while you were swimming or something like that.
Hey, hey, hey.
Somebody grabs your USB key, somehow dries it off, they can't completely own you.
Correct.
And I store all kinds of information, like any keys that I get for Windows or valid keys for Windows
or games or stuff like that, I store in there just so I can keep my keys private to me and always have them.
Right.
No, that's actually a really good tip.
That's why I said you and I talked about that earlier,
and that's actually something I can see myself doing as well.
Well, it's a lifesaver.
I'll tell you what, you learn after you get burned.
All right, and what else you got?
All right, this is an actually agitating subject for me, this next set of applications.
I find it very angering, if that's a word, when I see on dig.com or news or any other forum,
how do I get around my firewall at work or school or whatever?
I mean, there are so many times where I've gone, just fucking Google it or ours.
Just, you know, and I get mad because they don't, people just don't see that it's everywhere.
Right.
So, this application is, this set of applications is how I would suggest users get around their firewall,
which I don't suggest they do at work.
Well, we're not going to tell them where, yeah.
We're not authorizing or telling anybody.
We're just throwing out the possibilities here.
So, with that, I'll go into it.
Portable Firefox, again, from portableapps.com, is the portable version of Firefox, obviously.
Well, you have that option of adding all those add-ons and plug-ins and extensions, if you will,
like, normally install a Firefox.
Well, Foxy Proxy is one of those.
Mm-hmm.
Now, before Foxy Proxy, I had to use, or I, how do I say this?
Well, implicating myself.
I've suggested using other tools, such as Provoxy and another proxy tool, or Switch Proxy for Firefox.
Right, I've used Switch Proxy.
Now, the problem with a Sox Proxy, which is what SSH or PuTTY, using SSH, sets up when you port forward.
So, let's start from the beginning.
Okay.
I have an SSH server at home, a Linux install, or a SigWin on Windows space,
and I port forward on my firewall so that it's, port 22 is available on my local or home network.
Right.
I use PuTTY from whatever, my laptop at, say, Panera Bread, and I SSH to my home computer.
Right.
Now, I log in, and I change the settings on it.
Let me get this right.
Under Connection, under SSH, under Tunnels.
I turn on local and remote port, and I add the source port as 8000 or whatever you want.
And what this is basically saying is I'm going to listen on this port on your local machine,
and I'm going to set the destination to blank because it's going to assume that the destination machine is the machine you're SSH into,
and I'm going to change it to dynamic.
Now, what this is doing is saying that anything that I see coming in on port 8000,
I'm going to tunnel through my SSH.
Right.
My SSH connection.
So now that I've tunneled port 8000 or opened up port 8000 on my computer
and anything that goes to it is going through to my SSH server, I use Foxy Proxy.
Foxy Proxy, I set that up to basically set up a, I don't know how many of your users or listeners might know what a SOX server is,
but it's basically a proxy server.
Now, the problem with SOX is that any DNS requests will still go out through the normal means.
It won't get proxied.
Right.
So that's kind of loud still because you're still saying, I want to go here, but once I get DIP, I'm going to go.
And it's easy to see on a log file where there's 30 DNS requests but no connections out once those DNS requests are made.
Right, right.
And they will see the destinations.
They may not be able to see your packets and what's contained within them, but they'll see where you're going.
All right.
So your computer is going to say, whatever the Panera Reds DNS server, I want to go to binrev.com.
Right.
Okay.
The DNS server will say, binrev.com is this IP address.
After that, your computer will tunnel any further through that IP or through your SSH tunnel out through your SSH server's ISP connection to binrev.com IP.
Right.
So all that's going to get logged on that DNS server is a request for an IP.
Right.
That DNS server is going to reflect that somebody looked up binrev.com.
Correct.
Right.
That's what I was saying.
That's going to still show up.
But everything else subsequently is not.
Right.
Okay.
So we're on the same page.
That's a problem.
You don't want people knowing where you were going.
I mean, that defeats the point of tunneling unless you're just doing it so that you can log in securely.
Right.
And it depends on what your motives are, of course.
You may or may not care about that.
But yeah, go ahead with what you're saying.
You're absolutely right.
Well, with FoxyPoxy, there's a setting.
And it's kind of obfuscated.
It's down in the settings.
You have to find it.
And it says tunnel DNS traffic as well or something of that nature.
I'm sorry.
I don't have it right in front of me.
But you click that on, hit okay, and you're set.
All the DNS traffic will, from then on, be going through your proxy, your SSH tunnel.
Right.
And that is the best way to securely, from, say, Panera Bread, tunnel all your traffic home and out through your firewall, which you know is secure.
And none of your traffic is going to be able to get sniffed.
Exactly, because it can't see what the traffic is, so it can't filter anything out or stop anything.
Now, actually, I think we're probably running short on time here.
We kind of had a little hiccup in the recording, so my timing is a little off here.
But before we wrap up, are there any other things we wanted to mention here?
I know we talked about updating software when versions come out, whether you should or shouldn't, and sometimes you don't want to.
We talked about maintaining and backup and things like that.
We talked about carrying around your PGP and GPG keys.
It's very handy, but a good way to protect them using TrueCrypt.
Are there any others quickly, like in a minute or two, that you wanted to mention before we get out of here?
I hate to rush you, but...
The only two we had left was PT Lookup and PT Hasher.
Both you can check out at karenware, that's K-A-R-E-N-W-A-R-E dot com.
And they're both good tools, and we don't have time to go through them, but check them out.
That's PT Lookup and PT Hasher.
Okay, and then the only other one I wanted to mention was what I've done in the past,
is I've used the distributed .NET clients and Folding at Home or any sort of distributed computing,
programs, if you will.
They are usually very portable, and pre-configuring those with putting all the configuration files
to put your name and join group, DDP group or whatever, for folding at home.
And I have had that on a USB key, and when I'm out somewhere, if I'm in a computer lab,
I'm on a school campus somewhere, I'm in a public lab, coffee house, whatever,
where they have computers available, you can throw that bad boy on there and put that machine to work,
pounding out some packets.
So that's always been pretty handy as well.
And I think also worth mentioning as we kind of close up the show is there are already a couple of projects
worth mentioning over on the Hack5 forums.
Is that right?
Oh, yes.
Pimp those quickly.
The Hacksaw and the Switchblade.
These are two projects that are on the Hack5 forums and put in Hack5 episodes
that allow a USB key to be auto-run and do some interesting things.
Very cool.
So go check that out.
And speaking of closing out the show, I think we should probably do some shouts here.
So I'll go ahead and go first and stall for you to think of any shouts you want to give out.
I want to give shouts out to E-Man for helping me out with doing some encoding for me.
To Enigma, of course, good friend over there in the Tampa 813, BR813 meeting.
And I guess anybody whose handle begins with E is the theme tonight.
If your handle begins with an E, you get a shout-out tonight.
And I've got to give congratulations to Mr. and Mrs. Droops for their birth of their healthy baby girl.
So congratulations to them for that.
And what do you got for shouts?
I got just one shout-out to Cyber Eagle.
Again, his nick kind of starts with Eagle or an E.
There you go.
That's the only one I could think of.
So Cyber Eagle, if you're out there, shout-out to you.
Okay.
And our site of the week comes from our co-host.
It's centralops.net.
That's C-N-T-R-A-L-O-P-S, centralops, all one word, dot net.
There's some handy little apps over there that you can play around with.
Email us if you have any kind of feedback, if you want to talk about that whole disclosure topic we had at the beginning of the show.
If you have any other tools or any other software packages you want to mention.
Now, I'll go ahead and preface this saying that we had to draw a line and cut off of how many things we could talk about on this episode of the show.
We might have some subsequent shows with a little bit more specific areas and types of tools that we may go into some more detail about.
But we picked some of our favorites on this one, but if anybody has any they'd like to recommend, by all means, contact us, radio at binrev.com, or come to forums.binrev.com.
Start a thread, any information that you have on anything to do with the show, like how much you hate me and how much you love Mubix and you want me off the show and you want him to run the show from now on.
Email us, radio at binrev.com.
There you go.
See, I'm going to put you to work, man.
You didn't think you were going to get away doing one episode and that was it.
You're on for life now.
You're in the family now.
Closing music this week.
The closing music this week is We Have the Technology by ADD.
And I think that is going to do it.
Mubix, thank you for being on the show with me.
And joking aside, we will have to do some episodes in the future.
I know we've got some other tools to talk about, some other topics in general to talk about.
But we will have to save them for a future episode.
But until then, we will see everybody next week.
Same Hack Time.
Same Hack Channel.
So start a fire
If it gets too tall
When you can't take it anymore
You have to take it all
If luck has been filled
You'll come out and leave
But if you're sinful
You ought to cut your losses and leave
We have ideas
We have energy to run
We are duty-bound
We have follow-through
We have energy to run
We have the technology
But you waited all night
And he never came home
Was it the blue and yellow lights
That confused him
And he never came home
And I'll keep it in mind
If we get the chance
To change things for the better
I want to change things for the better
We have ideas
We have energy to run
We are duty-bound
I will say we have follow-through
We have energy to run
We have ourselves
We have energy to run
We are duty-bound
We have junior-bound
We have follow-through
We have energy to run
We switch from ourerves
It's only what happened to us, and it's only what happened to us, and it's only what happened to us, and it's only what happened to you, two, three, four.
Thank you.