phrack/phrack67/3.txt

                            ==Phrack Inc.==

               Volume 0x0e, Issue 0x43, Phile #0x03 of 0x10

|=--------------------------------------------------------------------=|
|=-----------------------=[ Phrack World News]=-----------------------=|
|=-------------------------=[ by EL ZILCHO ]=-------------------------=|
|=----------------------=[ elzilcho@phrack.org ]=---------------------=|
|=--------------------------------------------------------------------=|


1. The TJX Case and the Longer Arm of the Law

2. Stuxnet, Cyberwar, Hacktivism and Political Hacking

3. Wikileaks and Whistleblowing

4. Scene Events: the Final Word

                          -------------------------


--[ 1. The TJX Case and the Longer Arm of the Law

When the going gets weird: The TJX crew / Probation for the narqs, tough 
sentences for the hard luck crowd / The longer-reaching arm of the law

Computer crime and hacking have always made for uncomfortable bed fellows, 
splitting hackers into two general camps; The laissez-fair consideration 
of those who know they commit several technical crimes before even getting 
out of bed in the morning, and those whose fear of the law drives them, 
essentially, straight -- condemned to endless nights in front of a 
debugger with nary an unauthorized rootshell to be seen.

So where to draw the fuzzy line under the TJX crew, from the manipulating 
Gonzales, who narqed out #phrack opers early in 2003, to the erstwhile 
seven-foot tall computer programmer the_uT who faces two years in the cage 
and a $172.5 million restitution for the writing of a simple computer 
program that most of us could have written at age fifteen, under the 
influence of ketamine or not?

PWN corespondents have viewed the original source code to 'blabla' and can 
attest that it consists of nothing more than a read loop from a raw socket 
on a high port outputting, unformatted and unfiltered, data to a file. To 
say that tcpdump is a far more sophisticated piece of software for data 
thiefing is not an exaggeration.

At least we can say with a comforting certainty that the fine old art of 
narqing like a pro will still get you out off the hook in times of phear 
and stress. As many old-timers will attest, narqing has been a fine 
defensive tradition among hackers over the years, with many well-loved 
figures of hacker mythology, from Chris Goggans to Agent Steal, being firm 
believers in the practice.

The TJX case has been a prominent reminder of the efficacy of the ancient 
technique of daubing one's mates in, with all sides planting knives 
between shoulder blades with sickening alacrity and producing some truly 
Olympic-grade scores in the Freestyle 100m Narq -- to wit, among others:

* Patrick 'eckis' Toey who faced a maximum sentence of twenty-two years, 
reduced to a paltry five years by merit of supplying 'extensive 
cooperation' to the authorities.

* Breakout act Jeremy 'horse addict' Jethro -- evidently the star of the 
case -- managing to not only narq out everyone he knew, but then managing 
to find his Saviour in Our Lord Jesus Christ AND being fined less than 
what he actually earned for his crimes (thus earning a nice little 
profit); He also managed to get his sentence commuted to probation, on top 
of everything else! Once again, this is solid proof that God is indeed on 
the side of the just.

* Albert 'soupnazi' Gonzales -- the sole failure here, scoring miserably 
by still receiving a massive twenty-year sentence despite having 
implicated everyone he knew up to and including his own grandmother

-- and that's just for starters.

The most disconcerting element in the entire show so far for anyone in any 
way involved in any sort of criminal activity (or, indeed, anyone who 
involves themselves in anything anywhere near anything resembling criminal 
activity), is the startling comaraderie and friendly interaction between 
international agencies - particularly Interpol and the FBI. Especially the 
FBI.

Recent international busts involving novel interaction between agencies 
has lent heavy weight to previously unfounded concerns of privacy 
advocates. The mere idea of a foreign national's being arrested overseas 
and renditioned/transferred to the custody of American civilian agencies 
purely on the basis of American testimony and evidence is enough to turn 
the stomachs of anyone, and yet it seems to have gone largely under the 
radar -- especially among American Citizens. 

The pseudo-criminal actions necessitated by the various agencies involved 
in order to bring down Gonzales would stagger even the most ardent 
Republican waterboarder. To wit, the hard drives belonging to Ukrainian 
carder Maksym 'Maksik' Yastremskiy were cloned during his trip to Dubai 
and yet again when he was coerced into visiting someone in Turkey (all the 
while while US agencies tried to tote the party line that they caught him 
while he was taking "vacation" -- conveniently ignoring the fact that they 
lured him to visit) and his movements tracked throughout Europe and Asia 
over an extended period of time. We can be sure that Interpol had not the 
gumption nor Ukrainian officials the interest (or resources) to bring 
about this level of interplay. With the evidence in hand, surely only the 
FBI can be to blame? The Turkish officials got to crow about a 30 year 
prison sentence -- in a Turkish prison, no less -- and the US got to cross 
one more name off their "to do" list, case closed, job done -- success all 
around.                                       

Further confirmation of such a hearty and hale level of cooperation was 
provided just this past October by the FBI, who affirmed that the break-up 
of a major Zeus botnet ring was the result of an "unprecedented" 
partnership between the FBI and police forces around the world including 
the UK's Metropolitan Police, the Security Service of Ukraine (SBU) and 
the Netherlands Police Agency. So far the international Operation Trident 
Breach effort has yielded more than 150 arrests across the US, the UK and 
Ukraine, the FBI said. One can assume that's only "so far" and that once 
the narq ball gets rolling, yet more waves of arrests -- and yet more 
international cooperation -- will commence in earnest.

Perhaps you are wondering what this has to do with you, at this point. 
Perhaps you ARE merely doing your job as a whitehat, researching these 
transglobal "criminal conspiracies", reversing malware, sticking to only 
machines you have permission to access, maybe even contributing to some 
open source projects and communicating giddily about 0day bugs on bugtraq 
and full-disclosure, or releasing exploit information on your twitter 
feed; after all, in this wired global age, the opportunities for 
collaboration are indeed unprecedented. But where does one's level of 
responsibility for the use of one's research end and begin? Dig Sklyarov 
and the DMCA brouhaha. Witness certain unnamed Linux distros suddenly 
being unwilling to allow tools such as SQL Ninja to be included in their 
source code repositories.

At what point might YOUR code be considered a munition? At what point 
might your totally legitimate work as a whitehat (or greyhat, or what have 
you) researcher, or pentester, or even systems administrator or website 
developer be called into question? While it is certainly difficult to 
argue that putting identity thieves behind bars is a quote-unquote "bad 
thing", it is also difficult to refute that code itself is being seen as a 
munition (just as crypto was not so long ago, and probably will be 
increasingly so again, as time passes and the reins tighten up in only 
somewhat predictable ways).

If you mistakenly introduce an error into your codebase at work and it 
creates a security hole, can you prove it was not intentional? There 
really are no guarantees. An overly aggressive legal system will at the 
very least threaten to steal time, money, resources, and quite probably 
your reputation. 

If you're very unlucky you might wind up in jail, or in trouble for 
something someone you know was involved in, in hopes that you will be the 
next hacker willing to daub in his (or her) mates to be set free, thus 
maintaining the cycle of narqing and providing an always-revolving door of 
the Usual Suspects to lay blame to. That's not even including the Patriot 
Act and wiretaps (an issue pretty much deserving of its own article some 
other time). 

The exposure of Google's Street View Wifi data gathering fiasco is likely 
only the tip of the iceberg -- what we were told was the accidental coding 
error of a single engineer (who probably will wear that virtual scarlet 
letter on his resume for life). And yet again, in that case, other 
countries were first to protest; only lately has there been a strange and 
questionable desire TO have those records retained -- for what purpose who 
only knows.

The question to wrap all of this up with, here, probably isn't "Does it 
affect you now?" (unless you are indeed a blackhat, in which case, no 
doubt, this will impact you tremendously). The question is "can you be 
sure it never will?"


--[ 2. Stuxnet, Cyberwar, Hacktivism and Political Hacking

It's no secret that, with the US economy in a state of planned poverty, 
conventional sense.  But the growing speculation, that Iran's nuclear 
power plant at Bushehr will turn into a weapons program, is a timely 
excuse for governments to exercise their newfound cyber warfare tactics.  
Iran believes Stuxnet was intended to derail its nuclear ambitions; and 
"analysts" expect us to believe that a string of numbers, the name of some 
shrubbery, futbol domains, and weird 2012 shit... somehow indicates Israel 
was behind it all.  The reality is probably this: as much as Israel's 
super star hacking squads would love to take down Bushehr, Russia is 
standing in the way, defending its plan for a return on investment.

Stuxnet represents just one of a few big events in this arena since last 
issue. We've also had Aurora and that whole Google scandal in China.  
Hildawg has been bitching about China from the start, and it came as no 
surprise that pressure would be put to bear on big companies, like Google, 
to defame China's government in the midst of a GFC.  More recently, 
Europe's cyberwar simulation has been hailed as a success, with countries 
across the EU learning to defend against over 300 attacks.  This marks 
another milestone in the EU's attempt at coordinating intraregional 
cybercrime investigations.  Across the Atlantic, USCYBERCOM has finally 
gone live.  While governments prefer to keep their military hax a secret, 
there exists a necessity for them to demonstrate their power.  Welcome to 
a whole new wave of terror, hackers.

The majority of high profile attacks in the last year show a trend towards 
highly skilled and targeted hacks that take a lot of time and/or money to 
develop.  In these cases there is minimal collateral damage, months may 
pass before detection, the hackers are anonymous, and the vector is 
unique.  While these are still large-scale attacks, they're not intended 
to affect the entire internet -- just a select few major players, and 
sometimes only for a short while.  As corporations and governments throw 
big bucks into cyber warfare we're going to start to see some of the big 
names in the IT industry get left behind.

The continued DDoS of Burma, in the lead-up to its first election in over 
20 years, showed a recent and unwelcome return to stupidity and ignorance 
at a rate of 10-15gbps, easily dwarfing the Estonia DDoS of 2008.  Amnesty 
International had been working hard to get radios into Burma, so that 
people could keep up with the election news from across the border.  Days 
after the election, their Hong Kong website was compromised and visitors 
were attacked with an IE exploit that Microsoft knew about, but blatantly 
refused to patch early.

On the same day that the Burma DDoS began, the Iranian Cyber Army 
announced its "botnet for hire", though it is rather unlikely that there 
is a substantial link between the two.  Their admin system is some kind of 
honeypot, their stats are fake, and surely the very idea should have 
screamed of an obvious trap.  But as the news started to spread, bloggers 
began recycling news media, and slower reporters started relying on those 
bloggers, until we started coming across reports that ICA was renting out 
"the same botnets that took down Twitter and Baidu".  Uh, sorry?  Last 
time I checked, social engineering a dude at Register.com didn't require a 
botnet.  

But hey, maybe there is a botnet, or at least one in development.  It's 
hardly as though ICA are the first to do so.  But their treatment by news 
media is ridiculous.  I mean, if these guys really are an "army" then just 
where were they when Honker struck out in retaliation for Baidu's 
defacement earlier this year?  Unfortunately the media still clings to 
them because of a handful of high profile defacements.  And because they 
tend to pop up every time something big happens, some journalists actually 
think these kids are an officially sanctioned military force that reports 
to Ahmadinejad himself!  I don't believe, for a second, that they're even 
Iranian to begin with.

On the related note of poor-man's hacking, we're also seeing a rise in 
grassroots hacktivism.  Social networking sites are making it increasingly 
easy to inspire angry mobs of ordinary computer users to take part in a 
DDoS by clicking a link.  Years ago we laughed at those kinds of methods 
(remember the cDc's hacktivismo?).  But we're not on dialup anymore, and 
there's not a lot you need to get your own "human-net" started -- just a 
persuasive cause and a handful of idiot-proof programs.  LOIC is popular 
for this, as are websites that send GET requests in iframes over and over 
and over.  Next thing you know, there's thousands upon thousands of stupid 
tweeters, staggering forth like something out of Resident Evil.  This 
isn't even including the more normal botnets that use sites rely on 
Twitter for commands.  Throw that into the mix and Twitter becomes some 
kind of pluralistic middle-class pseudo-political force to be reckoned 
with.  Law enforcement seem to just give up in those cases.  Too many 
people to chase.  Not enough resources to prosecute them all.  The most we 
see is the instigators of these human-nets being hunted down.  As the RIAA 
and MPAA attacks showed us, Anonymous ain't so anonymous when they plan 
their attacks in the open, in front of feds, on 4chan and Darknet.

The trend toward military-directed cyber attacks is prompting some 
academics to call for a change to the laws that regulate the conduct of 
hostilities in war.  They are questioning whether a country can remain 
neutral in a cyber war if the data carrying the attack travels along that 
country's pipelines.  Some militaries insist that for hackers to qualify 
for "prisoner of war" status, these geeks must wear a special hacker 
uniform and carry a sidearm (I like to think this uniform would look like 
TRON Guy).  

And then there's the question of whether something like Stuxnet can be a 
legal impetus for conventional war.  The real beauty of Stuxnet isn't just 
in the code (as specialised and 0-day as it may have been) -- it's also in 
the attack vector.  If you conveniently lose your malicious USB key in a 
parking lot, and some "unscrupulous person" picks it up and decides to use 
it at work... YOU are not committing an attack -- at least not directly 
(one could argue, after all, that they had no business picking up the usb 
key in the first place).  Moreover, philosophical arguments aside, if 
you're a civilian, the likelihood of you being charged with anything is 
extremely remote. Add all of this to the essential argument that hacking 
cannot be considered an act of war necessitating self-defense unless the 
hack can be compared to a substantive and conventional military attack, 
and conventional arguments are essentially thrown out the window. In other 
words, in the case of Stuxnet, while Iran recognises there was espionage, 
and possibly an intentional attack, the worm was not an "armed attack" 
sufficient to qualify self-defense under the UN Charter.

In sum, if the events occurring since the last issue has been anything to 
go by, the next decade will see a growing disparity between the nature of 
high-profile hacks, but at the end of the day the bulk of it is the same 
old same old, with some new shit thrown in.  Militaries are fast becoming 
a cyber-force to be reckoned with, but in the absence of laws to regulate 
their actions, don't expect bombs to fall as a result.  While it is most 
probably that the recent spate of uniquely targeted high-profile attacks 
will go unpunished, what we can expect is the government to play an 
increasing role in regulating the Internet and hunting down ordinary 
hackers in the name of a "war on cyber terrorism".


--[ 3. Wikileaks and whistleblowing 

But what of Wikileaks? While it is undeniable that it has had some impact, 
one must ask oneself if we are not just raucously accepting as a date to 
the prom the only girl who asked us out and considering ourselves lucky to 
have found anyone at all. One could argue that when a society needs a 
hero, someone will always be willing to show up fighting, but the same 
could be said of most movements, even including the upstart 'Tea Party' 
being cawed about on Fox News to cheers by the same people who would have 
voted for Obama if they'd been Democrats instead of Republicans. Perhaps 
it's unfair to tilt this article so specifically in the direction of the 
US -- after all, Wikileaks has shed some light on some tremendously 
important stories in the three or four years since its inception -- but 
it's hard to argue that 2010 was the year that Wikileaks came to true 
nation-wide attention, due in no small part to a certain "redacted" video 
going by the sobriquet "Collateral Damage", and then fueled by the 
document dumps ostensibly leaked by US insiders concerning Iraq and 
Afghanistan that came not long thereafter.

Yes, we have a responsibility to make information acceessible, or at least 
make the knowledge of how such information is stored and used more public, 
less draconian and redolent of a country poised to curtsy/bow to 'Mein 
Fuhrer' but we also have a responsibility to treat that information with 
respect, and more importantly to be able and willing to filter that data 
through the sieve of common sense and reason: Data should be valuable 
because it is valuable data (and in some cases the releases by Wikileaks 
have indeed been valuable data) and not valuable simply by the reasoning 
that "they don't want us to have it." 

By the same token, sometimes the very act of sticking the proverbial 
middle finger up at The Man serves as a call to arms -- or at the very 
least a rate limiter: A way to urge the current Powers That Be to think a 
little more before trying to instituting even further privacy eroding 
measures. Conversely, it is all too easy for any country to consider any 
"leak" -- righteously whistleblowing or not -- as an act of war, or an 
excuse to add a few zeros to a department's line budget.

And there's something else we all need to be thinking about:

Every country, every war, every movement has secrets. We may tell 
ourselves that information wants to be free, but freedom comes with a 
price and some secrets are GOOD secrets. More importantly there OUGHT to 
be some secrets in the world.

To completely submit to Wikileaks' vision is almost more akin to Big 
Brother than anything the US government -- or any other government -- 
could possible create on its own: A culture where your every move may be 
exposed, your every thought may be tallied, your every minutiae published 
for the whole world to see, in a world where Google gambols giddily in the 
grasses of greed and Facebook and Twitter announce to the world your every 
move to a perceived audience of enthralled onlookers all willing to say 
'you!' when you say 'ah, me!'. In a way we're already most of the way 
there, and that's a very dangerous thing. When your baseline gets reset 
and you don't REALIZE that your privacy is being invaded, then the great 
big "They" has already won -- and you have just let yourself do the dirty 
work for Them.

One could argue that if PFC Manning did indeed leak what has been 
attributed to him, he may have done a heroic thing, but the fact that he 
may have also broken a trust that he covenanted into in advance with the 
US government is difficult to completely discount. The Manning case having 
received the attention it has gotten this year has brought up a lot of 
grey areas in peoples' political belief systems, but it has also begged 
the question: What *is* "whistleblowing" and what is "disloyalty"? What is 
"patriotism" and what is "narqing"? When can one trust one's judgment 
about another person's true intentions and is it truly as cut-and-dry as 
we all wish it would be? Adrian Lamo snitched, but it is always possible 
that he thought he was protecting himself or his country even as he may 
have also been trying to cobble together some newfound publicity for a 
receding career that has been inarguably past its prime for years now. At 
some level this isn't about government or whistleblowing or privacy -- 
it's about society and about interpersonal trust, and perhaps that is 
where things get the murkiest. Naive or not, trust is dealt out 
increasingly to total strangers on the internet. One could argue that 
Manning, if indeed that was Manning, was naive in trusting a veritable 
stranger, but most of us do this on a regular basis now; the difference 
here is, Manning paid.

Without an explicit agreement of nondisclosure one cannot truly and 
totally scorn somebody for "squealing", but by the same token our very 
society has been built up on such simple and implicit bonds of trust: I 
will not hurt you, I will not steal from you, I will not betray you. I may 
not agree with what you do, but I respect your choices as an individual. 
At what point does that trust need to be broken off? Some secrets are 
good, if they contribute to the greater good of society -- and that goes 
*both* ways -- at times in favour of the individual, at other times in 
favour of government. As a species we always want to root for the Underdog 
(and nowhere is this more true than the US, perhaps), but given the fast 
fluxing nature of the Internet, who the Underdog is can flip at a second's 
notice: At first Wikileaks was the cause celebre of people everywhere, 
then came the backlash. All movements have backlashes, and Wikileaks was 
bound to not be the exception.

Perhaps one reason so many scorn Wikileaks has to do with the closed-book 
nature of a site so overtly and devoutly espousing transparency; at some 
point it becomes difficult not to interpret all sides as playing with 
similar playbooks. But it's difficult to win at poker at a table where 
everybody knows your cards, especially when the rest of the players have 
bankrolls that far eclipse your own. Again, the question arises: When is 
transparency necessary, and when is secrecy a requirement to make any 
progress at all? On the one hand, one must worry about too much 
transparency; on the other hand, one must worry about too much lurking in 
the shadows. In the past we had journalists to expose corruption; now it 
is often journalists themselves fighting off corruption charges, hiding 
facts, skewing evidence.

It's incredibly difficult to deny that some transparency, and indeed 
Wikileaks itself, can have a positive impact -- and it's hard to imagine a 
world where SOME sunshine shouldn't be shed; The trick here is to remember 
that such increased levels of exposure demand we be a more responsible, 
measured animal -- something as homo sapiens we have really never learned 
how to do or be. 

There is no way to shove the genie back into the bottle, and old rumours 
on the Internet never really die -- they just get archived til someone 
else manages to come along and dig them up from their temporary graves. 
This holds great promise for the future of integrity, but it also creates 
issues when the possibility of outright falsehoods are introduced, 
especially through an anonymous third party, or in cases where a split 
exists between haves and have-nots; who really has time to monitor their 
reputation online to that level? And if someone does besmirch your name, 
what can be done?

If your data shows up on a whistleblower site care of a third party, then 
it also becomes yet another way to show a display of power: The 
Vice-Presidential hopeful breaks the rules -- nay, the law -- and walks 
free while the college student who guesses at her password gets sentenced 
to a year of supervision or prison. If there is to be light shed, then it 
should be an equally penetrating (and perhaps softer) light -- not a light 
meant to shine in the victims' faces and hide the face of the perpetrators 
-- especially when the label of 'victim' and 'perpetrator' is so murky and 
grey (as in the Palin case; one could argue both sides committed some form 
of fault).

Julian Assange likes to say 'speak truth to power" but this is a tall 
order; to first be able to speak ANYTHING to power, you must basically 
gain the ear of the powerful, or you just get thrown
into an eddy, left to whirl around with a bunch of kooks and nutjobs (as 
any federal agent handling walk-ins will likely attest to, and too, so 
must whistleblowing sites contend with; with fame
comes your own raft of nutjobs to weed out).

It'd be hard to deny that whatever else Wikileaks has accomplished in the 
past year, it has gotten someone's attention. Whether that will be a good 
thing or a bad thing remains to be seen... But one imagines any call to 
arms must bring about some force for good, even if that force is something 
as simple as a renewed spirit of vigour and willingness to be involved 
among an otherwise sluggish populace juggling its own sense of 
powerlessness in a country demanding what essentially constitutes sexual 
assault merely in order to board an airplane. To make an omelet you must 
first break some eggs; To create a change you must first gain the ear of 
not just power but the people itself -- and then you must charge them with 
the duty to act.

The true collateral damage may wind up being Manning himself, here; 
basically judged guilty already, his name forever stored, his 
acquaintances being hassled, his personal life bared open to the
 world, he serves as both an example of what to strive for and a 
cautionary tale for a new age. What the future holds for him remains to be 
seen, but with any luck he will receive a fair trial by a jury of his 
peers -- if any such people even exist.

Wikileaks may not be perfect -- in fact, it may be deeply flawed -- but 
for now it's probably all we're going to get. And we should probably be 
grateful for it -- but wary. Always wary. The danger of mixing the message 
up with the messenger is always great, and there is no real way for any 
whistleblowing site to always be 100% correct. Even governments have an 
incredible amount of difficulty verifying the veracity of any information 
or separating rumours from fact; to put this level of blind trust in a 
volunteer organization with no oversight is bound to be fraught with a 
whole host of issues we haven't seen the likes of yet... For instance, 
what happens when a non-governmental entity views it as a potential source 
of information? Once any whistleblowing site gets information, it is out 
there; what is done is done; At this point, false flags and disinformation 
is also an issue; the possibility of tricking any whistleblower site to 
publish false information would destroy not only its credibility if found 
out but possibly be used to forward some governmental or non-governmental 
party or agenda. Additionally, to believe everything that any organization 
says is as short-sighted as believing everything your government tells you.

Ultimately your conscience will have to be your guide -- and likely no two 
consciences will ever completely agree, especially about anything as 
at-times agit prop as Wikileaks can be, or as secretive as governments 
have always been.


--[ 4. Scene Events: the Final Word

To be sure, many other events have taken place this past year and a half 
(the whitehat-vs-blackhat wars forever raging (cue zf05 and the 
never-ending arguments about disclosure-vs-nondisclosure); the global 
emergence of a harsher, more organized form of cybercrime (and the many 
busts that resulted);  etc, etc), but several basic themes emerge: There 
has been fraud -- but there has always been fraud. There have been 
invasions of privacy -- but there have always been invasions of privacy. 
There have be governments overstepping their bounds -- but there have 
always been governments overstepping their bounds. That doesn't make any 
of it acceptable, but it also doesn't make any of it new -- nor does it 
give any of us an excuse to pretend it has nothing to do with us (no 
matter where you reside or what flag you fly (or choose not to fly, 
whatever the case may be)). If anything, there has been an amplification 
of all of the above, but none of it is truly 'new'. Read past issues of 
Phrack: All of the above has existed in some form or another, just on a 
smaller scale. It's still existed.

Judging by the drive for wealth or fame or infamy displayed in so many of 
this year's stories, it bears mentioning that we cannot let a few key 
players make us forget how important it is to treat technology 
responsibly, reasonably -- to love it, to hack it, to, please, take risks, 
but to do so with heart

-- with CONSCIENCE --.

In the end it all starts and ends with you.

[EOF]