Full Disclosure mailing list archives
Re: What the UK government care about in a hacker
From: Ureleet <ureleet () gmail com>
Date: Sun, 29 Jun 2008 14:29:10 -0400
finally something sane. i agree. On Fri, Jun 27, 2008 at 8:50 PM, n3td3v <xploitable () gmail com> wrote:
On Sat, Jun 28, 2008 at 1:38 AM, Ureleet <ureleet () gmail com> wrote:u know how old this article is?A couple of months old and a prime example of that the intelligence services don't give a fuck about fire fox, internet explorer, opera and other gay applications people post application flaws about on Full-Disclosure. I want to see things post that actually affect national security and the government actually give a fuck about. Let's move away from stupid computer applications and start focusing on national security if you want to be an elite hacker, nobody cares about applications, buffer overflow and the like, its over and done with, its old skool, nobody gives a fuck anymore. If you want to impress the government then start on mobile, radio frequency, chip / hardware hacks. The security community has got to evolve, we can't be sitting here in 2020 still getting wet and excited about an internet explorer or quick time flaws, its getting gay, its nearly 2009... All the best, n3td3vOn Thu, Jun 26, 2008 at 5:45 PM, n3td3v <xploitable () gmail com> wrote:On Thu, Jun 26, 2008 at 2:08 AM, n3td3v <xploitable () gmail com> wrote:I think we've gone beyond the F-Secure has said stage, I think folks are looking for something more. I think the security space has evolved already in respect of home user hackers, the security professional circuit and with the government. Infact the government are finding it hard to keep up with what's possible by the government and what's technologically possible by joe average in his bedroom. A few years ago it was impossible for joe average to shoot the live scene of a national emergency via his cell phone, email that footage to a national television station and that to be used as prime time evidence of the incident, now it is. With this I look onto the media, its still using F-Secure press releases for its news round. Your average joe is now able to creep behind the media wall and get the news before the outlet gets time to read up. The fact, the media is becoming less important in the security arena for bringing us news. Your average joe can configure google.com/ig to give them keyword news thats coming onto the news wires and google.com/alerts can too. What used to be a government fundamental for the intelligence services, is now becoming a challenge for them to know what user is signed upto what and how much they know. Before it was more straight forward, they would know what news sites were available as civilian intelligence sources but now its becoming less obvious. The intelligence community are having to dig deep into online community to see what is possibly being plotted and what sources of information they have and the technique in which its gathered. Today the world is changing, what used to be charted water only reserved for the intelligence services is now also being used by the civilian population. It's scary times, hackers have the best ability to over come the intelligence services, not the script kids, but the hackers! The main focus for the British intelligence service is mobile and anything to do with radio frequency hacks, including RFID type stuff, that's high on the British government look out. The media are hyping about mobile phone worm, while this hype *is* unfounded right now, thats not to say its not top on the British government's watch list of most desirable vulnerability threat vector against national infrastructure of government and civilian population. The hax0r credibility score board from the government's point of view isn't hacks in safari, fire fox or internet explorer, its telecommunications and radio frequency hacks right now. So while you and your friends might think browser hacks, etc.. think again, the real stuff that gets the UK government interested in you is radio, mobile and chip hacks, anything to do with electronics and communication, they don't actually give a fuck about applications, DNS hacks, Cisco router hacks and the like. While those things like DNS hacks, Cisco router hacks and the like are internet critical, they aren't national security critical... So hackers, if you want the most hax0r credibility points and attention with the UK government, think national infrastructure, radio frequency, chip hacks and mobile telecommunication interception. If you want head hunted into the UK government cyber defensive, offensive and research departments go for those vectors... keep away from silly stuff like web browser hacks, DNS poisoning, Cisco etc. How will the UK government contact you? Brute guys will jump out of a range rover land rover which will have darkened windows and will give you an offer you can't refuse after abducting you for five minutes based on your research post on Full-Disclosure. All the best, n3td3v---------- Forwarded message ---------- From: n3td3v <xploitable () gmail com> Date: Sun, Apr 20, 2008 at 10:42 PM Subject: GSM Researcher stopped at Heathrow Airport by UK government officials To: n3td3v <n3td3v () googlegroups com> I was leaving today from the United Kingdom/Heathrow airport. I am about to speak at the HITB IT security conference about GSM security and the USRP (gnu-radio project). I was searched by the UK government while waiting at the Gate and reading a newspaper. A UK Government employee flipped his badge and said "Let's talk. Come over here". They detained my USRP (Software Defined Radio), my mobile phone and my personal SIM card. They did their homework. They knew who I am, where i live, which day I speak at the conference and who I work for. I'm involved in the GSM software project where we also developed a new attack against the GSM encryption A51. We published our research in February at the Blackhat security conference in Washington DC. I understand that the government wanted to make sure that I'm not exporting any cryptanalytic device. I did not. I will not. The USRP is a radio. My mobile phone is a normal nokia 3310 phone and my SIM card is a sim card. They said they do not know what the USRP is and that I can not take it until they have checked it in the lab. This can take 14 days (1/2 month). So be it. They have it for 14 days. Guys, enjoy the device! It's fun playing around with it! I'm uneasy that they took my mobile phone and my sim card. Having a pregnant wife at home and not being reachable complicates my situation. Is this common practice? Are they allowed to do this? Any tips how I can get my mobile phone and my sim card back quicker? Our project: http://wiki.thc.org/gsm The USRP is available from http://www.ettus.com The GNU RADIO project: http://www.gnu.org/software/gnuradio stunning, THC --- Appendix: Surprisingly they did not detain my laptop or my paperwork which would be the most likely place to store any information related to cracking A51. They were also not interested in my 160GB harddrive which would have been the obvious place for storing the rainbow tables. Neither were they interested in the high performance FPGA chip. Instead they took all equipment that could have been used for demonstrating that GSM signals can be received with publicly available hardware for 700 USD. It does not appear that they were after cryptanalytic information. I received a yellow paper about my detained goods. They left the field blank that reads "The goods specified below are detained for the following reason:". What reason? They also crossed out the field "Agent" of the officer who was in charge of the operation. --- UPDATE 2008-04-18 Arrived back at Heathrow. Airplane crew announced "All passengers please have your passport ready. There is a passport check while leaving the airplane. Passenger Steve Mueller please make yourself noticeable to the crew. Steve Mueller please." They told me at the gate that I can get my equipment back. I had a chat with them and they answered many of my questions. They did not answer who requested that I should be searched when I left the country. I'm happy that I got my equipment back and I appreciate that they had it checked out quickly. I'm still not sure why they took exactly the radio receiver parts. I had to change my presentation for the conference and was not able to demonstrate the USRP/gnu-radio. http://blog.thc.org/index.php?/archives/1-GSM-Researcher-stopped-at-Heathrow-Airport-by-UK-government-officials.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- What the UK government care about in a hacker n3td3v (Jun 25)
- Re: What the UK government care about in a hacker wac (Jun 26)
- Re: What the UK government care about in a hacker scott (Jun 26)
- Re: What the UK government care about in a hacker n3td3v (Jun 26)
- Re: What the UK government care about in a hacker rawket (Jun 26)
- Re: What the UK government care about in a hacker rawket (Jun 26)
- Re: What the UK government care about in a hacker James Rankin (Jun 27)
- Re: What the UK government care about in a hacker Ureleet (Jun 27)
- Re: What the UK government care about in a hacker n3td3v (Jun 27)
- Re: What the UK government care about in a hacker Ureleet (Jun 29)
- Re: What the UK government care about in a hacker rawket (Jun 26)
- Re: What the UK government care about in a hacker wac (Jun 26)
- Re: What the UK government care about in a hacker Neil McGovern (Jun 28)