Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all,
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.

USA turning to the Darkside or midichlorians all used up ?

Comments

  • #2
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    How do private companies defend themselves? They hire a team of hackers to go to work and hack their own systems, revealing holes and make recommendations for plugging the gaps. And the gaps get plugged.

    How does the US defend themselves? They send the marines.

    Is this article suggesting that the US intends to go on the offensive digitally? Guys, come on! Fix your sh1t.

    I can't talk about what I see on a daily basis but often times it is truly shocking the state of security in some organisations. A level of security understandable in a startup with 3 guys, and its in a national service provider.

    Im not just talking about Ireland. Gary McKinnon hacked into the the US Government computer systems looking for evidence of aliens, and he says he guessed most of the passwords he used to get in. In the last couple of years I've stopped doubting that story.


  • #3
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    syklops wrote: »
    How do private companies defend themselves? They hire a team of hackers to go to work and hack their own systems, revealing holes and make recommendations for plugging the gaps. And the gaps get plugged.

    How does the US defend themselves? They send the marines.

    Is this article suggesting that the US intends to go on the offensive digitally? Guys, come on! Fix your sh1t.

    I can't talk about what I see on a daily basis but often times it is truly shocking the state of security in some organisations. A level of security understandable in a startup with 3 guys, and its in a national service provider.

    Im not just talking about Ireland. Gary McKinnon hacked into the the US Government computer systems looking for evidence of aliens, and he says he guessed most of the passwords he used to get in. In the last couple of years I've stopped doubting that story.


    Could't agree more only this garbage coming from the US is a very defeatist attitude almost as if they wanna throw all the toys out of the pram.

    I would tend to believe you, in what you have found as i have also found similar stuff in my past and that's not excluding the present . IT would frighten the **** out of you to see what masscan returns for 1433 , 80 , 443 on 0.0.0.0/0 lolz . Thats a scan on the whole internet in less than 5 mins ( Provided you have 10GB pipe) no usernames and passwords and gui front ends to internal management systems all completely unprotected . You might get the odd complaint but its only 3 ports and not a persistent hammering via the scans. !!


  • #4
    Gone West
    Registered Users Posts: 6,374 ✭✭✭Gone West


    Scan 3 ports on the entire ipv4 address space in 5 minutes on 10gb? Nope. Sorry, but nope, that's not real.


  • #5
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    Fuzzy wrote: »
    Scan 3 ports on the entire ipv4 address space in 5 minutes on 10gb? Nope. Sorry, but nope, that's not real.


    15 mins it can be done . You have to set up parsing tools and advanced configs on masscan but it can be done.


  • #6
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    And you need to ensure that you are registered with public awareness to show you are not hacking but offensively looking for vulnerable sites that may or may not become targets. How do you think we get our impacted or open to heartlbeed or poodle counts ( As well as a myriad of other vulns)?


  • Advertisement
  • #7
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    https://github.com/robertdavidgraham/masscan


  • #8
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    to you it may not be possible , but i can assure you it is .


  • #9
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    Are we may be getting away from the point?


  • #10
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    syklops wrote: »
    Are we may be getting away from the point?

    A little but saying its not possible has to be shown other wise.
    IT rides on the back of what you said about finding loose connections in the wind , no passwords and system gui's doing the same thing .


  • #11
    the_syco
    Registered Users Posts: 37,295 ✭✭✭✭the_syco


    “I just think it’s critical to develop an offensive cyber-capability,” said Sen. Angus King (I-Maine ). Moreover, he said, that capability needs to be publicized.
    Publicize it so people can blame it? Why don't they just have it and use it?


  • Advertisement
  • #12
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    the_syco wrote: »
    Publicize it so people can blame it? Why don't they just have it and use it?

    So a senator or congressman can read it and approve extra funding.

    "The Wall Street Journal said it so it must be impartial".


  • #13
    Gone West
    Registered Users Posts: 6,374 ✭✭✭Gone West


    dbit wrote: »
    15 mins it can be done . You have to set up parsing tools and advanced configs on masscan but it can be done.
    I am very familiar with this tool. 5 mins or 15 mins, neither are realistic for scanning the entire /0.
    Either way, this isn't about open config panels or huge scans, this is about more targeted, sophisticated attacks against named and unknown aggressors.

    This thread is a bit of a misfire. This is just the usual TLA-group looking for a change in mandate.
    The US typically considers it's much lauded offensive capabilities their best tool in their cyber defense arsenal. The reality is that threat actor groups don't fear a retaliatory hack, and the threat of it is not deterring attackers.
    The best defense is not a good offense, not when you are in a guerrilla war.
    I think that the US are not reacting well to recent developments.


  • #14
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    lol


  • #15
    Gone West
    Registered Users Posts: 6,374 ✭✭✭Gone West


    dbit wrote: »
    lol
    "lol", surely you can do better than that.
    You are talking about script kiddie bullshít, scanning the entire ipv4.
    Completely unrelated to this thread.
    If you want sources on my post above, I can recommend some ok books to cover the basics of politics meets cybercrime & cyberterrorism which would allow you to understand what the article you linked is about.


  • #16
    dbit
    Closed Accounts Posts: 1,322 ✭✭✭dbit


    lol and Yawn !


  • #17
    Gone West
    Registered Users Posts: 6,374 ✭✭✭Gone West


    dbit wrote: »
    lol and Yawn !
    Yawn indeed. Off to AH with you, lad.


  • #18
    the_syco
    Registered Users Posts: 37,295 ✭✭✭✭the_syco


    http://www.military.com/daily-news/2013/03/12/general-says-detection-deters-major-cyberattacks.html
    American companies are being more vocal about cyber theft emanating from China "on a very large scale." He said Beijing "should take serious steps to investigate and put a stop to these activities" and recognize the risk to international trade and to U.S.-China relations.
    After analyzing breaches that compromised more than 140 companies, the private security firm Mandiant has concluded that they can be linked to the People's Liberation Army's Unit 61398, a secret Chinese military organization based in Shanghai.

    Seems it's less "anti-government hacking" that they want, but more "cloak and daggers hacking" that hacks the chinese state-sponsored company that the chinese pretends doesn't exist, without openly attacking China as they still rely on it for cheap goods.

    Steal from Peter to pay Paul, imo.


  • #19
    Gone West
    Registered Users Posts: 6,374 ✭✭✭Gone West


    It's a dog and pony show.
    Why would they ask Beijing to investigate something that Beijing instigated.


  • #20
    Manach
    Moderators, Society & Culture Moderators Posts: 9,663 Mod ✭✭✭✭Manach


    To be fair they are not actually yet suggesting kinetic weaponary release on the basis of a cyber-attack. This is a option (under the Tallin doctrine) to deal with cyber attacks as the damage to physical infrastructure from a physical attack could be mirrored by a cyber one (as per Stuxnet mentioned in Goodman's Future Crimes). As well, the damage done by Chinese espionage both to civilian/miliary intel loses can be quantified in the billions. Thus the US might be an offender, it is not the only Dark sider in the house.


Advertisement