well do ya think you could never be hacked?
why not find out.. goto http://www.grc.com
and click on Shields Up! This nifty web site check your computer for vounerabilities and tells you how to fix them.


--Clean
_____________________________________________
<- If i put this here people think i am joking instead of a cunt



[This message has been edited by Mister_Clean (edited 09-20-2000).]

thats an umm...less then comprehensive check there boyo...

Yes, ummm protecting against hackers is not just hiding ports open to the net...

I just posted that so you all can check how many open ports you have.. Damn you dont need to attack me.. My computer is totally safe anyway

--Clean
_____________________________________________

<-- If i put this here people think I am joking instead of a cunt

Umm, if that's all it takes for you to feel your computer is totally safe, then I'd be worried..

There are way better and more comprehensive tests out there
http://www.secure-me.net/scan

is one that seems pretty good...

Ok i went to that site and i will even POST my results

Your Report Card
Conclusion: Healthy Setup! We could detect nothing interesting on any of the default
ports on your IP address. Your computer appears to be a hard target. Well done!
ALL TCP ports
FILTERED
No response (open or closed) to an open request was received.
ALL UDP ports
FILTERED
No response (open or closed) to an open request was received.

So again i will say that my computer is safe

-Clean

Here is yet another hacker test.. from none other than symantec ya know them peoples that make them programs with that scary Norton Man
http://security2.norton.com/common/1033/sym/sym_intro.asp

any system is hack proof, until the hacker comes along that break it.

Any system is hackproof, provided it doesn't have a modem.

well i am on a LAN which make me even more prone to hackers..since i am on connected to the net 24/7 but i have a hak proof machiene... go ahead and try to hack me

Hey how about an ip MrClean, j/k man.

Security through obscurity is never a valid security option. Meaning just becuase you can't find the machine doesn't mean its secure. Being connected to the net via a static connection (T1, T2, cable, dsl. Some cable and dsl isp do have dynamic services that are like dail-ups but thats not the issue here.) doesn't make you any more or less secure. Security comes in when the person is trying ot penetrate your machine. Besides the only safe computer is one that is off, locked in a safe at the North Pole. Of course this computer has no use to anyone. If your computer provides a service, it can be hacked. If you computer responds to web like requests (port 80 commonly) web related hacks can be implemented. I just telling you guys that it is possible but it can be virtually impossible. Where there is a way, there is a hack.

No system is completely safe. If someone tried to get into your system, and they're 311t3, then it's just a matter of time. That doesn't mean they will get in - if it's secure then maybe they will give up, but if they are determined then it's just a matter of time. And even if you aren't connected via modem, there is still on-site hacking. I work for a company that relies heavily on it's system, so the administrator makes it as secure as possible. Maybe that's why I still work - the tough system keeps me occupied....

screw that, all security relies on obscurity, and it does work to a certain extent. If the person hacking your system has no clue as to the file system, precautions, or security daemons you've implemented, then you've got that much a better chance of getting him. Whether it be system logs, IDS, honeypots, a chroot variant or something as simple as a password, Security through obscurity is an integral part of any secure system. It just means you have to update it constantly...

Im going to try to answer this without sounding like a complete retard :]

First off a real hacker knows the system before he hacks it. He/She would gather as much information as possible about the target and then use this knowledge to begin hacking it. You can rely on changing your systems everytime someone figures out those systems. You would run out of systems very quickly. Honey pots and syslogs do not stop the hacker they make it easier for the person to get caught. Im talking prevention here. The only obscure piece of a security system should be the password. These are easy to change and have a lot of different combinations. If a password is compromised, it can be changed.
Unlike some obscure system you might have implemented. You would have to recode it, or find some binary executable somewhere. Even a binary can be hacked and exploited. Enter assembly language stage right. It is harder to weed your way through assembly code but it can be done. It is better to use systems that have withstood the test of time and public flaming. Much like my ideas are going to have to withstand your guys' flaming. Most exploits i have seen have never relied on knowing the password. Just exploiting some system to gain root access. (My fav being a stack smash. You know if they had a seperate segment as a data stack, and a seperate segment as an address stack this would be a problem. Although you would need 2 registers for pointers.)

Of course i am also aware of weaknesses in humans. Social Engineering, weak passwords, writing down the password on a piece of paper. Humans are the biggest weakness in most security systems. But what still amazes me is the lack of usage of this exploitation.

Now honey pots, logs, etc., are all parts of a security system. I am not denying their importance. But when a machine is compromised it is safer to assume that all logs, and auditing information will be tampered with. Honey pots are nice toys but are the embodiment of a security hole. The whole concept of a honeypot is to have 1 or many security holes, and then monitor the activity of a hacker or a group of them. The only reason they are useful is because of "script kiddies". They have no clue what is really going on and shouldn't get credit for hacking a system, their script should :] Fooling someone like that shouldn't be held as an accomplishment. Real hackers are few and far between. So most security options are vaild for most situations. But then again you could risk being vunerable, if you rely on such measures.

Im an advocate of prevention in most matters.

Prevention continues once the hacker is actually inside the system, I'm about to go to dinner, so I'll answer you more fully later. But a good sysop keeps his system obscure, the more the better. Because the more obscure, the harder it is.


and yes, stack smashing is wonderful

appearantly my computer is safe from hackers as the only thing that website told me, Is that I was using windows 98. Go figure.

Jaded, i await your reply.

Oh yes i love watching the whole thing in a debugger :]

gonna break this down point by point...

First, Say I secure my system as best as I know how, and still lay down tripwired Honeypots and an IDS system linked to say, a pager. That increases the liklihood that I'm gonna be able to go in there and prevent the hacker from doing any more damage and/or getting any more info. So yeah, honeypots, IDS, stuff like that is incredibly useful in prevention if used correctly, with the proper obscurity as to their roles in the system.

Secondly, Chroot. Root cage. Great thing. Tricks em into thinking their in the system but not, there is actually an improvemed system out there that incorporates a bunch of shit into that, mantrap or lantrap or some shit like that. Anyway, if the fact that the hacker is in a cage is obscured then your system is secure due to the obscurity.

As for the time tested systems, hell yeah, the external configuration should be just as such. But I really prefer to keep all my network configuration, file structure, etc.. as *ahem* unique as possible. 'course that means a shitload of documentation, but the way I look at it, a hacker without the documentation would have an extra hard time figuring out what the hell the configuration is....



[This message has been edited by Jadedfool (edited 09-28-2000).]

It seems i was talking in broader terms. I was talking from a programs/systems point of view. What i am arguing against is the code of a certain program should not be the obscure part of the system. Take MS for an example. It's code is pretty much the definition of obscure. They believe since most people can't read assembly language, they will prevent people from seeing the flaws in there security systems. And now that you have clarified your points, i would have to agree with what most of what you have been saying.

Oww, oww, head hurts, ill finish the reply later, maybe tommorow. Need aspirin.

Oh I totally agree, the only way to get any kind of quality software is to let the source stand up to a public beating. I was talking more in terms of the higher levels of security...

Well, ran all those tests on my computer here at AOL office in OKC. Seems pretty safe to me. Not that it's my comp or anything 8)

hmm aol still sucks.. they have been hacked sooo many times i would hope by now they have some kind of security.

Clean.