• Content count

  • Joined

  • Last visited

Everything posted by eshaelon

  1. I was reading the Cybersecurity Act of 2009 (S 773) and I have a couple of questions. In section 18 paragraph 2, The President: "may declare a cybersecurity emergency and order the limitation or shutdown of Internet traffic to and from any compromised Federal Government or United States critical infrastructure information system or network" In section 23 paragraph 3, the following definition is given: The term `Federal Government and United States critical infrastructure information systems and networks' includes-- A: Federal Government information systems and networks; and B: State, local, and nongovernmental information systems and networks in the United States designated by the President as critical infrastructure information systems and networks. My question are: 1) What exactly qualifies as a Cybersecurity emergency? 2) What qualifies a network as part of the "critical infrastructure information systems and networks"?
  2. chaostic-- I definitely see your point and thank you for that insight. Pan-- I believe that if a serious infection occurred, then the network administrators would step in, but this legislation does include the provision for the president to shutdown the network in the intrest of nation security (Section 18 paragraph 6). As far as the "technically minded folks have to come up with a reasonable plan", the legislation requires this also. Specifically, it requires the president to form a Cybersecurity Advisory Panel. They will produce reports every two years and aprove domain name contracts between the Assistant Secretary of Commerce for Communications and Information and the Internet Assigned Numbers Authority (Section 8, paragraph A). I wonder what this legislation will look like if it is passed. As of right now, it is in the Senate. It still has to go to the House of Representatives and finally before the president. Does the legislation appear fine now or should we demand our representatives to amend any parts? I have read provisions for: (sec 3) A Cybersecurity Advisory Panel consisting of many people of varied technological backgrounds. (sec 4) A Real-Time Cybersecurity dashboard displaying the security and vulnerability status of all the government networks managed by Dept. of Commerce (sec 5) Creation of Regional Cybersecurity Centers for the Promotion of Cybersecurity Standards. ++++©(3) make loans, on a selective, short-term basis, of items of advanced cybersecurity countermeasures to small businesses with less than 100 employees. (sec 6) The creation of a cybersecurtity standard. ++++(a)(6) Vulnerability specification language- establish standard computer readable language for specifying vulnerabilities in software to enable vendors to communicate vulnerability data to software users in real time. ++++(a)(7) Nation compliance standards for all software - ++++(a)(7)(A) PROTOCOL - The Institute shall establish a standard testing and accreditation protocol for software built by or for the Federal Government, its contractors, and grantees, and private sector owned critical infrastructure information systems and networks. (sec 7) License and certification for cybersecurity professionals working on federal or critical infrastructure information systems. (sec 8) Review of NTIA Domain Name Contracts by the Advisory Panel. (sec 9) Creating a Secure Domain Name Addressing System (sec 10) Promoting Cybersecurity Awareness ++++(2) communicates the Federal Government's role in securing the Internet and protecting privacy and civil liberties with respect to Internet-related activities. (sec 11) Federal Cybersecurity Research and Development ++++(a)(4)How to guarantee the privacy of an individual's identity, information, or lawful transactions when stored in distributed systems or transmitted over networks ++++(a)(6) How to determine the origin of a message transmitted over the Internet. ++++(a)(7) How to Support privacy in conjunction with improved security. (sec 12) Federal Cyber Scholarship-for-Service Program ++++((4) shall provide a procedure for identifying promising K-12 students for participation in summer work and internship programs that would lead to certification of Federal information technology workforce standards and possible future employment (sec 13) Cybersecurity competition and Challenge for cash prizes. (sec 14) Sharing Threat information between the federal and private sectors. (sec 15) Cybersecurity Risk Management Report. ++++(1) (the feasibility of) creating a market for cybersecurity risk management, including the creation of a system of civil liability and insurance (sec 16) Legal Framework review and Report (sec 17) Authentication and Civil Liberties Report on the feasibility of ID management and authentication on government systems with respect to civil liberties and privacy (sec 18) Cybersecurity Responsibilities and Authority ++++(2) (The President) may declare a cybersecurity emergency and order the limitation or shutdown of Internet traffic to and from and compromised Federal Government or United States critical infrastructure information system or network. ++++(6) (The President) may order the disconnection of any Federal Government or United States critical infrastructure information systems or networks in the interest of national security (sec 19) Quadrennial Cyber Review (sec 20) Joint Intelligence Threat Assessment ++++ The Director of National Intelligence and the Secretary of Commerce shall submit to the Congress an annual assessment of, and report on, cybersecurity threats to and vulnerabilities of critical national information, communication, and data network infrastructure (sec 21) International Norms and Cybersecurity Deterrence Measures. (sec 22) Federal Secure Products and Services Acquisitions Board (sec 23) Definitions
  3. I used the Samy worm's outbreak on Myspace as an example of a possible cybersecurity emergency. If a new, highly infectious worm were to infect a popular site and millions of people became infected. Perhaps this worm attacks the firmware within a brand of router and bricks them. (I know a worm's function is to spread, but maybe after it infects so many users, then it bricks the router.) If there was significant damage, could this legislation be used to force the shutdown of the site? (assuming responsible admins are forced to keep the site up by the know-it-all advertising execs. (just a theory)) If such a worm were coded from bugs and exploits posted on securityfocus or some other security site then couldn't such sites be targeted. Could they be accused of promoting or enabling Cybersecurity emergencies and be forced to shutdown? All it takes is time to erode the constitution. It works so slowly, we do not realize it. Maybe I am paranoid and overly cautious, but I just have a few trust issues with my politicians.
  4. This past Monday, I was conducting an experiment. My goal was to test the signal strength of my home access point as I approached the driveway. Before I left my job, I booted up my laptop and started netstumbler. As I drove, netstumber was bonging away, locating around 200 access points between my work and home. I was about 10 minutes from my house when something strange happened. I was passing by a home that recently burned to the ground and about to stop at a stop sign, when I heard the “bong”. I glanced down and saw a weird MAC address: 9A01B7000444 and SSID: SST-PR-1. As soon as I stopped, a van with a bright green “A&E” logo turned beside me. I immediately thought “there’s no way that there is an access point inside of the burnt house.”, but I had to investigate. I turned around and drove back down beside the burnt house….nothing. I drove around the block a little ways….nothing. Then I remembered the strange van. I got home and looked up the MAC address vendor, and I cannot find one (maybe a spoofed MAC?) I then googled the SSID “SST-PR-1” and got a couple of hits. Apparently it was coming from a Sears Home Service van, and here is an article about it and here is a van like the one I saw.
  5. I thought I was just being paranoid. I wonder if they could use this to target social site or use it as a censorship technique. Consider if another worm (like the Samy worm) got out on a social networking sight (like Myspace). Could this constitute an emergency and Myspace would be ordered to shutdown? What about sites like Binrev or HPR? Could they target security sites (like securityfocus) claiming that the evil attackers will use such information to attack these critical infrastructures? Would such vagaries in the legislation allow for preemptive actions? I may be blowing it out of proportion, but look at what they have already gotten away with: Banning of incandescent light bulbs by January of 2014 Bailouts Patriout Act(a special case in a different political world, I know, but look what has been done with it). Maybe the old CG cartoon show "Reboot" had it right with Daemon, the supervirus. "She controls the pathways but not the systems; effectively controlling the net without spreading herself too thin."
  6. As far as encryption, I use WPA-PSK. I've disabled SSID broadcast and I use MAC filtering to prevent the random drive association. This is all overkill though. I live out in the country, and my neighbors haven't learned about WIFI yet .
  7. Am I seeing a reoccurring theme? There seems to be a standard format that the media uses to sell new ways of stripping away privacy. The article claims that anonymity is the precursor to crime. As people flocked from small communities where everyone knew each other, an anonymity emerged in the cities and a rise in crime followed. Our law enforcement officers are human and subject to the same manipulations as any human would. In a perfect world, I would trust my identity to anyone. Until we reach that world, I would like the option of anonymity. I'm not a criminal for that desire. Then they bring in the fear. That's allowing "criminals to infiltrate the community, become part of the conversation and persuade people to part with personal information," Smith said. Children are particularly at risk to anonymous predators or those with false identities. "Criminals seek to win a child's confidence in cyberspace and meet in real space," Smith cautioned. OMG, the children are in danger. The children are in danger from paper cuts at school and the mercury in the florescent lights. If anonymity will lead to child molestation, then lets ban public school to further protect children. Maybe it would be too much to ask that the parents get involved with what the children are doing online and maybe Little Jimmy can stay safe. Instead, let's make sure that we can ID everyone that's in chat. That's a much better alternative. Sorry for misspellings and grammer errors, i'm late back from break.
  8. I'm still new to the forums and haven't been much help to anyone, so I cannot claim any of your appreciation. I will offer you luck in learning Ruby
  9. There is an episode of "Boston Legal" that ends with one lawyer talking to another. The first says "To Daniel Post, my loss". The other says "I didn't know you knew him." The first responds, "I didn't, and from what I gather, my loss." I've never heard of EPiC until now. After reading some of the comments on the website...."To EPiC, my loss."
  10. Hello everyone. I'm trying to get a binrev meeting started in the Tifton - Valdosta area. We have about 5 people total that are willing to come, but we are open to anyone comeing. If anyone is located close to Tifton, Ga, we are having our meeting this Thursday (April 17th) at the Krystal's In Tifton, Ga. It is actually located on the North West corner of the 2nd St And Virginia Ave. (About 1 Block West of the location on google maps.) We are planning on meeting around 6pm, and staying till when ever.
  11. It's great to hear from another GA BinRev'er . Thanks for the reply.
  12. Thanks for the reply man. We chose Krystals mainly for the wifi (advertised as free), but also for the food. We may get thrown out in the first five minutes, but it will be something to post about.
  13. Greetings to everyone. This is my first post in any forum. If this topic is not appropriate here, then I ask for any advice or even flames for being a noob. Thanks in advance for all responses. I recently got high-speed DSL from my local phone company. The modem that they provided was made by "Clear Access". This particular modem has a built-in wireless router, and 5 Ethernet ports. The setup for the router was done at the phone company, since my schedule prevented any home installation. Once I brought the router home and plugged it in, it was all down hill from there. The first kink was getting passed the "Blocked Access" screen that kept coming up when I would enter a URL. This was defeated by pointing my laptop to a specific DNS server. Once online, I found the last half and the first half of the MAC address was the username and password respectfully. After logging in, I secured my wireless network by changing and disabling the SSID broadcast and enabling WEP (weak I know, but it was what I was comfortable with). Unfortunately, it doesn't support MAC address filtering. I moved on to the LAN configuration. This came as a huge shock to me. The configuration for my LAN was stored off site. Any changes to be made to my LAN, including open ports and mapping a MAC to a static IP, had to be done through their server. I could understand if it was my local telecom’s servers, but these servers had nothing to do with them. What was worse, the port forwarding wouldn't work with any application, on any of my computers. I moved to the log screen. It wasn't very informative, but it did have an email field. I sent it to a dummy address and viewed the header. The IP address that sent the message resolved to some company named Jumpline. It claimed to have come from "", but the message was CC to "". This really made me mad. I did notice that every function on the router was done through, where function would be log, home. I have been learning Perl for the past few weeks and I decided to write a brute force attack to try every possible combination from /a.cgi to /zzzzz.cgi. After letting it run all night, i woke up the next morning to see mail.cgi. I keyed it in and it took brought up security certificates for "" and "". WHY WOULD MY ROUTER NEED TO BE LOGGING IN TO THERE? I went back to the log screen and viewed the source. It posted the variables back to itself, so that wasn't any help. I went to a friend’s house and he happed to have an older Bellsouth DLS modem. I asked if he would mind if I used it in a little experiment. I unplugged the phone cord from my "Clear Access" router. I waited till it gave me the "Setup Connection" button. I clicked through till i got to the PPPoE settings (username, password, vpi, vci). I plugged in the Bellsouth modem and went to the configuration page ( I had to change the vpi (what ever that is) to "0" and restart the modem. I specified the default DNS server to the modem. I plugged in the phone line, waited about 30 seconds and I was online. I checked my speed to make sure I was still filtered. I'm cruising along at 10-mbps and I can actually open my ports and use my applications. Now for my questions: 1) How common is this? Has anyone else used an old modem with a new provider? I was told by my telecom that no other modem would work because of MAC filtering, though that cannot be the case. 2) Should I expect any fall out from this? Would my telecom notice or not? 3) Should I return the modem that I'm not using and being charged extra 5 dollars a month for? My pride wants to call the oh so informative tech support and gloat, but I don't want to jeopardize my internet service. On a final note, I'm new to programming Perl, but I'll be happy to post the brute force script if anyone wants it. I've modified it by changing it to a dictionary attack and I've pointed it towards's mailboxes. Interesting stuff Thanks for any and all posts, even flames. -Eshaelon
  14. I'm reluctant to release their name now. I'm waiting to hear back from their tech support. The last questions I had for them were “Does the router allow for any encryption greater than WEP?", and "Does it allow MAC filtering?” I’ve asked these question three times this past week, twice to "associates"? On a side note, when I call with question concerning my modem, they transfer me to ‘dispatch’. Shockingly, the dispatch associates have been more helpful with my DSL issues than DSL tech support!!! As soon as I hear back from them, I’ll post more information about them. The first three octets are 00:1A:2B. I think that they "resolve" (I’m not sure on the correct term) back to a company called "AyeCom". Also, how secure does this sound? The router has 4 mac addresses in it: Dec 31 16:00:20 INFO kmsg <4>wl0: MAC Address: 00:1A:2B:6E:00:03 Dec 31 16:00:20 INFO kmsg <4>usb0: Host MAC Address: 00 1A 2B 6E 00 02 Dec 31 16:00:20 INFO kmsg <4>usb0: MAC Address: 00 1A 2B 6E 00 01 Dec 31 16:00:20 INFO kmsg <4>eth0: MAC Address: 00:1A:2B:6E:00:00 (That was lifted from the is from the first log that i mailed myself. The last two octets have been changed. I'm sorry guys. I'm paranoid. As I said before, the username and password is the last six and first six characters of the eth0 mac address. Simply take 3(hex) away from the wireless (wl0) mac and you have the username. Scary!!! Scary!!! Scary!!! Thank god for the lack of functionality that I mentioned earlier. I guess that must be a safety feature.