Cracking 400,000 Passwords

Cracking 400,000 Passwords

Speakers:
Matt Weir PhD Student, Florida State University
Professor Sudhir Aggarwal Florida State University

Remember when phpbb.com was hacked in January and over 300,000 usernames and passwords were disclosed? Don't worry though, the hacker only tried to crack a third of them, (dealing with big password lists is a pain), and of those he/she only broke 24%. Of course the cracked password weren't very surprising. Yes, we already know people use "password123". What's interesting though is figuring out what the other 76% of the users were doing. In this talk I'll discuss some of my experiences cracking passwords, from dealing with large password lists, (89% of the phpbb.com list cracked so far), salted lists, (Web Hosting Talk), and individual passwords, (TrueCrypt is a pain). I'll also be releasing the tools and scripts I've developed along the way.

Read more »

How to hack millions of routers

How to hack millions of routers

Read more »

Remote Shutdown

Remote Shutdown

Read more »

How to Hack a Web Site

How to Hack a Web Site


In this first lecture of the Fall 2010 series, Dr. Loveland and her special guest Eve Hacker take you on a precautionary journey regarding computer security, with a talk entitled "How to Hack a Web Site". Adams State Computer Science Program: http://www.adams.edu/academics/compsci/index.php

Read more »

Hacking DNS

Hacking DNS

Level: Intermediate
Presenter: Eli the Computer Guy
Date Created: November 1, 2010
Length of Class: 45 Minutes
Tracks

Hacking
Computer Security /Integrity
Prerequisites

Knowledge of TCP/IP and Domain Name Resolution
Purpose of Class

This class teaches students how use DNS to redirect computer or network users to alternate websites or servers for security or malicious purposes.
Topics Covered

How DNS Works
Editing the HOSTS file
Alternate Public DNS
Planning a DNS Hack
Reasons to Hack DNS
Class Notes

Introduction
DNS resolves Domain Names to IP Addresses
Warning: Use at your own risk
DNS
HOSTS file is the local file that resolves Domain Names
Windows Location = C:\Windows\System32\drivers\etc
Example = 10.1.10.2 www.elithecomputerguy.com
In Vista/ Windows 7 First Open Notepad using "Run as Administrator" and then open the HOSTS file. Otherwise you will not be able to save your edits.
Computers FIRST try to Resolve a Domain Name with the HOSTS file, they then Go To the LOCAL DNS Server, and then they Query the PUBLIC DNS Server. If any server has a record the computer does not ask any other sources. SO if the HOSTS file has a record the computer uses that record and stops.
Using Alternate DNS
You do not have to use the Public DNS IP Addresses that your ISP gave you. You can use Alternate Public DNS Servers.
The benefit of using a server like OpenDNS.org is that they will prevent Domain Names for malicious websites from resolving. This is a HUGE security tool.
You can create your own Public DNS Server for Good/ Bad Purposes.
The DNS Attack
HOSTS file can be compromised either through manual editing, or through scripting. If users are logged in as USERS vs. ADMINISTRATORS there is far less chance that a script will be able to modify the HOSTS file.
By Wardriving or Plugging Into an Unsecured Network Jack You May be able to Hack the DNS Server. Routers/ Modems with default passwords are easy to Hack.
A clever, well disguised DNS Hack is very difficult to detect once it has been successfully implemented, and it is moderately difficult to circumvent if it is done by a network administrator to secure a network.
Final Thoughts
Hacking DNS is the EASIEST way to either protect or attack a network or computer

Read more »

Introduction to Hacking

Introduction to Hacking

Level: Beginner
Presenter: Eli the Computer Guy
Date Created: November 3, 2010
Length of Class: 68 Minutes
Tracks

Hacking
Prerequisites

None
Purpose of Class

This class gives an overview of what hacking is and what hackers do.
Topics Covered

What is Hacking and Who are Hackers
Legal Questions for "Ethical Hackers"
Planning an Attack
Ways to Attack
Protecting Yourself from Discovery
Class Notes

What is Hacking and Who are Hackers
Hacking is Non Convenenal Ways of Interacting with Systems
Hats -- Black is Bad, White is Good, Grey Depends on Who You Ask
"Ethical Hacking" -- is more a marketing term then anything else.
Reasons
Acquire Data
Impersonation
Destruction
Fun
Fog of Law
Corporate Privacy Policy
Who owns the SYSTEM is not the same as who owns the DATA
Beware of HIPPA and other Privacy Laws
Ways to Attack
Physical
Physically Enter a Building for Theft or to Open a Breach
Gaining Entry to a Building
Posing as Computer Tech/ Security
Be a Temp Employee
Hack systems internally
Leave a Device to Allow Hacking into Network
Planning Attacks
What do you want?
Mass Attack is where you go after as many systems as possible.
Semi Targeted attacks mean you go after a group of targets. Such as you attack companies that use a specific program.
Targeted attacks mean you single out a single company for attack
Protecting Yourself
You can be tracked, but it's not usually worth their time
Hack from an Internet Connection that is unattached to you.
Leave no trace on your system -- Temp and Log files will document your activities
Use compromised systems for attacks
Use prepaid credit cards/ phones for transactions and communication
RUN and deny everything if found out
Criminal Justice Funnel -- Approx. 2% of Criminals Caught Receive any kind of punishment

Read more »