Transfer Files and Data via DNS-Requests

Most of you might know dnstunnel. Johannes Ullrich from Sans lists a poor mans dns-filetransfer using xxd which i think is a nice idea working on most unix boxes for xxd seems to be commonly installed.

How Egypt cut itself off - and how it got back

Heise.de hosts a nice video derived from bgplay showing how the egyptian BGP-Routes vanished.

http://www.heise.de/newsticker/meldung/Aegypten-Massenproteste-gehen-weiter-Update-1181273.html (sorry - much german text, but the video speaks for itself...)

Ripe also has some static infos here: http://stat.ripe.net/egypt/

Egypt is currently coming back on the internet, see a video of the newly announced routes here:
http://www.heise.de/newsticker/meldung/Aegypten-ist-wieder-online-Update-1182195.html

The situation in Egypt and the currently proposed "Internet-Kill-Switches" throughout Europe made me think. In the days before Trumpet Winsock i used to be a FIDO-Net-Point, polling twice per day via modem. Maybe it's time to wipe the dust of the old sportsters and see, if we can remember the basics of the AT Commandset and if the boxes are still working, even without a serial card with a 16550-FIFO.

I wonder if FroDo2.02/FastEcho still run within a WinXP Commandshell. And if there is any local Fido-Node supporting Modem Calls left...

For those willing to try: http://www.softeq.de/old/Download/download.html

tom

Why unsolicited reporting of vulnerabilities is a bad idea

Almost all young hackers come at some point of their hacker-life to the conclusion that finding and unsolicited reporting of vulnerabilities would be a fine idea:

The owner of the website might be thankful or even hire the young hacker to check the site further or fix the vulnerabilities.

Almost everyone in the IT-Sec-Business I know had this idea - and most of us learned the more or less hard way, that it is in fact a bad one. Not all potential customers are nice people. And be honest: Would you really hire someone who did an unsolicited hack of your infrastructure?

Some "IT-Sec-Professionals" take longer to learn their lessons - I remembered my own experiences when I read about Chris Russo and his plentyoffish-hack.

In my opinion both partys made mistakes and are leaving a really bad impression in this case. Maybe something to learn from, regardless on which side of the net you work?

Some of the comments over at slashdot http://slashdot.org/story/11/01/31/1856202/PlentyofFish-Hacked-Founder-Emails-Hackers-Mom are worth reading.

tom