CONGRATS TO SHADOWDRIFTER!

Congrats Shadowdrifter!

One of our writers, Shadowdrifter, has made an outstanding article about hacking Audix systems. His article was recently published on a hacking security website called mrcracker.

Here is just a little taste of the article

So as many of you know cell phone voicemails are incredibly insecure. Now for reconnaissance this isn’t useful when you are gathering information on big companies. Mostly due to the fact that employee cell phones are often private. When doing reconnaissance you should always be aware of the information you have already found, and how it can be used. Thats where an employee directory comes in handy. Many top businesses use the Audix voicemail system so knowledge of the system is invaluable.

So, head on over to mrcracker to view the article now. Again, congratulations Shadowdrifter!

Simple coin flip simulation.

By simple coin flip simulation I am meaning that I created a program with Python to "simulate" flipping a coin 100 hundred times which then returns the result. It is a simple program using list, and the random module built into Python.

import random
# Assigning the variables
i = 1
h = 1
t = 2
lit = []
lih = []
# Starting the loop
while 101 > i:
# Random function to select 1,2 to represent heads and tails.
data = random.randint(h,t)
print data
i = i + 1
data = int(data)

if data == 1:
lih.append("1")

if data == 2:

lit.append("2")

e = len(lit)
e = str(e)
f = len(lih)
f = str(f)
print 'You flipped tails ' + e + ' ' + 'times ' + 'and ' +  'You flipped heads ' + f + ' times'
raw_input()

This is just an example of what you can do with very simple functions, and just a few lines of code.

PODCAST : Episode Four - Dead Drops

In this episode Clocwork briefly talks about Dead Drops.

Router Hacking.

Todays post is on router hacking. I am not going very indepth on how
to hack routers. I will just be going over a few ways to find unsecure routers, and poorly configured routers
The simplest way is to just gain access to the network, and go commonly to
192.168.1.1 for the router page. You will encounter routers without passwords, but you should learn some of the most common
default passwords for routers just in case.

Common default passwords for any router username:password:


admin:admin.
admin:password.
admin: no password.
nothing in either username nor password.
admin:guest
guest:password

Those few password combinations will be the most commonly used. I personally used admin:admin just the other day.
Now we have logged into router so what can we do? Well the first thing we can do is enable remote management ( Remote management is the ability to control the router from a remote location); it is different
for each router, and some do not even have the option.  If you do happen to find the option; you will need to change the default
password, and make sure you allow your I.P address to connect. This is all very self explanatory when you are familiar with routers.
By the end of this post you will be well on your way to becoming an expert at router configuration.

Now its easy to find routers from just finding secure, and unsecure wireless networks to try and access. There are a lot of
routers that web interfaces are actually indexed in Google! So with a simple Google dork we can find dozens even hundreds of unsecured routers
just waiting for someone to experiment with.

Google dorks to find routers:

intitle:"SpeedStream * Management Interface"      ( Speed Stream routers )

intitle:"Setup Home" "You will need * log in before * * change * settings"  ( Belkin routers )

intitle: "actiontec" main setup status " Copyright 2001 Actiontec Electronics Inc"


Those three dorks should keep you busy for quite some time. Now there is one more method that is hit, and miss really.
If you happen to find a target. Port scan them, and look for port 23 which is by default Telnet. There are a lot of off the shelves routers with telnet
active with only the default passwords in place. Which are very similar to the default router passwords except for a select few.

Default Telnet router passwords:


guest:guest
guest:password
user:guest
admin:guest

That is all for now; may your blades stay sharp, your mind sharper! Shadowdrifter.

Using the Bystander Effect

The term bystander effect refers to the phenomenon in which the greater the number of people present, the less likely people are to help a person in distress.
- Darley, J. M. & Latané, B. (1969). Bystander “apathy.” American Scientist, 57, 244-268.

      The Bystander Effect, although a phenomenon, can have some practical use in Social Engineering. 


PLEASE NOTE: This effect will not happen every single time as there are good people in this world that are willing to help those in distress. We do not condone using this for illegal purposes, this post is only for information about psychological phenomenon. 

     Standard tests done by many psychologists involve the use of an injured victim laying in the middle of a busy side-walk. Passers-by simply ignore the injured person and continue walking no matter how much the person in distress is moaning. Occasionally, someone will confront the injured victim and ask if he or she needs any assistance. The number of people that actually help is very slim when compared to the number of people that simply continue walking.


     Most psychologists say this is because people are lazy, other psychologists say that its because no one else sees the distressed person as a priority, so it must not be that big of a deal. Others, including myself (even though I'm not a psychologist) say that they simply avoid the distressed person because they think the person could be pulling a con. However, keep all of these points in mind, as they could be useful for a Social Engineer. 


     Lets say someone gets pick-pocketed. They start to fuss, they make a big commotion, and they tell people to stop the pickpocket. Now lets say that you had a group of people just walk by the distressed person completely ignoring him. There is a high chance that everyone else around the distressed person would do absolutely nothing simply because no one else was doing anything. 


     In theory, a group of pick-pockets could go around and steal purses, wallets, sunglasses etc. in the most non-secretive way possible and they would be able to get away with it (so long as the victim doesn't start chasing after the pick-pocket). 


     A Social Engineer can use this effect in many ways to get away with certain crimes. The biggest factor is the number of people that the Social Engineer has with him. If there's a smaller number of people, the less likely it is that he will get away with his con. The larger the number of people, the easier it will be to get away with it. 


So ask yourself, if you saw someone in distress, would you help them? What if no one else was helping them, would you still help them, or would you just walk away?


Thanks for reading,
- Clocwork

PODCAST : Episode Three - Phreaking

In this podcast we discuss different types of phreaking methods, and you get to hear a prime example of Social Engineering from Ian.

Clocwork Hack Diary : Random Mischief Part One

Posted From My Droid

I feel like I've been getting too soft lately, like I haven't done anything really mischeivious. So, I've decided that I'm going to be doing random acts of mischief until I'm satisfied. Currently, I'm seated in a lawn chair on the porch of another person's house smoking a cigar and watching some birds fight over seed in a bird feeder. To make it more interesting, the person doesn't know I'm here, and I don't know the person at all. I hope they don't show up, but, I need some water, and I know where to get it.



Now I'm seated in a chair at some private pool area. Just got a drink of water from the water fountain out here. Some just yelled at me and told me to leave, I'm telling him I needed some water. Walking over the water fountain again. Water just shot in my face, lol. Just got some water, the guy is still staring at me. About to hop the fence and continue with my running. Since today is Friday and tomorrow is Saturday (and Sunday comes afterwards, Rebecca Black reference bitches) I'll probably do some more mischief then. But, I gotta get home and upload the next podcast, gotta run about 3 miles back and then I'll post it.

Thanks for reading,

-Clocwork

P.S. That guy stared at me the whole time I wrote that last message, now his kid is staring at me. Oh well, I just needed some water