Stupid Customer Tip #2

So, you have caught your son misbehaving. Maybe he killed an animal, looked at porn, his room is messy, or he has bad grades or something. Whatever. Has done something that requires you to swiftly and harsly punish him. You then suddenly remember that he has a computer in his room, and you can punish him by taking away his access to the internet.

If you switch the breaker on your son's room so he can't use his computer, but the modem and wireless router are also in his room, you won't be able to get online on your computer either because there is no power to these devices. Don't call your Internet Service Provider (or ISP) saying that their service is horrible, because you are just being too stupid to realize that you are an idiot.

This equipment shouldn't be in his room anyway.

Attacking a Time Warner Call Center

Last year, I mentioned that I would tell a true story of an attempt from someone in the Netherlands to break into a router at the call center I work at. As you already know, I took a years hiatus from this blog due to personal matters. Well, I figured I would tell the story as I wrote it to 2600 Magazine. They never published it, so don't look for it in any of the issues. **NOTE** All names and IP addresses have been changed to protect the innocent and guilty.

Attacking a Time Warner Call Center

I work for Time Warner Cable as a Tier 3 Technical Support Rep in a northeastern division of the company. The following is a report of the events that took place on a Friday evening while I was at work. It's about someone from Germany who tried desperately to get into a residential modem and router that are in the Time Warner call center I work at.

When I walked into work at 5:00 PM, I was thinking it was going to be a normal Friday night in the call center. I would take some calls, help some customers, and when 9:00 PM rolled around, I would go home. I didn't think that I would be fending off a German intruder trying to gain access to our router.

As Tier 3 tech support representatives, we are allowed to bring in personal laptops and connect them to various wireless networks throughout the call center. We use these for testing purposes and for added troubleshooting when we are talking to a customer on the phone. Therefore, we depend on these internet connections that are specially setup for the Tier 3's to use. Usually there is no problems connecting to them, but tonight was different. Tonight we were gonna be fighting to use them.

It started practically when I walked into the door. I had just sat down in my cubicle and logged into my work computer when I booted up my laptop. I got my work desktop all situated with the billing and service call system, Outlook, Firefox, and AIM. I looked over at my laptop and saw the Gnome log-on screen, so I logged into my laptop and opened up terminal once it had fully booted. I pressed Fn+F2 to turn on my wireless card configured my wlan0 card to the essid, "Isle A near DNOC" and ordered DHCP to give me an address. I opened up Firefox and I was unable to get a webpage.

I checked my IP address using iwconfig and I still had an IP, but I could not ping out. Thinking maybe the router got unplugged, I did a quick iwlist scan on my wlan card and there was no "Isle A near DNOC"; only "NETGEAR". Someone had done a full factory reset on the router. I stood up and talked to Garry who was sitting in the cubicle next to mine and asked him if he was having problems getting online with his laptop. He told me he was and then Jared walked over and said that someone was hitting the router with Denial-of-Service (DOS) attacks. We were actually getting DOS attacked from two separate IP's: 77.177.201.255 and 71.167.8.76

Using tracert in Windows, Jared was able to determine the domain names where these IP's were originating from. 71.167.8.76 was pool-71-167-8-76.nycmny.fios.verizon.net (out of NYC) and 77.177.201.255 was blfd-4db1c9ff.pool.einsundeins.de (somewhere in Germany). I asked him to give me the IP's and let me do nmap on them to see what ports were open on their end to see how we could send our own DOS attacks and get them to go away. The FIOS connection was easy, because we sent DOS attacks to him, and he just disappeared. Either he didn't know what he was doing, or he didn't care to pursue whatever was behind our router. It didn't matter though, because either way, we only one adversary was left to fight off.

This fight was not going to be quite so easy. While I was nmapping the attacker from Germany, Garry came to me and asked what the name of my computer was. I told him that it was Unr3a1r00t and he told me to stop DOS attacking the network. I asked him what he meant and he said that the log files on the router showed that DOS attacks were coming from my IP. Puzzled, I assured him that I wasn't and took a look at the log files. Sure enough the private IP address that was linked to my computer was sending DOS attacks. This could mean only one thing: the attacker from Germany was using the nmap connection that was made between us and either spoofed my IP, or was sending DOS attacks through the connection to make it look like they were coming from me. In addition, he started to use proxy servers to make it look like some attacks were coming from different IP addresses in different countries throughout the world.

I immediately stopped the nmap process and went over to Jared to tell him what had happened. He carefully watched the log file and saw as it grew that the attacker was not just making it look like attacks were coming from my laptop, but his as well. We were all very frustrated and perplexed how and why someone would be doing this. We knew at this point that we were dealing with somebody that greatly surpassed our abilities.

I came up with the idea to try and change the public IP address of the router, thinking that the attacker would potentially go away if he couldn't connect anymore using the original IP. So we switched which modem the Netgear router was getting it's internet from. Now it would get a totally different IP address and because the two modems were getting their connections from completely different regional switches, he would have to actually look at a different spot on the internet for the router. Unfortunately for us, literally within a few minutes of making the swap, he had found the router again. We knew this meant that he had to have found the router using it's MAC address.

He then proceeded to hit the router with everything he had. DOS attacks were coming from completely different proxies every other second. We had to constantly reconnect our laptops to the router and the internet was unbearably slow. He was able to get into the router and assign his computer a local IP address within our network. I quickly told Jared to change the router's management log-on password and gave him a 27 character password that had a combination of uppercase and lowercase letters, numbers, and symbols. It was at this point he was brute forcing the modems management log-on trying to get a remote connection. These attacks were coming in at one point, as frequenly as four times a second; from completely different proxy IP addresses that never once repeated.

Jared was constantly refreshing the log file and within five minutes, the attacker had already attempted to remote into the routers management system a few hundred times. We concluded the obvious fact that he had to be using some kind of bot that was able to change proxy connections every ¼^th of a second. Since the password that I came up with is very secure, for the time being he wasn't going to get in any time soon. Therefore, Jared took this time to look at all the configuration settings on the router.

It was now 9PM and we still really had no fully usable internet connection. Jared asked me if anyone had turned on UPnP. We never found out who turned it on, but we believe that it was this connection type that the attacker was using to try and get into our network. We came to this conclusion, because as soon as Jared turned it off, the DOS attacks stopped and there were no more attempts to log into the router's management system.

Now whether or not turning off UPnP was really the reason the attacks stopped, or because the attacker figured it was no longer worth the fight, could probably still be debated. The point was to try and get these attacks to stop, so we could actually use the wireless connection to troubleshoot for customers calling in. Jared sent me the log text files for me to try and find information on what exactly went down.

I concluded that the attacker was only initially trying to get into our router so he could use the connection for his personal use. When I nmapped him, it piqued his interest in trying to get in, because to him this meant that whoever was behind that router atleast knew halfway what they were doing. He knew he wasn't dealing with complete newbs because we blocked him from getting in and he was ready to face the challenge.

Once it was all done, I was able to go home. I told Jared I would look a little into the issue over the weekend and he said he was gonna do the same. The internet connection was fully restored and all was back to normal. The next day, we still saw some random DOS attacks on the router so we eventually just swapped it out for a different and better wireless setup. Since making the swap to a different modem/router, the problems have gone away completely.

We have since upped the security of the router and are taking measures to ensure that the log files are constantly monitored to avoid anymore intrusion attempts. I do have to say, that it was very interesting to see how someone who was essentially breaking into a network wouldn't care that he had been found out. Instead he actually chose to fight the people behind the router for access to a network he shouldn't have been accessing.

At this point though, it doesn't matter. I had fun playing with the attacker and I am sure it was fun for him to try and get in. We also learned a lot and that of course is always a good thing. Shout outs to Jared, Garry and Justin; you all know who you really are. Finally, a shout out to The Q 357 for just being a good friend and for helping me stay motivated.

Stupid Customer Tip #1

I am going to start posting a series of "Stupid Customer Tips" for those of you who are subscribed to a service of some kind (phone, cable, etc) but may not be the brightest light bulbs in the box. These tips are meant to HELP you understand a little more in a straight-forward in your face kind of way. Basically, these are customer bitch slaps for the absolute DUMBEST people on the planet. If you are a dumb customer of a service provider (again, phone, cable, etc) then please heed these tips.

If you do not have power in your home, it should come as no big surprise when your cable services do not work. Electricity is an absolute NECESSITY to power your cable equipment and any other electronic devices in your home (TV, computer, etc.). This is also why if you do not have electricity, your lights do not turn on. Now, as the cable company, we do not provide or control the flow of electricity to your home. Your ELECTRIC COMPANY controls this.

So if you are in the middle of a power outage, do NOT call your cable company and bitch and moan that 10-year old Jimmy cannot watch Dora the Explorer or that you are missing your precious soap operas. You will want to call your ELECTRIC COMPANY to complain about their service not working. Jimmy should be outside playing anyway, and you shouldn't watch soap operas; they are not helping your intelligence levels.

A Year and A Bunch of New Gadgets

So it has been more than a year since I have posted anything on here. There have been a lot of personal things that have happened over the last year. I will have more time now a days to post on here more often, so it should definitely not be another year before I post again.

So where to start? Well, around this time last year, I found out that my oldest sister had uterine cancer. Turned out to be lymphoma as well, but she had to have a hysterectomy done, as well as having to go through chemotherapy. She completed chemo about Feb of this year and so far she is still cancer free. Which is good. There have also been some very personal things in my family, that I will not go into here, but lets just say I now have a totally ass-hat of a brother-in-law who married my other sister. Can't stand him, but whatever.

In other news, I have also broken up with my girlfriend of 3 years. It was not working the way that I had hoped, and it was in the best interest of both of us to end it. I have begun to move on with my life, and I really hope she has done the same.

So now that those are out of the way, it's time to get to the new gadgets in my life. Hehehe. Lets, see, the list starts with a Xbox 360 purchased at a Circuit City earlier this year. I have since gotten Halo 3 of course, which I liked a lot. The multiplayer part of the game is definitely the best part of the game, however, Microsoft in it's infinite greediness forces you the player to download the first three map-packs released for Halo 3. This means that if you buy the game off the shelf, and go to play on Live, you will have to spend an additional $30 on maps in order to play online. Of course these maps will now be included with the upcoming Halo 3: ODST. I really hate M$.

Then I finally joined the HD class. I got a Sharp AQUOS 40” 1080p HDTV. Cost a pretty penny, but I definitely like it, and like looking at the nice HD picture while watching the Yankees on YES. It also goes good with my 360 cause now I can game in high definition, which is certainly helping me in CoD4.

Finally, I have also gotten a new computer to replace my old Gateway laptop. It is a Lenovo Ideapad S10 netbook. Has the Intel Atom processor, 1GB of memory, 160GB HDD with no CD-ROM and a 10” screen. It's really nice, and a solid little computer. I have actually since purchasing it back in.... February I think, gotten upgrades for it. First, I got a Rosewill external DVD burner for it, which is really good. I have also gotten a larger HDD, 500GB and upped the RAM to 2GB.

The most recent thing I have gotten for it, and for a computer I plan on building over the next year is a keyboard. It is the Happy Hacking Keyboard Lite 2. I purchased it from Amazon.com for around $90 after shipping. It is a great little keyboard with only 65-keys and I fucking love this thing. I will post a picture of it tomorrow with a full review on it. In the meantime, the Yankees are playing the Mariners, so I am going to go watch the game.

Hackers, Shitheads, Anonymous & Three New Fish…

So here I am, sitting at a community college in upstate New York waiting for my girlfriend to get out of class. It's been a while since I posted again, and again, I am sorry for that. Seems my life is constantly a big clusterfuck. Shit is always crazy in the life of Unr3a1. I turned 24, been working my ass off, went on vacation, and been dealing with some personal shit.

So I will start with the more useless news. I now am the proud parent of three fish. My girlfriend really wanted to get fish, so we went down to the local PetSmart to pick a few up. We got a starter kit that included a 10-gallon tank, tank filter, water conditioners, and instructions on how to care for the tank and the fish themselves. We then picked up some really pink tank rocks, a little mountain with a bunch of holes in it, and a fake plant. It looks ok, except the girly looking rocks at the bottom of the tank. The three fish we have are a Black Moore goldfish, a Calico goldfish, and then some gold and black one that I have no idea what the name of them is. My two crazy cats love to just stare at the fish in the tank and try to paw at them through the glass. And fish are a pain the ass to take care of. You gotta feed them, change the water in the tank on a weekly basis, make sure the PH levels of the water are normal… just a hassle. But they are interesting to look at, so for now they can stay.

So a guy on 4chan posted information that he got when he hacked into Governor Sarah Palin's personal Yahoo e-mail account. Of course you really couldn't call it "hacking" because all he did was reset the password on her account using public information. All he really accomplished there was showing how retarded Palin was by using information that was readily available to the public as her security information for password recovery. I mean, you work in a public position; why the fuck would you have your security questions ask you shit that I can Google? I mean, in her defense, I never even heard of her until she was announced as McCain's running mate, but even still. It doesn't take a rocket scientist to figure out that maybe you shouldn't use the date you met your husband when the date is on friggin' Wikipedia.

Besides exposing Palin's total lack of concern for proper security, the intruder in her account was able to take several screenshots of what he found. I will not post any links here, as I do not feel compelled to give the FBI any reason to shut down my site here. It is obvious that they shut down wikileaks because the site was mysteriously unreachable for almost 20 hours starting shortly after the information was posted. It has since been restored to an online status, but for a while there, it was touch and go…

The big thing about what happened is the individual who posted the information to 4chan entrusted that information to them. The whistle might not have been blown so quickly if had not been for some shithead who decided that it wasn't "right" to break into her account. While technically what the guy did was illegal; it was still the search for information. I mean it wasn't revealed until later, but for a while there people thought that Palin was using this Yahoo e-mail address so that she could hide behind privacy laws. So basically, for the future security of our people and to ensure that she wasn't using her personal email for governmental purposes, it was almost necessary to get in to see what exactly she was using it for. Now, the intruder admitted that she didn't have anything incriminating that would suggest that we should question her reasoning for using this address, so as far as I am concerned this should be considered a "no harm, no foul".

Also, the anon on 4chan who took it upon himself to be the good Samaritan by revealing to her and to the public of what happened fucked it up, which could have potentially made it a hundred times worse for Palin. She is lucky that Yahoo has a security feature that locks the account for 24 hours after too many failed logon attempts. According to Wired, when he posted on 4chan that he had changed the password to her account and alerted friends of hers as to what happened, he posted a screenshot of the email he sent to Ivy Frye, a Palin aide. In this email was the password that he had changed her account to; and the dumb white knight fucker didn't blotch it out. So everyone on 4chan saw the new password and tried to log into the account to change it again causing it to lock up.

Palin has since deleted the account from Yahoo and understandably so. She got pretty close to yet another scandal. However, I think that all of us can learn some valuable lessons from this whole debacle. First off, I think we can take from this, is that since it has also been reported that the Secret Service is investigating who broke into Palin's account, one should never break into any government official's email. Considering everything that has happened with Palin's e-mail address getting deleted, Wikileaks being shut down, the Secret Service being involved in finding out who did it, I would say it was a BIG no-no. Second, you should never trust anyone on 4chan with any kind of sensitive information (no offense anon). Last - but certainly not least - if one should try and be a hero and save the day, for shits sake make sure you smudge out the new password when trying to tell people to give up on breaking into the site. Palin's moron for a white knight fell of his high horse pretty damn quickly.

In different news, a hacker from the Netherlands tried desperately to get into a router in the call center that I work at. I wrote up the whole story, but since I am trying to get it published in 2600, it will have to wait to be posted here. They won't publish it if it has been published elsewhere and that includes my own blog. But as soon as I know whether they will publish it or not, I will post it here as it is a pretty interesting story. Until next time, please remember to try and not break into any politicians e-mail. It's bad joo-joo.

A New Book, Firefox 3, and Converting Girlfriend to Ubuntu... Maybe.

Wow, it has really been a long time since my last post; three months. A lot has happened since then and I am excited for the changes that are on the way. I mean, the editor-in-chief of 2600 is coming out with a new book, Firefox 3 was released a little while ago, Microsoft has dropped full support for XP... I mean a bunch of things are changing. It's crazy.

First and foremost, Emmanuel Goldstein, who is the Editor-in-Chief for 2600: The Hacker Quarterly magazine has written a book. It is called, The Best of 2600: A Hacker Odyssey and it basically tells the story of the evolution of technology, the Internet, computer related laws, and hacking by way of the articles that have been printed in the magazine in chronological order from the magazines inception in 1984. It comes out later this month, and I am really super excited about it. I will definitely be picking it up before I go on vacation.

So Firefox 3 was released a couple weeks ago, and of course I have updated to it and I must say that it is definitely the best version of the great browser to date. With a reported 15,000 security and performance updates, it is advertised as the fastest and most secure Firefox yet, and so far, it is proving to be so. The folks over at Mozilla decided to hold a “Download Day” to see if they can set a Guinness Book World Record for the most software downloads in a 24-hour period. I helped out in this number by downloading the application three times that day; once for me, once for my work computer, and once for my girlfriends computer at home. The final number was over 8 million downloads in a 24 hours. Which is awesome. I think IE just lost some market usage. The world becomes a better place as more and more people move from Microsoft to open source options.

So a few weeks ago, I was talking with my girlfriend about possibly switching her over to Ubuntu Linux. She is very reluctant because she is afraid of the unknown. I told her that Ubuntu could do everything she would need it to do. So, I asked her if I could see if I could get Ubuntu setup with everything that she would need from it. She said yes, but that even if I do show her that it can, she would not guarantee that she would actually allow me to install it on her laptop. Oh well, one can dream. But I am getting it to work how she would need it to, which is good. So maybe she will let me install it on her laptop; we shall see. I mean, everything is already in place.

I was really surprised to see that Ubuntu natively supports and recognizes the Apple iPod. It has a great default application to add and manage music on the iPod, Rythmbox, which in almost every aspect, is just a Linux clone of iTunes. The only things it cannot do is access the iTunes music store, or access any firmware updates that Apple may have released for your version of the iPod. However, it does automatically download the album art work for any albums you have, and there is another iPod application you can download, GtkPod, that can automatically delete any duplicate music it finds on your iPod. The only thing I really gotta get working now, is Office in Wine. I think if I can get that working in Ubuntu, she would be convinced to make the switch. Gotta keep at it though.

Finally, in other news, Microsoft, has finally stopped allowing PC manufacturers such as Dell, HP, and Gateway, from selling OEM versions of Windows XP to customers. As I am sure everyone already knows, Vista was released last year. What you might not know, is that it had a lot of problems when it was first released, and because it was to terrible, and demand from not only home consumers, but also businesses, was so high for Windows XP licenses rather than Vista ones, Microsoft allowed manufacturers to continue to offer laptops and desktops preinstalled with Windows XP. Well, Microsoft finally pulled the plug on this, and now the manufacturers are only limited to installing XP by default on the micro PC's – those PC's that are extremely small, with not a lot of RAM or HDD – that have begun to be really popular in the last few months. While I can initially understand this from a business prospective, I can't help but think that this is really such a damaging move for Microsoft to make. I mean, don't get me wrong, I am happy about it, but how can it be that Ballmer is continuing to make these mistakes? It has been almost a year and a half since Vista's release, and people and businesses are STILL opting to purchase Windows XP machines over Vista ones. Why would Microsoft think that it is safe to stop allowing manufacturers to sell them? Makes no sense to me whatsoever. Oh well; hopefully they will continue to make these mistakes and Linux can take over.

I will be moving soon, so I really don't know how often I will be able to update the site for the next few weeks, but I will try to be on here from time to time. I will definitely be updating on the whole girlfriend running Ubuntu, though.

Ultimate Star Wars Fanboy Movie.

Of course, every Star Wars fan has heard of this movie. I forgot about it for the longest time, because it has been literally 10 years in the making. I first heard about it 8 years ago from a friend who was all excited about it. I haven't even thought about it in probably 3 of those 8 years because I have not heard any new news about it. Of course, until now. The movie in question is Fanboys. It is what they call the "ultimate Star Wars fan movie".

Set in 1998, it centers on a group of friends that go on an adventure across the country to break into George Lucas' Skywalker Ranch and steal a copy of Episode I: The Phantom Menace before it hit theatres. So why is it in the news? The reason is because the production company that funded the film is now trying to change a key element in the plotline. The original plot had a character with terminal cancer that is a major Star Wars fan. It is for him, that his friends embark on their quest to break into George Lucas' ranch. They are unsure if he will live to see the movie in theatres, so they want to get it for him so he can watch it before he dies.

The Weinstein Company, who is distributing the film under Miramax, is unsure about the cancer plotline. Steven Brill, who was brought in to do reshoots and re-editing of the film said, "It would be irresponsible to release it." The film company is unsure how they will be able to make people laugh in the movie theatre after the mention of cancer.

A very large online protest has been formed and you can read about all the news on it here: Stop Darth Weinstein! I of course agree with their feelings on this. I think that the move should be released with its original plotline. Two reasons I feel this way, is one that I don't like political correctness, and I feel that this is what it is ultimately about. The movie studio does not want to feel responsible if people who have cancer are offended by the movie because they may see it as "making fun" of people who are dying from cancer. Also of course, they wouldn't want to lose money by people not going.

The other reason is that they didn't come up with a good alternative. They just reshot the movie with no mention of cancer. So it will seem as if these guys just woke up one day and felt like stealing the movie. While yes, it might still be really funny, I think that it would take away a whole depth to the movie. What's interesting is that Ernie Cline, who wrote the original story for the movie, realized what the movie industry can do. "Unless you're putting up all the money yourself, making a movie seems to be an endless series of compromises," he said. "It's hard to know what that means until you actually go through it. The Weinstein Company can do whatever they want. They put up the money. But it is against our wishes and it's done purely for monetary reasons. The cancer version had heart. It's now a forgettable road comedy with no heart and no soul."

We'll see when the movie is released what is going to be done about it. Hopefully the original plotline makes it to theatres. Support the cause!