Small Bone To Pick With Hak5

Back in September I mentioned that I went to Toorcon, which is a San Diego hacker convention. There I met Darren Kitchen and Shannon Morse from the fairly popular IPTV show Hak5. When I met these two guys I mentioned to them that I was going to be writing a final report for my Advanced Network Security class in college. It was going to be my final report and presentation before I graduated with a Bachelors Degree in Network Security.

Anyhoo, Mr. Kitchen told me to keep them posted on how my paper and report turned out, so I decided to go ahead and sign up for the Hak5 forums so I could participate in the community a little, as well as post about my ideas for my paper... and I did on October 6th here: (Hak5 Forum Post)

Basically I did my paper on running Jasager in conjunction with Sidejacking, and told the community at Hak5 about my idea for my paper.

Okay, so no big deal right?

WRONG!

I just popped on my Tivo to watch a little Hak5 while working out on my total gym when Darren begins talking about Jasager and how people have been asking what it can be used for. Here is a clip from that episode where he proceeds to tell people about my idea:



The full episode can be seen here: (Hak5 Episode 412)

Did you notice anything missing from that segment? HOW ABOUT A FRIGGIN' SHOUT OUT? How about a nice little, "El Di Pablo From our forums gave us this idea..." or a nice little flash on the screen "Thanks EDP!"

Alas... Nothing, zip, zilch, nada.

Not a single mention in the credits, or even a blurb in the show notes.

What gives Hak5?

What do you guys think? Too harsh? Should I calm down a bit? Anyone from Hak5 want to comment? Anyone from Revision3? Hit me up in the comments please.

Read more »

Side Jacking With A Hamster And A Ferret

A new mod started at school this week. For you not in the know, a mod is what we call a semester at my college. It is short for module. They call it that because our semesters are only 10 weeks long, and we go year round without breaks (Except two weeks at the end of the year).

Last night I had my first class in Security Policies and Procedures. In that class our teacher starts out with current events related to security. One of the things he mentioned which I though was really cool was a relatively new method of hacking your accounts and stealing your goodies. This method is called Side Jacking. The term is so new, I couldn't find anything about it on Wikipedia (Can you believe that?). I did find something on Webopedia.com about it though. They describe Side Jacking as a:

Term used to describe the malicious act of hijacking an engaged Web session with a remote service by intercepting and using the credentials that identified the user/victim to that specific server. Typically, SideJacking is most common on sites that require authentication through a username and password, such as online Web mail accounts as well as social networking sites. SideJacking works only if the site catches a non-SSL cookie, so any Web site that uses SSL exclusively would be safe from SideJackers. SideJacking was first demonstrated by Robert Graham, CEO of Errata Security at Black Hat in 2007.

So basically, you are sitting at Starbucks. You and a bunch of other latte drinkers are sipping away typing away on your laptops. The difference between you and them is that you are basically sniffing their web browsing and mirroring their cookies, and sessions. Once you have all of their cookies you simply browse to Gmail and bam! You are in their email! Pretty cool huh?

Another thing that I find interesting is that the tool to do this is made for Windows! Most hacking tools are made for Linux. At least the really cool ones are. Not this one though! You can download both Ferret and Hamster (The tools used to do this hack) here: (SideJack.Zip)

Here is a video tutorial showing you young hackers how it's done:



Have any of you heard of this before? Better still, have any of you tried this? Let me know in the comments! I am breathless with anticipation.

Read more »