mirror of
https://github.com/fdiskyou/Zines.git
synced 2025-03-09 00:00:00 +01:00
587 lines
31 KiB
Text
587 lines
31 KiB
Text
==Phrack Inc.==
|
|
|
|
Volume 0x0e, Issue 0x43, Phile #0x10 of 0x10
|
|
|
|
|=-----------------------------------------------------------------------=|
|
|
|=----------------------=[ International scenes ]=-----------------------=|
|
|
|=-----------------------------------------------------------------------=|
|
|
|=------------------------=[ By Various ]=------------------------=|
|
|
|=------------------------=[ <various@nsa.gov> ]=------------------------=|
|
|
|=-----------------------------------------------------------------------=|
|
|
|
|
Look at the last Phrack issues.
|
|
Look at 2010 security CONs.
|
|
Look at any kind of public activities involving hackers.
|
|
|
|
West Europe, North America, Asia are shining. No need to run an agency to
|
|
see that and sharing informations with the according scenes is child's
|
|
play. But what about sharing with other countries?
|
|
|
|
For the 25th birthday of Phrack, we're very proud to present you two
|
|
oustanding scene philes. One will describe you the hacking scene of the
|
|
amazing India which can't be ignored anymore on the IT playground. The
|
|
other one will describe the Greek scene. Yes you've heard of them through
|
|
blog posts, CONs and even Phrack. You simply didn't pay attention ;)
|
|
|
|
Enjoy the reading of this phile.
|
|
|
|
-- The Phrack Staff
|
|
|
|
|
|
---
|
|
|
|
The Indian Hacking scene
|
|
Unofficial memoirs of the Desi h4x0rs
|
|
By anonymous null community member
|
|
|
|
1. Preamble
|
|
2. Introduction
|
|
3. Hacker Groups
|
|
4. Hacker Cons
|
|
5. Memoirs of the underground
|
|
6. Future
|
|
|
|
--[ 1 - Preamble
|
|
|
|
Jai Jawan Jai Kissan
|
|
(no it has nothing to do with the song Jai Ho :-P, just felt like writing
|
|
something in Hindi). This article is a composition of interviews with/text
|
|
directly taken from the hackers in the Indian underground (and the
|
|
above-ground :-P). If it offends the reader in anyway.........feel free to
|
|
complain to your mom about it:-P.
|
|
|
|
--[ 2 - Introduction
|
|
|
|
Before I start I must admit that we have been really really late in the
|
|
hacking scene as a whole. Some say it has to do with the cultural ethos and
|
|
the prevalent business culture in India, while some propose that Indians
|
|
culturally have been known as non aggressive & peace loving (Doh! Yeah
|
|
right..Like the F#@$ing stereotypical dumb Indian characters in hollywood
|
|
movies) and focus has been on ethical hacking and creation of software to
|
|
benefit world at large rather than cause destruction. The activities of
|
|
hacker groups started to emerge with the beginning of year 2K.
|
|
|
|
--[ 3 - Hacker Groups
|
|
|
|
There have been many hacker groups in India since 2k. Some are noted for
|
|
their notorious behavior.
|
|
|
|
1. Indian Snakes. Indian snakes was a closed underground community of
|
|
hackers who were on the top of the scene in the early 2000s. They are
|
|
also noted for the YAHA worm that they had written.
|
|
2. hacking-truths.net (2005-2008) stopped because of personal problems.
|
|
Restarted in 2010. Activities malware dev/hacking.
|
|
3. h4cky0u. It started around 2003 Website: h4cky0u.org. The activities
|
|
included defacing, exploit dev, botnets etc. It died in 2006 due to
|
|
some personal differences between the staff. It was reopened as
|
|
h4ck-y0u, sadly h4ck-y0u also stopped after one year of its existence
|
|
due to cyber crime activities, financial issues. H4cky0u was started
|
|
again by an American who went by the handle "Big Boss" and we haven't
|
|
heard much about it after that.
|
|
4. n|u (null security community). It started in 2008 and has spread to 6
|
|
cities in India namely Bangalore, Pune, Delhi, Mumbai, Hyderabad and
|
|
Bhopal. Their activities include vulnerability research, exploit dev,
|
|
projects, disclosures, nullcon hacker conference. It is more of an
|
|
OWASP style community sans the limitation of only web app security
|
|
research. It is also registered with the Govt. Of India as a non-profit
|
|
organization.
|
|
5. Andhra hackers. Started in late 2000s. It is a forum like portal.
|
|
Activities include sharing security information.
|
|
6. ICW (Indian Cyber warriors) is an off-shoot of Andhrahackers and
|
|
started around 2008. This is a hactivist group with activities
|
|
including defacing Pakistani websites.
|
|
7. Securitytube.net. It is not a group per se. It is a portal that has
|
|
lots of security videos, question/answer section much like
|
|
stackoverflow. It was started somewhere around 2008 or 2009.
|
|
8. Indishell. It started in 2009. The main guys behind indishell are
|
|
Lucky, mr. 52, jackh4xor, silentp0sion. It is again a hacktivist group
|
|
and majorly into defacing pakistani websites. It was recently stopped
|
|
due to some unknown issues and has re-emerged at the time of writing
|
|
this article. Activities include defacing websites.
|
|
9. ICA (Indian Cyber army) is an off-shoot of Indishell with mostly the
|
|
same staff as Indishell. It is also a defacer group. Noted for defacing
|
|
sites including Pakistani ISP national telecommunication corporation
|
|
pakistan (Defaced page http://www.ntc.net.pk/news.html)
|
|
10. Fake ICA. There is yet another ICA (cyberarmy.in) which is announced as
|
|
fake ICA by the actual ICA group. One glance at the website content
|
|
tells you that there is some truth to what the actual ICA(indishell)
|
|
guys and other say and reminds you of the infamous plagiarism cases
|
|
(Ah! Any Indian h4x0r's favourite topic when they feel like bitching
|
|
about something :-P)
|
|
|
|
--[ 4 - Hacker Cons
|
|
|
|
1. ClubHack. http://clubhack.com The first in the series of hacker cons.
|
|
It is held in Pune, one of the software hubs in India. It started in
|
|
2007 and is running it's 4th edition this dec (2010).
|
|
2. nullcon. http://nullcon.net The first community driven hacking
|
|
conference, organized and managed by null community members. It started
|
|
this year and the next edition is in Feb 2011. It is held in Goa. The
|
|
party hub of India.
|
|
3. Cocon. http://www.informationsecurityday.com/c0c0n/ 1st edition held in
|
|
Aug 2010. earlier held as part of information security day. It is held
|
|
in Cochin.
|
|
4. Owasp + Securitybyte Appsec Asia http://securitybyte.org. More of a
|
|
corporate conference with the suited people around :-).
|
|
|
|
--[ 5 - Memoirs of the underground - By dot
|
|
|
|
|
|
=[ Past.. that's where all the nostalgia and fun lies :)
|
|
|
|
So it all started sometime during late 2001 when a new variant of Yet
|
|
Another "Hello World" Application spread rapidly via mostly social
|
|
engineering mails and Outlook Express invalid MIME type exploit (similar to
|
|
Klez.?). AV technology was not really matured back then, Kaspersky was not
|
|
there with its PDM modules or its emulation heuristics, Symantec did not
|
|
conceived SONAR or its Reputation Technology, it was practically open
|
|
season for anybody with some programming skills to write and spread a
|
|
successful worm. But amazingly a very nice and simple HTTP ping module was
|
|
built into the program which used infected systems to ping (simple GET /)
|
|
certain government website across the border towards the friendly
|
|
neighbourhood creating a DDoS condition. News !!! News !! News !!! Cyber
|
|
War between two countries.. Beware! iNDian sNakes are here !!! Hackers
|
|
hacking each other's websites. Unicode double escape? Front Page is cool,
|
|
lg7 (but where is the pass? :P)? dtspcd? little they knew, early stage
|
|
script kids playing with public tools and little common sense without basic
|
|
computer science background.
|
|
|
|
I don't speak for the unknown elites before me who might be able to
|
|
represent the scene in a much better way than me leaving me to a
|
|
1337-wannabe state.. I don't even speak for the Indian Snakes guy(s) who
|
|
taught me quite a lot during my early days but I think we started quite
|
|
late. Aleph1 had already written about how to smash the stack, Solar
|
|
Designer had already found and exploited a heap overflow bug, Format String
|
|
exploitation technique was also known among multiple circles, the world was
|
|
filled with 7350*.c.. But fortunately Security Industry was not there yet
|
|
or at least not so prevalent in this part of the world. We are lucky to be
|
|
driven by the curiosity hormones to explore the black arts of hacking which
|
|
ofcourse later turned out to be obvious computer science with a bit of
|
|
innovation and passion to solve difficult problems. I remember playing with
|
|
some MSN Trojan to steal passwords, I remember installing Barok in various
|
|
Cyber Cafes, I remember installing Red Hat 6.2 and feeling elite after I
|
|
could connect to my dial-up internet and browse the web, infact I remember
|
|
doing almost everything for being a perfect script kid. I also remember
|
|
finding myself neglecting everything in life and reading Phrack during all
|
|
those sleepless nights.. Smashing the stack, Voodoo Malloc Tricks, Once
|
|
upon a Free.. Then after sometime actually solving PTP/0xbadc0ded
|
|
exploitation challenges and hanging around with those awesome and nice
|
|
people in their IRC.. but that was kind of late, a bit surpassed the prime
|
|
time for ideal initiation.
|
|
|
|
So getting back to the history part, here is how it goes: If you write a
|
|
worm and leave an e-mail address in messages it drops, you are bound to get
|
|
a lot of fan/hate mails. It is actually a good methodology to build a
|
|
community of rebels (??) or oh well people who liked Fight Club :) I think
|
|
the creators of Yaha did not initially expected to build a community, their
|
|
entire purpose was to retaliate to web defacer groups like G-Force, AIC
|
|
etc. but they actually ended up building a small and highly closed/private
|
|
community and am happy to have known few of them. Although we had some
|
|
Israeli friends (hi root, hi dak :)) the privateness of the group actually
|
|
created a problem, we were starved ! Defacing seemed boring, writing
|
|
exploits for public vulnerabilities were fun but quite challenging at that
|
|
time, their weapons were old and obsolete. So we decided to look around and
|
|
the obvious result was #darknet :)) Haha.. dvdman, nolife and the massive
|
|
list of ops there. Immediate learning from #darknet was to idle in #phrack
|
|
as well for possible 0day drops :P.. Next learning was to read ~el8 and be
|
|
an anti-establishment, anti-security-industry h4x0r !! Armed with newly
|
|
made l33t friends and their dropped exploits (yo! we had 0days..) it was
|
|
time to restart the so called cyber war in retaliation to multiple groups
|
|
spreading anti-India propaganda via defaced websites.. thus born "Indian
|
|
Hackers Club" :) Along with a new group name, an IRC server was created on
|
|
a box with 128kbps or so ADSL line at a friend's (hi rex) work place (truly
|
|
BoFH) which later got shifted to a .il server. We began meeting like minded
|
|
individuals and groups... came across with Cyber Yoddha, Hindustan Hackers
|
|
Organization (IIT had massive resources for hacking huh? :P), Emperor (baap
|
|
of all h4x0rs? :)), Nirvana (our own govboi :D) and slowly our IRC idlers
|
|
list grew. Just like any other similar IRC, we began exercising power,
|
|
control and ego... Ops were considered to be l33t, +v dudes were considered
|
|
decent and the rest were considered to be wannabe creatures for the
|
|
operator's show off needs.
|
|
|
|
Then came the day of IIS WebDAV vulnerability: Kralor probably wrote the
|
|
first public exploit which we took, modified it to support different
|
|
shellcodes, tested it extensively and developed an internal kiddie friendly
|
|
version and so began a moderate scale defacing of friendly neighbourhood
|
|
websites and confrontation with FBH (Federal Bureau of Hackers later turned
|
|
Federal Black Hats (too much PHC influence?)). Netcraft was used to find
|
|
suitable targets then instant connect back shells and tftp in the backdoor
|
|
and defacement page :) Later I learned FBH guys also used the similar
|
|
vulnerability to deface Indian websites during that time however they
|
|
either wrote or managed to obtain a mass rooter version of it.
|
|
Unfortunately (perceptions change with age though) we didn't really have a
|
|
lot of CVV2s back then else we could have also used techniques like: buy a
|
|
shared web space on target box and use kernel exploits (ptrace_kmod fun!)
|
|
to root and deface for l33t show off. But yes, we would like to laughingly
|
|
say we pwned r4t's brand new shell server before the h0no guys using
|
|
trojaned exploits.. err oh well, we pwned a lot of funny people with
|
|
trojaned/fake exploits. I remember once dec0der @ #ukr (or something i
|
|
forgot) told me that I change boxes like he change underwares considering I
|
|
was logging in from brand new boxes every other day.
|
|
|
|
Later on many of us made friends with people at #darknet, #m00, #c/c++ and
|
|
even some old timers from #phrack. One of the funny moments happened when I
|
|
was working for an .eu company along with another guy hired by them and
|
|
after working for a few days I found that guy is dvorak.. and we had a nice
|
|
laugh.
|
|
|
|
So all in all, during my time, the underground here in India was very small
|
|
and pretty much a closed group. Although we saw a couple of guys popping up
|
|
with security forums or websites once in a while we never really interacted
|
|
too much. We made a lot of friends world wide but the state of underground
|
|
here during those days was no way significant compared to .eu or .us.
|
|
|
|
|
|
=[ The evolution.. Towards sanity
|
|
|
|
The Last Stage of Delirium (LSD-PL) changed many of us! The 5th Argus
|
|
Hacking challenge, the Solaris LDT bug (reminds me of http://git.kernel.org
|
|
/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=dc63b52673d71f9d
|
|
49b9d72d263a9f32df18c3ee) exploitation writeup, Win32/Unix Assembly
|
|
Component Development, JVM Vulnerabilities etc were awesome and inspiring
|
|
(yea I remember GOBBLES too :)) We decided its time to grow up and learn
|
|
something real. Enough of (0xc0000000 - blah blah) type local stack
|
|
overflows, enough of exploitation challenges (PTP was good.. ok!) and thus
|
|
we created a so called Research Team with a website and a bunch of exploits
|
|
written for public vulnerabilities. Proving lighthttpd header folding bug
|
|
to be exploitable was an interesting achievement (Securityfocus initially
|
|
ranked it as DoS only). Learning about exploitation techniques for NULL
|
|
pointer dereference kernel bugs from an .eu friend and realizing the
|
|
obvious sometime before the first public exploit posted on DailyDave list
|
|
was also something to remember. Goin a bit back in the history, one of us
|
|
worked on a hobby OS project (based on Bach's Design of Unix OS) which
|
|
actually made rest of us (at least me) learn a lot and spend a lot of time
|
|
on websites like osdever.net etc to learn something real, learning to debug
|
|
an OS kernel was something which helped me solve a lot of problems in later
|
|
days. Finally reached a state where the Intel Manuals seemed to be useful.
|
|
|
|
Starting from 2005 onwards or so, Security Companies started getting
|
|
prevalent here, through various contacts an IPS startup contacted many of
|
|
us for job offers. It was my early college days back then so I could not
|
|
consider but others went ahead and that was probably the first time many of
|
|
us learned to go ahead with bigger and better things in life like having a
|
|
full time security job or in other words hack even when it doesn't makes
|
|
you happy, although yes much later we learned hacking at workplace on a
|
|
daily basis is an opportunity which is not easily achievable not just in
|
|
India but throughout the world... oh I must also mention, by now we learned
|
|
to use the word "hack" in a bit more "generic" and "abstract" sense :D
|
|
|
|
|
|
=[ Present.. The era of selling out..
|
|
|
|
Just like anywhere else, Security Industry is pretty much here now. A lot
|
|
of security startups and moderately matured companies has been developed
|
|
here working on consultant driven pentesting to security products
|
|
development etc. Most of the old guys are either working either for some
|
|
Security company or working as programmers in some software development
|
|
company. As far as I know, there is no significant underground here
|
|
although there are people who are pretty much involved in interesting stuff
|
|
but at a different scale in multinational groups. Web Application Security
|
|
is so hot these days that I see most of the younger people are focusing
|
|
totally on Web Application security vulnerabilities without looking into
|
|
lower level software security.
|
|
|
|
--[ 6 - Future
|
|
|
|
The recent shift in the mind set of some of the Govt. intel agencies
|
|
towards opening up to the hacker community has brought about a lot of
|
|
changes in the hacker scene in India. This collaboration is only going to
|
|
increase the moral of the hacker community and thereby also helping the
|
|
govt. in it's own way. As I mentioned we started a little late which is
|
|
applicable for the Govt. as well, but as they say - better late than never.
|
|
Things have started to pick up and we will see more of intel-hacker
|
|
collaboration in the future which may prove to be good/bad for some, but
|
|
yes the intent is to establised cyber warfare strategies and action plans,
|
|
which we will start to see in the next 5 years.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
An overview of the Greek computer underground, part 1
|
|
by two (not really) anonymous G(r)eeks - anonymous_gr@phrack.org
|
|
|
|
|
|
--[ Table of contents
|
|
|
|
1 - Introduction
|
|
2 - Present
|
|
2.1 - GRHACK
|
|
2.2 - Meetings
|
|
2.2.1 - 0x375
|
|
2.2.2 - AthCon
|
|
2.2.3 - 2600
|
|
2.3 - Online forums
|
|
2.4 - Controversial groups
|
|
2.5 - Demo scene
|
|
2.6 - Pentesting community
|
|
2.7 - Open source related events
|
|
2.8 - Academia
|
|
3 - Conclusion, what does the future hold
|
|
4 - References
|
|
|
|
|
|
--[ 1 - Introduction
|
|
|
|
In this brief article we will attempt to give an overview of the current
|
|
state of the Greek computer underground scene. However, since the strictly
|
|
underground scene in Greece is very small, we will also include some
|
|
information about other active IT security related groups and forums. There
|
|
is a going to be a second part to this article at a future issue in which
|
|
we will present in detail the past of the underground Greek scene in all
|
|
its gory glory.
|
|
|
|
Before we continue let's get something out of the way. We know that a lot
|
|
of people act offended when they hear the words "Greek" and "scene" in the
|
|
same sentence. They flat out reject that anything is currently happening
|
|
in the Greek underground and mumble about how much better things were
|
|
during the past years. We are sure that the exact same behavior exists in
|
|
the scene of other countries as well. We do not agree with this behavior.
|
|
Yes, the present Greek "scene" is small, obscure, full of ignorant and
|
|
incompetent people. But that was also the case in the past. But there were
|
|
and there are exceptions. If you are part of the scene (Greek or
|
|
international) you probably know the exceptions. We need to focus more on
|
|
what is good and try to bring that forward. Yes, that means you too.
|
|
|
|
--[ 2 - Present
|
|
|
|
In this section we will introduce you to the present and recent past of the
|
|
Greek hacking scene, roughly from 2005 to 2010. We will avoid mentioning
|
|
nicknames and handles of specific people since we feel that this has led to
|
|
fragmentation of the scene in the past. Instead we will only mention group
|
|
names.
|
|
|
|
----[ 2.1 - GRHACK
|
|
|
|
One of the most interesting things to note about the Greek underground
|
|
scene, was the fact that although there were plenty of skilled
|
|
individuals, no one ever tried to unite them. Most of them used to work
|
|
alone, isolated from the rest. It was obvious that something had to be
|
|
done to help those individuals come together, exchange ideas, cooperate
|
|
and contribute. It was then, about two years ago, when two guys from
|
|
the Engineering school of A.U.Th. (Thessaloniki, Greece) grabbed a bunch
|
|
of redundant boxes, set up a CVS server, a website, an IRC network and
|
|
published an open invitation [GRH]. GR Hack was born. The fact that
|
|
Greek Universities are modern sanctuaries and the fact that academics
|
|
are protected by asylum laws, made the location an ideal place for a
|
|
hacking community.
|
|
|
|
Although not a team in the strict sense, the GR Hack community is still a
|
|
very active think tank composed of well known and respected Greek hackers.
|
|
Members and friends of GR Hack have published work in Phrack ([ARG], [ITH],
|
|
[HUK]), have participated in security conferences like AthCon and Black Hat
|
|
and have had a great time meeting in real life, drinking alcohol and
|
|
sharing knowledge. The core of the community consists of a circle of
|
|
trusted individuals (software analysts/reverse engineers, old school
|
|
hackers, administrators etc.) who are more than willing to cooperate with
|
|
other people that take security seriously and have a passion for hacking.
|
|
|
|
----[ 2.2 Meetings
|
|
|
|
------[ 2.2.1 0x375
|
|
|
|
The need for an event came as no surprise. Everyone agreed that the local
|
|
underground scene had been inactive for quite a long time and that a
|
|
meeting (preferably with a catchy name!) would be the ideal motive for all
|
|
those who were willing to share their ideas but never had the chance to.
|
|
The place was Thessaloniki, and the name was picked to be Thessaloniki
|
|
Tech Talk Sessions or just TTTS. Since TTTS was not cool enough, the final
|
|
name for the meeting was chosen to be 3TS and was later settled to 0x375
|
|
(almost overnight!). During 0x375 meetings people give presentations
|
|
on technical topics, have an open discussion and an afternoon full of
|
|
fun. Currently, the Greek underground scene is preparing for 0x375 0x03
|
|
but the lack of people willing to contribute has made the whole process
|
|
a difficult task. 0x375 material is published at [375].
|
|
|
|
------[ 2.2.2 AthCon
|
|
|
|
Following the classic naming convention of other "cons", three people from
|
|
Athens decided to organize AthCon, an IT security conference that would
|
|
take place in Athens, Greece. The AthCon staff announced an open call for
|
|
papers and promised everyone that it was going to be a cool event. And,
|
|
yes, it was. The first ever AthCon took place in June 2010 and was actually
|
|
the first "con" to take place in Greece. The event featured a capture the
|
|
flag contest, a closing party and cool presentations. It's interesting to
|
|
note that AthCon attracted a lot of people active in the international
|
|
security scene [ATH] both as speakers or as part of the audience. AthCon
|
|
was the perfect place for everyone to meet in real life and have fun. We
|
|
would, definitely, like to see more security conferences taking place in
|
|
Greece in the near future.
|
|
|
|
------[ 2.2.3 2600
|
|
|
|
According to the official Greek 2600 site [260], 2600 meetings started
|
|
taking place in Athens back in 1999 and, as far as the authors know,
|
|
they are still frequently organized. During 2600 meetings various people,
|
|
mainly young inexperienced ones (and that doesn't really matter), meet to
|
|
have a drink and talk about technical matters. Although we haven't
|
|
personally attended any of those meetings lately, we believe that they
|
|
serve a good purpose.
|
|
|
|
----[ 2.3 Online forums
|
|
|
|
We live in the, so called, "century of information" and it seems that
|
|
Greek hackers have kept up with the pace information travels. Fortunately,
|
|
Greeks are quite active when it comes to setting up discussion forums and
|
|
blogs. P0wnbox [PWN] is such a discussion forum. Although most of its
|
|
members are freshmen (in a good sense), there are some interesting
|
|
discussions on that board from time to time.
|
|
|
|
Hey, we are pretty sure you already know xorl's blog, right? It's probably
|
|
one of the most famous security blogs around and it's mostly dedicated
|
|
to vulnerability analysis. The pace by which xorl posts stuff may cause
|
|
you vertigo! Xorl is doing a great job and it's obvious that he spends
|
|
a quite fair amount of his daily free time on posting things. His blog
|
|
[XRL] is well worth visiting if you don't already know it.
|
|
|
|
----[ 2.4 - Controversial groups
|
|
|
|
In the recent past there have been a number of groups doing defacements and
|
|
fighting each other with childish insults. One of the most high profile
|
|
cases of this is the CERN defacement. There are tons of articles on the
|
|
Internet about the CERN incident and the events associated with the
|
|
defacement of the lxplus.cern.ch web server. We will merely state the
|
|
obvious. The content of the CERN defacement put blame on the same behavior
|
|
that itself was perpetuating.
|
|
|
|
Another recent trend in the Greek web defacement "scene" is the emergence
|
|
of extreme nationalistic groups. These groups attack web sites associated
|
|
with neighboring countries and deface them with nationalistic content and
|
|
messages. One of these groups uses a name (Greek Hacking Scene) quite
|
|
similar to a historic Greek hacking group (Greek Hackers Society). Their
|
|
reasons for using a similar name are quite obvious. We personally believe
|
|
that what nationalism stands for goes against the spirit of hacking, and we
|
|
will leave it at that.
|
|
|
|
Last but not least, Hack4Fame was a self-proclaimed hacking group
|
|
supposedly composed of blackhat hackers from various countries including
|
|
Greece. However, it was obvious to most of us who the single person behind
|
|
Hack4Fame was. In February 2010, Hack4Fame used standard media tricks to
|
|
publish data that were supposedly stolen after a hack in a Greek bank. The
|
|
data, which in reality were circulating the Greek underground scene for
|
|
more than 8 years, belonged to other individuals who either hacked the
|
|
aforementioned bank in the past or had performed fully legal penetration
|
|
tests. We don't know what the motive was for Hack4Fame but we definitely
|
|
disagree with his behavior, especially when it comes to publishing third
|
|
party private material belonging either to a company or to individuals.
|
|
|
|
----[ 2.6 - Demo scene
|
|
|
|
The demo scene has always been very closely associated to the hacking scene
|
|
having forked from it. While in the past the demo scene in Greece was quite
|
|
active, several demo parties were organized in a yearly basis with the most
|
|
famous one being The Gardening [GRD], it is currently in a state of
|
|
hibernation. An example of this sad state of affairs is that the past
|
|
Greek demo scene online home is now a web page full of advertisements
|
|
[DMS].
|
|
|
|
However there is one Greek demogroup that isn't just currently active, but
|
|
is also transcending the borders of Greece and is successfully
|
|
participating in international demo scene competitions [ASD]. Andromeda
|
|
Software Development (ASD) were formed in 1992 and participated for the
|
|
first time in a Greek demo party in 1995 (The Gardening 1995). They
|
|
originally developed demos on MS DOS with Borland Turbo Pascal and inline
|
|
16-bit assembly. In 2003 they competed for their first time in an
|
|
international event (Assembly 2003) and in 2005 they won that year's
|
|
Assembly demo party. Since then they regularly compete in international
|
|
demo scene events and have won many times [AWP].
|
|
|
|
----[ 2.6 - Pentesting community
|
|
|
|
Although we all like to pretend that the commercial penetration testing
|
|
community has little to do with the underground, we all know that it
|
|
actually has much to do with us. In Greece many, surely not all though,
|
|
pentesters that work for security companies come from an underground
|
|
hacking background. Others try to become part of the hacking scene in
|
|
order to leech technical know-how, code and sometimes even ready-to-use
|
|
weaponized exploits. Lately we have seen the emergence of a particular
|
|
community of people that do a security MSc degree at a semi-respectable
|
|
UK university (no need to mention it by name, it is well-known in security
|
|
circles), return to Greece and pretend to know everything there is to know
|
|
about "hacking". These people fail to understand the importance of the
|
|
underground and their leeching behavior actively contributes to the demise
|
|
of the already weak Greek scene. We all hope that Greek security companies
|
|
will start to publish tools, give talks and generally support and
|
|
contribute back to the underground hacking scene that has taught them so
|
|
much in their early days.
|
|
|
|
----[ 2.7 - Open source related events
|
|
|
|
The open source movement has seen a certain degree of acceptance and has
|
|
gained several followers and evangelists in Greece. As part of this
|
|
movement there have been several communities that have and still are
|
|
organizing technical talks and events. Although these events are not
|
|
primarily focused on security topics, there have been interesting security
|
|
talks from time to time. The Software Libre Society at the University of
|
|
Piraeus [SLS] deserves a special mention since it has been meeting on a
|
|
regular basis and most talks presented there are of an acceptable to high
|
|
technical level.
|
|
|
|
----[ 2.8 - Academia
|
|
|
|
Last but not least, it's quite encouraging that Greek universities
|
|
have recently started dealing with security more seriously. There are
|
|
several opportunities for a student to do some serious research for
|
|
a thesis, an MSc or a PhD that focuses on security both formally and
|
|
practically. This is good news since a couple of years ago the phrase
|
|
"applied security research" sounded alien to most academics. Namely, the
|
|
Electrical and Computer Engineering Department of A.U.Th. (Thessaloniki,
|
|
Greece) and N.T.U.A. (Athens, Greece) as well as the CS department of the
|
|
University of Piraeus (Piraeus, Greece) are currently some of those places
|
|
where one can treat security more academically.
|
|
|
|
Another academic institute that is actively doing security research is ICS,
|
|
FORTH in Heraklion, Crete [ICS]. Among their research topics are large
|
|
scale malware analysis, the monitoring of Internet for malware traffic and
|
|
malware epidemics. They have developed their own honeypot/honeynet software
|
|
which runs on a host machine and binds several well-known ports that aren't
|
|
used by the host. All the traffic that comes to these ports is forwarded to
|
|
their own backend infrastructure for further analysis. Furthermore, they
|
|
have recently started doing research on GPU-hosted malware.
|
|
|
|
Unfortunately, due to certain narrow minded extremists that represent
|
|
various political (and mostly partisan) views, Greek universities are still
|
|
quite far from doing some real, valuable research and even further from
|
|
collaborating with the very few capable security companies. Analysis of the
|
|
Greek educational system is a very interesting topic that may teach you all
|
|
how to respect the fact that you were born in a more civilized country :-)
|
|
|
|
--[ 3 - Conclusion, what does the future hold
|
|
|
|
The near future seems debatable for the Greek computer underground scene.
|
|
The fact that it is so small means that it is flexible and adaptable, but
|
|
also means that fragmentations and grudges between individuals can wound it
|
|
gravely. The Greek scene cannot be forcefully resurrected, that would only
|
|
lead to more mindless zombies with no motivation and no passion for
|
|
hacking. We would like to conclude with a positive message and we feel
|
|
that the conclusion of the "Underground Myth" article in issue 65 applies
|
|
well to the current situation in Greece [UND]:
|
|
|
|
"All that remains is to relax, to do what you enjoy doing; to hack purely
|
|
for the enjoyment of doing so. The rest will come naturally, a new
|
|
scene, with its own traditions, culture and history. A new underground,
|
|
organically formed over time, just like the first, out of the hacker's
|
|
natural inclination to share and explore."
|
|
|
|
We hope you enjoyed this brief overview of the current state of the Greek
|
|
security scene. Greets and thanks to the people that provided extra
|
|
information on certain topics. You know who you are.
|
|
|
|
Stay tuned for the second part of this article.
|
|
|
|
--[ 4 - References
|
|
|
|
[GRH] http://www.grhack.net/
|
|
[ARG] http://www.phrack.org/issues.html?issue=66&id=8#article
|
|
[ITH] http://www.phrack.org/issues.html?issue=66&id=9#article
|
|
[HUK] http://www.phrack.org/issues.html?issue=66&id=6#article
|
|
[375] https://www.grhack.net/files/0x375/
|
|
[ATH] http://www.athcon.org/speakers/
|
|
[260] http://www.2600.gr/
|
|
[PWN] http://www.p0wnbox.com/
|
|
[XRL] http://xorl.wordpress.com/
|
|
[GRD] http://www.deus.gr/gardening.html
|
|
[DMS] http://www.demoscene.gr/
|
|
[ASD] http://www.asd.gr/
|
|
[AWP] http://en.wikipedia.org/wiki/Andromeda_Software_Development
|
|
[ICS] http://www.ics.forth.gr/
|
|
[SLS] http://rainbow.cs.unipi.gr/projects/oss/
|
|
[UND] http://phrack.org/issues.html?issue=65&id=13#article
|