I seen someone has been fixing the tarpit patches to work with newer kernels so I decided to try it out with the latest grsec stable which is 2.6.24.5, well it patched fine and all that but on install vdso_install brought an error, that has nothing to do with tarpit so I decided to try with 2.6.24.3 and was succesfull. Here is a pre configured, pre patched grsec 2.6.24.3 kernel with xt_tarpit patch. Also includes is patched iptables source.

2.6.24.3 Kernel with Grsecurity and Tarpit Patches

64 Bit
http://nix101.com/kernels/linux-2.6.24.3-grsec-tarpit-64bit.tar.gz

32 Bit (includes iptables-1.40/tarpit in tarball)
http://fearlesshost.com/linux-2.6.24.3-grsec-tarpit-32bit.tar.gz

Iptables 1.4.0 with Tarpit Patch
http://nix101.com/iptables-1.4.0-with_tarpit.tar.bz2

If you are like me and manage quite a few servers using ssh keys can be a big help. It is also much more secure then using password auth. Here is a short tutorial on setting up SSH keys.

It is an old tut but everything still works the same. Originally from http://pkeck.myweb.uga.edu/ssh/

Getting Started
1. First, install OpenSSH on two UNIX machines, hurly and burly. This works best using DSA keys and SSH2 by default as far as I can tell. All the other HOWTOs I’ve seen seem to deal with RSA keys and SSH1, and the instructions not surprisingly fail to work with SSH2.
2. On each machine type ssh somemachine.example.com and make a connection with your regular password. This will create a .ssh dir in your home directory with the proper perms.
3. On your primary machine where you want your secret keys to live (let’s say hurly), type
ssh-keygen -t dsa

This will prompt you for a secret passphrase. If this is your primary identity key, make sure to use a good passphrase. If this works right you will get two files called id_dsa and id_dsa.pub in your .ssh dir. Note: it is possible to just press the enter key when prompted for a passphrase, which will make a key with no passphrase. This is a Bad Idea ™ for an identity key, so don’t do it! See below for uses of keys without passphrases.

4.
scp ~/.ssh/id_dsa.pub burly:.ssh/authorized_keys2

Copy the id_dsa.pub file to the other host’s .ssh dir with the name authorized_keys2.

5. Now burly is ready to accept your ssh key. How to tell it which keys to use? The ssh-add command will do it. For a test, type
ssh-agent sh -c ’ssh-add < /dev/null && bash’

This will start the ssh-agent, add your default identity(prompting you for your passphrase), and spawn a bash shell. From this new shell you should be able to:

6.
ssh burly

This should let you in without typing a password or passphrase. Hooray! You can ssh and scp all you want from this bash shell and not have to type any password or passphrase.

Since VOIP use has been on the rise many useful things have come from it for the legitimate user but more so for the illicit or mischievous user. In the last 2-3 years since skype and other VOIP tools have became popular hackers and pranksters have taken advantage of the benefits and anonymity it offers.

On the prankster side of things you have things like “swatting” which has been publicized in the news a few times lately where the prankster calls the target victim’s local police department with reports sounding drastic enough to have them assemble a swat team and raid the victim’s home. This is more so popular in the AIM kiddy scene then any other. Since “swatting” has became a way to get revenge or harass people from the internet a few arrests have been made but still remains prevalent.

On the serious hacker side of things VOIP is the perfect tool for social engineering and used in conjunction with a spoof card it is very effective. With social engineering very little actual hacking or technical skills are needed to pull off some major hacks so anyone with good social skills can get in anywhere they want. Most of the social engineering hacks and access some of the hackers I have spoke to rival and in some cases trump anything Keven Mitnick the famous hacker did.

I was able to do an interview with a seasoned hacker and was surprised as how deep they was into big companies and isps like comcast, tmobile, fed-ex, etc; Some have even taken over entire datacenters as such that rent dedicated servers like Server Beach and The Planet. Even domain registrars such as network solutions have been compromised.  Asked why they do this, whether they do it for financial gain or fun, the reply was simply boredom and info harvesting. Sometimes these things are done to obtain information about internet enemies or simple data-mining. All most of them need is a person’s ip address or cell phone number and then the fun begins.

The list goes on of all the big companies and isps that are easily accessed with a phone call. How do these phone calls work and obtain such information and access? It is simple, the average call is the hacker pretending to be some sort of management from a satellite or home office needing a small piece of information needed to perform a maintenance task that needs to be done. Most of the time the hacker knows what internal software is being used and they are able to gain the employee’s trust and confidence quickly. Tthe employee, trying to be as helpful as they can because they think they will be in trouble if they dont.

The average employee is an $8 or $9 an hour kid usually hired from a temp agency, turnover is usually very high for these positions so they are thrown in quickly in order to keep staffed. More so then not the employee is given very little training and even less training about security procedures, they would not imagine a person calling in asking for this information, knowing what software they are using and other internal aspects of the company who was not really management.

In some situations where companies use internal private networks to access admin functions the employee is socialed into down loading and executing malware which the hacker can connect to to and use the employee’s computer as a proxy to access functions on the private network. Some companies have web admin panels to access to private network from a remote location for telecommuting, usualy the login is the same as the employee’s admin login which can be accessed by anyone on the internet.

I investigated everything in this article in the last 3 months and was able to see first hand of the access these hackers have. From seeing screenshots and even listening in on some of the calls I was surprised at how easy it is to be done. You would think most of these companies would be prepared for this and train their employees. And you would also suppose that datacenters and isps would be extra aware as they deal with hackers on a daily basis in one form or another.

VOIP and exclusively skype is the number one tool for these exploits, now more so then ever with VOIP social engineering has reached new frontiers. VOIP communications is not be to totally blamed though, companies will have to prepare for new threats and bolder tactics. As proven time and time again human error will compromise even the most advanced of technologies.