Logs for ShadowRN and Associated Mailing Lists

From:	Tzeentch tzeentch666@*********.net
Subject:	The Matrix: Gearhead Discussion
Date:	Mon, 29 Nov 1999 18:56:22 -0800

Message no. 1 > First I wanted to say that I really enjoyed the other (long post) that you
> wrote and it was very well thought out. I do agree with several of your
> points. But the above statement might let me make my point perfectly.

<ducks for cover> Well at least this discussion is not semi-degenerating
into flamewars like my posts on the Deep Resonance forums (I must have a
real low online Charisma...)

> Classified data packets are quite possibly passing over my backbone router
> now since I'm in a University. No I can't see them, and it would take a
bit
> of effort to see them, let alone get to them. However, I can see the
router
> itself. If I started flooding that router with enough crap, all of the
data
> going to it is going to eventually get held up. That includes the basic
> stuff that I can see and the classified stuff that I can't.

Well actually a lot of universities are right on the internet backbone so
they may very well see these packets zipping around - you won't since the
routers upstream of you throw it out before it gets to you.

Yes you could flood the router simply by sending gigantic amounts of spam to
anyone on their network. But YOU have to have the bandwidth as well. IE if
you're on a 56K connection good luck saturating someones T1 line. You COULD
get a shell account and do it (but THEY have to have the bandwidth too...).

I agree, you could cause some problems this way, but the average Joe Decker
will not have access to the bandwidth to pull some stunt like this. Now a
lot of Joe Deckers on the other hand....

> Now if I would try to do that to each router in the Aztech pyramid, I
could
> get the same effect. I probably wouldn't know all of the different types
of
> data that are going in there. But its all data, and it has been
established
> that they all go through the Matrix. I'm not looking at it as a "metaplane
> of data" either. I'm looking at it as there are a few big rooms in that
> pyramid where all of the fiber optic goes in from the outside world and
> gets routed throughout the building. If you can cause enough spam, hang-up
> phonecalls, router traces and what have you to go through that set of
> routers, you can get them to shut down.

Well if you knew all the networks (assuming the future still uses such
things) you could try to spam all the routers. Depending on how "smart"
future routers are and how connections are identified they could just perm
ban all traffic from certain addresses (might not be a problem so much with
deckers since their ID codes are intentionally munged).

Or better yet, they have a LOT more bandwidth then you probably do. They
could do a reverse resolution and start spamming YOUR network. That would be
a standard Trace/ICE function (see, some of the decking system makes perfect
sense). It's difficult to hide the origin of your traffic (yes it can be
done) but that's what Stealth represents eh? I'm sure your Matrix provider
would not take kindly to users causing these sort of problems and might even
start implementing bandwidth caps to prevent abuse (cablemodem companies are
doing this now to discourage everyone and their pet monkey from setting up
warez ftp sites).

I agree, you could technically spam them into oblivion. What are other
peoples thoughts on the technical merits of this? Without any data (at ALL)
on how deckers connect to the Matrix (they have to have an account with
SOMEONE, even a fake one) it's hard to postulate how they could be traced or
blocked.

For important routers and such...my bet is if this becomes a problem they
would just plain ignore all traffic except from certain trusted sources
(other backbone connections, UCAS Online users, whatever). That way Joe
Decker with Local Matrix Provide X would have to work harder to cause
problems (and most 'hackers' are way to lazy to work).

I concede your point though. It COULD work.

> In fact, the corp will even help you with their own security measures.
From
> a physical wiring and security standpoint, its easier to send signals
> through a few key chokepoints. If the company controls access to those,
> they can control access to their system. What you do is block the access
> between their system and the rest of the world. Its like all of your
> plumbing in your house is working fine, but there's a big block between
the
> city water and your main pipe. As long as no water is coming in from the
> outside, doesn't matter how good your other plumbing is.

Again, depending on the tech and how their network is set up they could
start using vanishing SANs and other uplink/downlink methods that you may
not know about all.

System Admin A: "Damn, all the routers are at 100% saturation AGAIN this
week. I though the ICE division plugged all the holes in the routing
algorithm?"
System Admin B: "Bah, those losers are probably still working on that
Marilyn Monroe icon for their new Trace program - the knobs... Guess the new
exploit for their last fix has already hit the decker nets. Don't remember
seeing it during my last sweep of the pirate boards, must have missed it..."
System Admin A: "Blah, any second now those uncultured worms from marketing
will be calling asking why they can't access their stock portfolios."
System Admin B: "Switch to the backup network, not as much bandwidth but it
will do the job ok. And send a routing update to network operations so that
they know to put the backup public sites online."
System Admin A: "Yah, I'll also get NetSec to do a sweep looking for the
fools who released the exploit this time, nuyen to optisoft it's that
Hoosier Hacker group.."

These backups could be anything from a leased line usually used for
diagnostics to cell connections and satellite uplinks. You might block
people coming IN but it would be hard to block all traffic going OUT. They
could bring backup sites online, update the global registeries in the LAN to
point to the new addesses and people might not even notice the difference.
In the meantime they would be able to spend time tracking you down (And
having attacks constantly "on" does not sound like a good plan - unless you
have money to burn as they kill your frames and knowbots).

> I hope this explains what I was trying to say a little better.

It's doable as you describe. But since you don't see that sort of thing
happening today overmuch (usually they exploit a flaw in the hardware or
software until it's patched) I don't imagine it become ultra-common in the
future. I'll ask a friend a lot more knowledgable in exploits of this kind
and see what he thinks.

Cool discussion though, got me thinking about a lot of aspects of the SR
decking scene that have been a little..err.underdescribed (like where
deckers get accounts to log on with).

Ken
Ebola Monkey Hunter Z

> Sommers
> Insert witty quote here.

From:	lomion lomion@*********.org
Subject:	The Matrix: Gearhead Discussion
Date:	Mon, 29 Nov 1999 21:40:09 -0800

Message no. 2 > > Classified data packets are quite possibly passing over my backbone router
> > now since I'm in a University. No I can't see them, and it would take a
>bit
> > of effort to see them, let alone get to them. However, I can see the
>router
> > itself. If I started flooding that router with enough crap, all of the
>data
> > going to it is going to eventually get held up. That includes the basic
> > stuff that I can see and the classified stuff that I can't.

Seeing them isnt to hard, what you do nowadays is enable a certain mode no
your network card and run something called a sniffer, most isp's will
immediately shutdown an account if they detect this. I'd say this is
carried into SR as well. Now figuring out what the packet contains is a
totally different issue, especially with encryption. At work we only use
encrytped stuff -SSH for remote connections( think encrypted telnet), scp
to transfer files (Scp is like an encrypted version of ftp).

>Well actually a lot of universities are right on the internet backbone so
>they may very well see these packets zipping around - you won't since the
>routers upstream of you throw it out before it gets to you.
>
>Yes you could flood the router simply by sending gigantic amounts of spam to
>anyone on their network. But YOU have to have the bandwidth as well. IE if
>you're on a 56K connection good luck saturating someones T1 line. You COULD
>get a shell account and do it (but THEY have to have the bandwidth too...).

Most systems require root access to ping flood, plus some OS'es and
hardwarew now will automatically throttle back if this is detected. DoS
attacks run on more creative methods which do work.

Something scary, a normal user inside a network could easily bring down the
network with a single command unless limiting is done. From the inside it
would be cake.

>I agree, you could cause some problems this way, but the average Joe Decker
>will not have access to the bandwidth to pull some stunt like this. Now a
>lot of Joe Deckers on the other hand....

Most likely the scenario is comon one for DoS attacks..crack a remote
system with the bandwith and use it to perform the attack, if the system is
compromised to do this then it can be assumed that finding the responsible
parties may be difficult unless serious aduting is done.

> > Now if I would try to do that to each router in the Aztech pyramid, I
>could
> > get the same effect. I probably wouldn't know all of the different types
>of
> > data that are going in there. But its all data, and it has been
>established
> > that they all go through the Matrix. I'm not looking at it as a "metaplane
> > of data" either. I'm looking at it as there are a few big rooms in that
> > pyramid where all of the fiber optic goes in from the outside world and
> > gets routed throughout the building. If you can cause enough spam, hang-up
> > phonecalls, router traces and what have you to go through that set of
> > routers, you can get them to shut down.
>
>Well if you knew all the networks (assuming the future still uses such
>things) you could try to spam all the routers. Depending on how "smart"
>future routers are and how connections are identified they could just perm
>ban all traffic from certain addresses (might not be a problem so much with
>deckers since their ID codes are intentionally munged).

Going with current trends and whats out there, you could concevably(sp)
have it block ip's (or matrix addresses) on the fly if certain conditions
occur.

>Or better yet, they have a LOT more bandwidth then you probably do. They
>could do a reverse resolution and start spamming YOUR network. That would be
>a standard Trace/ICE function (see, some of the decking system makes perfect
>sense).

Spam? No, trace yes. Spamming back would make no sense since it would just
increase traffic problems.

>It's difficult to hide the origin of your traffic (yes it can be
>done) but that's what Stealth represents eh? I'm sure your Matrix provider
>would not take kindly to users causing these sort of problems and might even
>start implementing bandwidth caps to prevent abuse (cablemodem companies are
>doing this now to discourage everyone and their pet monkey from setting up
>warez ftp sites).

What they limit is upstream badnwith plus if they notice lots of traffic
flags are raised.

>I agree, you could technically spam them into oblivion. What are other
>peoples thoughts on the technical merits of this? Without any data (at ALL)
>on how deckers connect to the Matrix (they have to have an account with
>SOMEONE, even a fake one) it's hard to postulate how they could be traced or
>blocked.

Well, my idea was it can be like a network connection, you basically hijack
a way online. One easy way it hit the hardware address, kinda like the mac
address on a network card, this can be changed tho heh, easily.

>For important routers and such...my bet is if this becomes a problem they
>would just plain ignore all traffic except from certain trusted sources
>(other backbone connections, UCAS Online users, whatever). That way Joe
>Decker with Local Matrix Provide X would have to work harder to cause
>problems (and most 'hackers' are way to lazy to work).
>
>I concede your point though. It COULD work.

Trying to flood the networks in SR would be difficult if not impossible,
they are already breaking the Gigabit barrier in labs easily. Hell OC-48's
are theoretically beyond the gigabit barrier, don;t recall the exact
amount. Any DoS attacks (which is what is being discussed) would rely on
poor security, which can be a high probability, especially with a matrix
provider, going by most ISP's i deal with daily (I'm a systems
administrator for a consulting firm) i'd say security would be easy to
compromise for most Providers, now corps and Tier 1 (backbone) providers
eqivalent is a different story, they usually have the bucks to make this an
issue.

> > In fact, the corp will even help you with their own security measures.
>From
> > a physical wiring and security standpoint, its easier to send signals
> > through a few key chokepoints. If the company controls access to those,
> > they can control access to their system. What you do is block the access
> > between their system and the rest of the world. Its like all of your
> > plumbing in your house is working fine, but there's a big block between
>the
> > city water and your main pipe. As long as no water is coming in from the
> > outside, doesn't matter how good your other plumbing is.

Setting up point to point lines is easily done, they could setup a point to
point connection (think dedicated T1 that only connects point a and B) and
disallow any traffic from external sources.

One setup ive seen as used, internal networks run on a different set of
nics for the servers and outside traffic is restriced, setup is the main
issue, one could create an internal network that could be easily cutoff The
vanishing nodes thing in SR is a good eample of this on a level.

A setup i like is to have a firewall behind the router that disallow all
external traffic to a file server, the file server can only be reached
internall by a few addresses. In the case of an attack one could simply
lock down the firewall fully to protect internal systems.

>System Admin A: "Damn, all the routers are at 100% saturation AGAIN this
>week. I though the ICE division plugged all the holes in the routing
>algorithm?"
>System Admin B: "Bah, those losers are probably still working on that
>Marilyn Monroe icon for their new Trace program - the knobs... Guess the new
>exploit for their last fix has already hit the decker nets. Don't remember
>seeing it during my last sweep of the pirate boards, must have missed it..."
>System Admin A: "Blah, any second now those uncultured worms from marketing
>will be calling asking why they can't access their stock portfolios."
>System Admin B: "Switch to the backup network, not as much bandwidth but it
>will do the job ok. And send a routing update to network operations so that
>they know to put the backup public sites online."
>System Admin A: "Yah, I'll also get NetSec to do a sweep looking for the
>fools who released the exploit this time, nuyen to optisoft it's that
>Hoosier Hacker group.."

heh

>These backups could be anything from a leased line usually used for
>diagnostics to cell connections and satellite uplinks. You might block
>people coming IN but it would be hard to block all traffic going OUT.

It's easy to block all traffic, most firewalls will let you do it with one
command, it's basically a total lockdown.

>They
>could bring backup sites online, update the global registeries in the LAN to
>point to the new addesses and people might not even notice the difference.
>In the meantime they would be able to spend time tracking you down (And
>having attacks constantly "on" does not sound like a good plan - unless you
>have money to burn as they kill your frames and knowbots).

It would become a matter of blocking things at the router, also depending
on the OS a server can start dropping packets in random order to deal with
DoS attacks..that's a method to deal with Syn attacks on OpenBSD and
FreeBSD servers.

>It's doable as you describe. But since you don't see that sort of thing
>happening today overmuch (usually they exploit a flaw in the hardware or
>software until it's patched) I don't imagine it become ultra-common in the
>future. I'll ask a friend a lot more knowledgable in exploits of this kind
>and see what he thinks.
>
>Cool discussion though, got me thinking about a lot of aspects of the SR
>decking scene that have been a little..err.underdescribed (like where
>deckers get accounts to log on with).

I've been trying to reconcile SR stuff with real world trends and what i
know, I might even post it somewhere if anyone has any ideas or input email
me personally.

--lomion

From:	Sebastian Wiers m0ng005e@*********.com
Subject:	The Matrix: Gearhead Discussion
Date:	Tue, 30 Nov 1999 01:05:05 -0600

Message no. 3 :I agree, you could technically spam them into oblivion. What are other
:peoples thoughts on the technical merits of this? Without any data (at ALL)
:on how deckers connect to the Matrix (they have to have an account with
:SOMEONE, even a fake one) it's hard to postulate how they could be traced
or
:blocked.

I picture use of the matrix being rather like today's use of cellular
networks- not in its wirless nature, but because you can hook up from a wide
range of physical locations and be recognized and have "data" routed to you,
and because there are (that I have read aout) stealthed (and very illegal)
phones that can not only mask as another phone, but can genrate radom ID's
and even change ID while opperating. Not all those ID's are even valid
repesentations of exiting accounts, but the phone "convinces" the network
they are, somehow.
Perfoming a "graceful logon" gets you onto whatever network you are
connecting your jack to, right? So wouldn't that be annalogous to "cloning"
an account?

Mongoose

From:	Bruce iti03678@****.co.za
Subject:	The Matrix: Gearhead Discussion
Date:	Tue, 30 Nov 1999 12:49:43 +0200

Message no. 4 -----Original Message-----
From: Sebastian Wiers <m0ng005e@*********.com>
To: shadowrn@*********.org <shadowrn@*********.org>
Date: 30 November 1999 10:05
Subject: Re: The Matrix: Gearhead Discussion

>
>:I agree, you could technically spam them into oblivion. What are
other
>:peoples thoughts on the technical merits of this? Without any data
(at ALL)
>:on how deckers connect to the Matrix (they have to have an account
with
>:SOMEONE, even a fake one) it's hard to postulate how they could be
traced
>or
>:blocked.
>
> I picture use of the matrix being rather like today's use of
cellular
>networks- not in its wirless nature, but because you can hook up from
a wide
>range of physical locations and be recognized and have "data" routed
to you,
>and because there are (that I have read aout) stealthed (and very
illegal)
>phones that can not only mask as another phone, but can genrate radom
ID's
>and even change ID while opperating. Not all those ID's are even
valid
>repesentations of exiting accounts, but the phone "convinces" the
network
>they are, somehow.
> Perfoming a "graceful logon" gets you onto whatever network you
are
>connecting your jack to, right? So wouldn't that be annalogous to
"cloning"
>an account?
>
>Mongoose

If the "stealthed" phone changes ID during operation, how does it
receive calls without running somekind of commands on the cell
network? This sounds nigh impossible and from what I have heard these
"stealthed" phones are just urban legends / rumours.

- -
Bruce <phantasm@****.co.za>

Give me reasons why the sun has to shine
why they murdered the noisy mime
tell me the answers to the puzzles of Poe
and sing me to sleep on the rivers of woe

From:	Wildfire Wildfire@*************.com
Subject:	The Matrix: Gearhead Discussion
Date:	Tue, 30 Nov 1999 09:04:32 -0500

Message no. 5 Sebastian Wiers wrote:

> :I agree, you could technically spam them into oblivion. What are other
> :peoples thoughts on the technical merits of this? Without any data (at ALL)
> :on how deckers connect to the Matrix (they have to have an account with
> :SOMEONE, even a fake one) it's hard to postulate how they could be traced
> or
> :blocked.
>
> I picture use of the matrix being rather like today's use of cellular
> networks- not in its wirless nature, but because you can hook up from a wide
> range of physical locations and be recognized and have "data" routed to
you,
> and because there are (that I have read aout) stealthed (and very illegal)
> phones that can not only mask as another phone, but can genrate radom ID's
> and even change ID while opperating. Not all those ID's are even valid
> repesentations of exiting accounts, but the phone "convinces" the network
> they are, somehow.
> Perfoming a "graceful logon" gets you onto whatever network you are
> connecting your jack to, right? So wouldn't that be annalogous to
"cloning"
> an account?
>
> Mongoose

That makes sense to me. I always kind of pictured deckers getting onto the
Matrix using something close to AOHell/DHCP. Fudge a valid ID, and until it's
busted, you can access it wherever by just plugging in. The connection detects
a valid ID, and gives you an IP-equivalent thing, and voila - valid connection.

Wildfire (sometimes with a DC)
Terminally Behind SOTA
---
www.nexusgate.fresservers.com/Shadowrun
Play with the Target Number Calculator! SR2 implemented only.

From:	Asymmetric all@******.net
Subject:	Fw: The Matrix: Gearhead Discussion
Date:	Fri, 03 Dec 1999 00:11:00 -0500

Message no. 6 My compadre tzeentch asked me to join the list and butt in on various
things.. so I'll do my best. ;)

> > Seeing them isnt to hard, what you do nowadays is enable a certain mode no
> > your network card and run something called a sniffer, most isp's will
> > immediately shutdown an account if they detect this. I'd say this is
> > carried into SR as well. Now figuring out what the packet contains is a
> > totally different issue, especially with encryption. At work we only use
> > encrytped stuff -SSH for remote connections( think encrypted telnet), scp
> > to transfer files (Scp is like an encrypted version of ftp).

Yes.. promiscuous mode. This will allow you to see any traffic on the
immediate LAN segment that the listening NIC is on. It won't let you see
any traffic across routers, smart switches, or any of that kind of stuff
though.. so the further upstream the better.

> > Most systems require root access to ping flood, plus some OS'es and
> > hardwarew now will automatically throttle back if this is detected. DoS
> > attacks run on more creative methods which do work.
> >
> > Something scary, a normal user inside a network could easily bring down
>the
> > network with a single command unless limiting is done. From the inside it
> > would be cake.

You may not even have to be on the inside.. with a misconfigured
router/etc... smurf DoS attack anyone? Use their bandwidth against them.

> > Going with current trends and whats out there, you could concevably(sp)
> > have it block ip's (or matrix addresses) on the fly if certain conditions
> > occur.

Blocking IP's wont save you from bandwidth problems.. just from direct
exploitation.. even if you are ignoring their packets, they're still
wasting bandwidth if they are sent to you.

> > >It's difficult to hide the origin of your traffic (yes it can be
> > >done) but that's what Stealth represents eh? I'm sure your Matrix
>provider
> > >would not take kindly to users causing these sort of problems and might
>even
> > >start implementing bandwidth caps to prevent abuse (cablemodem companies
>are
> > >doing this now to discourage everyone and their pet monkey from setting
>up
> > >warez ftp sites).

If you're doing your stealth stuff then hopefully your provider will never
know you're the one causing the problems.. best solution: Pay for a fake
account in cash, and use that for your less-than-legal stuff.. no reason to
think that way of doing things would change either.

> >I agree, you could technically spam them into oblivion. What are other
> >peoples thoughts on the technical merits of this? Without any data (at
ALL)
> >on how deckers connect to the Matrix (they have to have an account with
> >SOMEONE, even a fake one) it's hard to postulate how they could be traced
or
> >blocked.

What about public terminals that don't require a paid account to logon?

> > Trying to flood the networks in SR would be difficult if not impossible,
> > they are already breaking the Gigabit barrier in labs easily. Hell
>OC-48's
> > are theoretically beyond the gigabit barrier, don;t recall the exact
> > amount. Any DoS attacks (which is what is being discussed) would rely on
> > poor security, which can be a high probability, especially with a matrix
> > provider, going by most ISP's i deal with daily (I'm a systems
> > administrator for a consulting firm) i'd say security would be easy to
> > compromise for most Providers, now corps and Tier 1 (backbone) providers
> > eqivalent is a different story, they usually have the bucks to make this
>an
> > issue.

It's all a matter of degree.. even if they have an OC48.. you just need to
compromise a system on their network, or a system on an adjacent one.. or a
few adjacent ones if they have less bandwidth.

Also.. trying to knock super-pyramid off the net may just be nearly
impossible.. but knocking off anyone they're directly connected to and thus
isolating them?

You don't have to knock out a system or their upstream provider.. you could
try and knock off all of their downstream feeds.. same effect.. they're cut
off, if they're a backbone provider.

> > Setting up point to point lines is easily done, they could setup a point
>to
> > point connection (think dedicated T1 that only connects point a and B) and
> > disallow any traffic from external sources.
> >
> > One setup ive seen as used, internal networks run on a different set of
> > nics for the servers and outside traffic is restriced, setup is the main
> > issue, one could create an internal network that could be easily cutoff
>The
> > vanishing nodes thing in SR is a good eample of this on a level.

Could you explain this part a bit more?

> >
> > A setup i like is to have a firewall behind the router that disallow all
> > external traffic to a file server, the file server can only be reached
> > internall by a few addresses. In the case of an attack one could simply
> > lock down the firewall fully to protect internal systems.

That's assuming the firewall is secure, also.. if they compromise the
firewall machine.. they have free reign.

more to come when I actually start getting some traffic from the list..

From:	lomion lomion@*********.org
Subject:	Fw: The Matrix: Gearhead Discussion
Date:	Thu, 02 Dec 1999 21:40:56 -0800

Message no. 7 >
>Yes.. promiscuous mode. This will allow you to see any traffic on the
>immediate LAN segment that the listening NIC is on. It won't let you see
>any traffic across routers, smart switches, or any of that kind of stuff
>though.. so the further upstream the better.

Your correct, i should have been clearer..

>> > Most systems require root access to ping flood, plus some OS'es and
>> > hardwarew now will automatically throttle back if this is detected. DoS
>> > attacks run on more creative methods which do work.
>> >
>> > Something scary, a normal user inside a network could easily bring down
>>the
>> > network with a single command unless limiting is done. From the inside it
>> > would be cake.
>
>You may not even have to be on the inside.. with a misconfigured
>router/etc... smurf DoS attack anyone? Use their bandwidth against them.

I was using a simple example, a smurf attack would do just as well.

>> > Going with current trends and whats out there, you could concevably(sp)
>> > have it block ip's (or matrix addresses) on the fly if certain conditions
>> > occur.
>
>Blocking IP's wont save you from bandwidth problems.. just from direct
>exploitation.. even if you are ignoring their packets, they're still
>wasting bandwidth if they are sent to you.

good point, but it depends where you ignor the packets too i think (need to
double check on this.)

> > >I agree, you could technically spam them into oblivion. What are other
> > >peoples thoughts on the technical merits of this? Without any data (at
>ALL)
> > >on how deckers connect to the Matrix (they have to have an account with
> > >SOMEONE, even a fake one) it's hard to postulate how they could be traced
>or
> > >blocked.
>
>What about public terminals that don't require a paid account to logon?

I think public terminals would require a sin or credstick of some kind.

>> > Trying to flood the networks in SR would be difficult if not impossible,
>> > they are already breaking the Gigabit barrier in labs easily. Hell
>>OC-48's
>> > are theoretically beyond the gigabit barrier, don;t recall the exact
>> > amount. Any DoS attacks (which is what is being discussed) would rely on
>> > poor security, which can be a high probability, especially with a matrix
>> > provider, going by most ISP's i deal with daily (I'm a systems
>> > administrator for a consulting firm) i'd say security would be easy to
>> > compromise for most Providers, now corps and Tier 1 (backbone) providers
>> > eqivalent is a different story, they usually have the bucks to make this
>>an
>> > issue.
>
>It's all a matter of degree.. even if they have an OC48.. you just need to
>compromise a system on their network, or a system on an adjacent one.. or
>a few adjacent ones if they have less bandwidth.
>
>Also.. trying to knock super-pyramid off the net may just be nearly
>impossible.. but knocking off anyone they're directly connected to and
>thus isolating them?
>
>You don't have to knock out a system or their upstream provider.. you
>could try and knock off all of their downstream feeds.. same effect..
>they're cut off, if they're a backbone provider.

Yes this ties into what I was saying how you compromise a lower security
box connected to the target and go from there...

>> > Setting up point to point lines is easily done, they could setup a point
>>to
>> > point connection (think dedicated T1 that only connects point a and B) and
>> > disallow any traffic from external sources.

Well a point to point connection could not be connect to the Matrix.

>> >
>> > One setup ive seen as used, internal networks run on a different set of
>> > nics for the servers and outside traffic is restriced, setup is the main
>> > issue, one could create an internal network that could be easily cutoff
>>The
>> > vanishing nodes thing in SR is a good eample of this on a level.
>
>Could you explain this part a bit more?

Ok..Real world ways to do this:

1. If you just want to sniff packets without being noticed get an old nic
with an AUI connection and snip the outbound pins. Then you can only
receive. I know of a few ppl who have done this when they thought there
network was compromised.

2. Setup 2 nics in a server, one is internal only, using non routable
ip's. You also restrict at the gateway any internet traffic for the
internal network. Now if you neet matrix access it gets more complex, you
need to do some proxying to allow outside traffic in.
The vanishing SAN is something like this, it only opens up an external
connection between certain times.

>> >
>> > A setup i like is to have a firewall behind the router that disallow all
>> > external traffic to a file server, the file server can only be reached
>> > internall by a few addresses. In the case of an attack one could simply
>> > lock down the firewall fully to protect internal systems.
>
>That's assuming the firewall is secure, also.. if they compromise the
>firewall machine.. they have free reign.

Well yes, but firewall should be very secure, since thats your most obvious
point of entry.

When I get some sleep I'll be more coherent promise...

--Larry

From:	Asymmetric all@******.net
Subject:	The Matrix: Gearhead Discussion
Date:	Fri, 03 Dec 1999 01:01:10 -0500

Message no. 8 At 21:40 12/2/99 -0800, you wrote:
>>Blocking IP's wont save you from bandwidth problems.. just from direct
>>exploitation.. even if you are ignoring their packets, they're still
>>wasting bandwidth if they are sent to you.
>
>good point, but it depends where you ignor the packets too i think (need
>to double check on this.)

Well, whatever machine is doing the IP filtering will still be open to
having it's bandwidth wasted.. it has to recieve the packets to discard them..

If you're just pingflooding.. then you target a host well on the inside..
then wherever they decide to filter, the packets will only make it that
far.. and essentially target that hosts bandwidth.

>I think public terminals would require a sin or credstick of some kind.

Mmm.. I don't imagine "fake ids" being any harded to get in SR than they
are here.. they'll probably just validate the number with some sort of lame
check like they use on credit cards, and not actually check to see if the
information is accurate.. it's a waste of time, in most cases.

>Yes this ties into what I was saying how you compromise a lower security
>box connected to the target and go from there...

Yep..

>>> > Setting up point to point lines is easily done, they could setup a point
>>>to
>>> > point connection (think dedicated T1 that only connects point a and
>>> B) and
>>> > disallow any traffic from external sources.
>
>Well a point to point connection could not be connect to the Matrix.

This wasn't anything I said.. :)

>Ok..Real world ways to do this:
>
>1. If you just want to sniff packets without being noticed get an old nic
>with an AUI connection and snip the outbound pins. Then you can only
>receive. I know of a few ppl who have done this when they thought there
>network was compromised.

That's slick.. that would even defeat AntiSniff (L0pht product, god bless
those boys.. heh), but it requires physical access to the machine.

>2. Setup 2 nics in a server, one is internal only, using non routable
>ip's. You also restrict at the gateway any internet traffic for the
>internal network. Now if you neet matrix access it gets more complex, you
>need to do some proxying to allow outside traffic in.
>The vanishing SAN is something like this, it only opens up an external
>connection between certain times.

True.. we do this at my company, also.. our firewall has more outbound
rules than inbound ones since we're using NAT/DHCP to keep our inside stuff
secret.

>Well yes, but firewall should be very secure, since thats your most
>obvious point of entry.
>
>When I get some sleep I'll be more coherent promise...

ok.. heh.

Even if the firewall is super-duper secure.. still only takes one little
chink in it's armor to take it down completely..

I think the "snip the pins" thing has an even cooler application, btw...
for use as a log machine.. something the other machines actively send stuff
to.. like syslog messages.. that can't be deleted by some hacker, because
there is no interactive access to the machine.

just one service listening on one port, for syslog-type stuff.. and thats
it.. nothing else even listening that could possibly be exploited via
buffer overflow or something.

From:	Christopher Pratt valen@*******.com
Subject:	Fw: The Matrix: Gearhead Discussion
Date:	Sat, 4 Dec 1999 10:38:11 -0500

Message no. 9 -----Original Message-----
From: Asymmetric <all@******.net>
To: shadowrn@*********.org <shadowrn@*********.org>
Date: Friday, December 03, 1999 12:14 AM
Subject: Re: Fw: The Matrix: Gearhead Discussion
>> > >It's difficult to hide the origin of your traffic (yes it can be
>> > >done) but that's what Stealth represents eh? I'm sure your Matrix
>>provider
>> > >would not take kindly to users causing these sort of problems and
might
>>even
>> > >start implementing bandwidth caps to prevent abuse (cablemodem
companies
>>are
>> > >doing this now to discourage everyone and their pet monkey from
setting
>>up
>> > >warez ftp sites).
>
>If you're doing your stealth stuff then hopefully your provider will never
>know you're the one causing the problems.. best solution: Pay for a fake
>account in cash, and use that for your less-than-legal stuff.. no reason to
>think that way of doing things would change either.

Actually, I have a customer at the ISP that I work at, he has been with us
for years, we don't know his name, address, phone, etc...etc... He (or she)
always pays their bill promptly every month by money order. And nobody in
the company knows anything about this person other than their username...
>
> > >I agree, you could technically spam them into oblivion. What are other
> > >peoples thoughts on the technical merits of this? Without any data (at
>ALL)
> > >on how deckers connect to the Matrix (they have to have an account with
> > >SOMEONE, even a fake one) it's hard to postulate how they could be
traced
>or
> > >blocked.
>
>What about public terminals that don't require a paid account to logon?
>
actually, when I go to work (for an ISP), I just plug my laptop's ethernet
adapter into thier switch and that puts me live on the internet. No account
or validation. I always assumed that deckers would go to a phone company
switch (which by 2060 would be all matrix stuff), break open the casing and
plug themselves in. effectivly putting their system live on the matrix. Yo
u might need to do a little research (or bribery) to determine what sorta
addressing you need to use...

later
valen

From:	Asymmetric all@******.net
Subject:	Fw: The Matrix: Gearhead Discussion
Date:	Sat, 04 Dec 1999 13:58:31 -0500

Message no. 10 At 10:38 12/4/99 -0500, you wrote:

>Actually, I have a customer at the ISP that I work at, he has been with us
>for years, we don't know his name, address, phone, etc...etc... He (or she)
>always pays their bill promptly every month by money order. And nobody in
>the company knows anything about this person other than their username...

...

>actually, when I go to work (for an ISP), I just plug my laptop's ethernet
>adapter into thier switch and that puts me live on the internet. No account
>or validation. I always assumed that deckers would go to a phone company
>switch (which by 2060 would be all matrix stuff), break open the casing and
>plug themselves in. effectivly putting their system live on the matrix. Yo
>u might need to do a little research (or bribery) to determine what sorta
>addressing you need to use...

Two points I was striving to make. ;)

From someone who's had his share of cracking open telco boxes... ;)

Mailing List Logs for

Further Reading

Disclaimer