ROOTCON Blog

ROOTCON 5 is 31 days away, the question is have you planned what to do during the two day Hacker CON? Or should it be, do you have an idea what its like to be at a Hacker CON? Well to give you an idea, ROOTCON like any other Hacker CON on the planet it's an awesome venue for Geeks, Hackers, Developers, and all tech enthusiasts.

The first thing to look forward are the talks, ROOTCON has gathered several cool talks, the next thing to look are the games hosted at ROOTCON, if you are into hacking, wargaming, then this is your place, ROOTCON Folks crafted some cool Capture The Flag games for the CON, from WiFi, Web to Shell breaking we have it all, and its all free for ROOTCON attendees.

And the coolest part being at a Hacker CON are the Partehs, yes you heard it right, Partehs. After Day 1 there will be a Geek-Up and Ninja/Pirate/Geek Parteh that will be held, right after Day 2 there will be a post-con parteh as well. Hacker CON is the best time to socialize with our fellow G33ks and H4x0rs. This is the best part of the CON that you don't want to miss at all.

At the time of writing we are already planning these Partehs, you can even plan with us!!! Be updated with our Twitter (@_rootcon_) and our Facebook (https://www.facebook.com/rootcon). Our brainstorming and planning will be put to public at our ROOTCON 5 Google Groups (rootcon5@googlegroups.com)

Let the Partheh and the Hacking begins..........

Another awesome day at DefCon 19 . Today a 10 year old Girl hacker - pseudonym CyFi revealed her zero-day exploit in games on iOS and Android devices that independent researchers have confirmed as a new class of vulnerability. The 10-year-old girl from California first discovered the flaw around January 2011 because she "started to get bored" with the pace of farm-style games.

About CyFi :
She is cofounder of DEFCON Kids. CyFi is a ten-year-old hacker, artist and athlete living in California. She has spoken publicly numerous times, usually at art galleries as a member of “The American Show,” an underground art collective based in San Francisco. CyFi’s first gallery showing was when she was four. Last year she performed at the SF MOMA Museum in San Francisco. DEFCON Kids will be her first public vulnerability disclosure. CyFi’s has had her identity stolen twice. She really likes coffee, but her mom doesn’t let her drink it.

CyFi said, "It was hard to make progress in the game, because it took so long for things to grow. So I thought, 'Why don't I just change the time?'" Most of the games she discovered the exploit in have time-dependent factors. Manually advancing the phone or tablet's clock forced the game further ahead than it really was, opening up the exploit.

CyFi said that she discovered some ways around those detections. Disconnecting the phone from Wi-Fi made it harder to stop, as did making incremental clock adjustments. CyFi's mother, who must remain anonymous to protect her daughter's identity, told at the end of CyFi's presentation at DefCon Kids that they would offer a $100 reward to the young hacker who found the most games with this exploit over the following 24 hours. The reward is sponsored by AllClearID, a identity protection company that is also sponsoring the DefCon Kids.

CyFi revealed that she was only a little bit nervous about having to speak in front of the 100 or so expected attendees. She admitted that while it was probably different publicly speaking about a topic with such a specific focus, it would be hard for her to imagine what those differences might be. "Well, I haven't done it yet," she said.

Source: The Hacker News

ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

Las Vegas, Nevada (CNN) -- Dear hackers: The U.S. government wants you.

Or, at the very least, the Department of Defense's research wing wants to pay you to help it block cyber threats, a project manager at the Defense Advanced Research Projects Agency said Thursday.

Former hacker Peiter Zatko announced the start of a fund-the-hackers program, called Cyber Fast Track, in a keynote talk at the Black Hat conference, which is aimed at hackers and computer security experts. The program began officially late Wednesday, he said.

Experts say the government has done a lousy job in the past of getting money to security researchers quickly enough for them to actually help mitigate cyber threats. Or the feds have avoided dealing with hackers entirely.

"One of the ways I see fixing it is bridging the gap between the government and the hacker community," said Zatko, who goes by the handle "Mudge."

By "hacker," he doesn't mean criminal. He's referring to people who try to break computer systems with the goal of making them more secure. These people are sometimes referred to in the security industry as "white hats," as opposed to nefarious "black hats."

"We have all sorts of other criminals, be it in politics or finance, and those elements may be bigger than the criminal element in the hacker community," he said.

Other wings of the government appear to be courting the hacker community as well. The Federal Bureau of Investigation and the Internal Revenue Service both have booths set up on the expo floor here at Caesars Palace. Federal agents are so commonplace at this hacker conference -- and at another, called DEF CON, which happens later this week -- that some of the hackers have held a "Spot the Fed" contest, with T-shirts as prizes.

Law enforcement and hackers don't always play well in these arenas. Speakers at past Black Hat and DEF CON conferences have been threatened with injunctions aimed at stopping them from explaining how to hack into certain systems.

The hackers say they're making public such exploits for the public's own good. If they can find the bugs, then bad guys who want to steal information and make money could, too.

In an interview after his talk, Zatko declined to say how much money DARPA will put into the new program, or how big the individual grants will be.

The goal is to fund independent security researchers, who currently do much of their work on nights and weekends without pay, in hopes that they will help make the Internet safer.

One of those hacker-researchers is Dino Dai Zovi, who says his girlfriend gets annoyed that he spends almost all of his free time on his computer.

"Look at the bags under my eyes -- I never stop working," he said.

Dai Zovi said the DARPA program will help hackers actually get paid for their work.

The stakes for the new program are also high.

Zatko, the hacker-turned-DARPA official, said the number of malware attacks continues to increase even as government agencies spend more money to stop them.

In 2000, he said, there were about 1,400 "incidents of malicious cyber activity." Nine years later, that number had jumped to more than 71,000.

Current computer systems are needlessly complicated, he said, which leaves them more open to malicious hacking. He suggested that researchers work, for example, to simplify Microsoft Word with its list of 3,000 fonts and many potential exploits.

Zatko, whose notable life as a hacker has been the inspiration for fictional characters, said he's trying to change how the government works from the inside.

"I hope the old Mudge of 1999 is looking at the current Mudge of 2011 and saying, 'Yeah, you're wearing a pocket square and you don't have long hair,' " he said, " 'but, yeah, you're still remaining true to the cause.' "

Source: CNN

ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

Las Vegas, Nevada (CNN) -- Joseph Horman already had seen the lock-picking videos on YouTube. But it was a different thing entirely for the 13-year-old puzzle-lover to get lessons in lock picking and computer hacking at an event sanctioned by adults.

The world's largest gathering of computer hackers -- DEF CON, which is happening this weekend at the Rio Hotel and Casino in Las Vegas -- held its first-ever hacking classes for kids this year, at an event appropriately called DEF CON Kids.

Sessions in hacking were designed for kiddos ages 8 to 16.

A common parent's reaction to something this might be: They're teaching them what?! But hear these hackers out. Their intentions are good.

Take Horman's uncle, Adam Steed, a computer security professional in Salt Lake City, Utah, who brought his nephew to these training sessions because he already was fascinated with games and coding. (He actually has written his own computer game, called "Blooks," in which players "try to build as many buildings as you can while avoiding enemies," he said.)

"You can watch lock-picking videos on YouTube, but where do you hear the ethical side of this?" said Steed, the uncle. "Not on YouTube."

He added: "I would rather someone learn in a controlled environment. They're going to learn it anyway."

Horman, the video game-writing nephew, sat attentively in the second row of a small classroom on Saturday, fiddling with a Rubik's Cube during sessions with titles like "Secrets Revealed," "Meet the Feds" and "Google Hacking."

That last class title is a bit misleading, since instructor-hacker Johnny Long focused more on non-technical hacking -- looking at people's laptops over their backs in airports; picking locks with toilet paper rolls and pen caps; and digging social security numbers out of corporate trash bins -- instead of actual search-engine hacking.

Long went to great lengths to remind the kids in attendance that the point of the class was to teach them what bad guys might be doing -- and how to avoid breaches in their own security or privacy.

"Don't let me catch you guys stealing toilet paper and breaking locks," he said. "If you do, it's not my fault."

Horman said he would only pick a lock if his family got locked out of their own house or car. That's happened before, he said, so that skill might be handy.

"Our family has had some trouble with locks," he said, smiling. "Let's say the younger ones love playing with the key and slipping them under the door."

In the "Meet the Feds" session, representatives from NASA, the Department of Homeland Security, the National Security Agency and the Navy told the kids they were smart to pick up hacking skills early because the government needs employees who can hack.

Several kids raised their hands to ask about hacking as a career path.

Part of the potential confusion about DEF CON Kids comes from the very term "hacker," which people here use to refer to anyone who has the skills needed to modify computer software and hardware. Some hackers extend the domain further, to locks and such.

Those skills could be used for criminal activity, but quite a few DEF CON attendees are actually computer security professionals -- the "good guys" trying to make the Internet less vulnerable to attacks by computer criminals.

Still, all this talk about malicious hacking made 10-year-old Dennis Mikhaylov a bit nervous.

"I'm getting a locker next year," he said after one of the class sessions. He's about to start middle school. "I thought it was cool, but now I'm afraid someone might open it."

Mikhaylov said he'd deal with this by keeping any valuables, which he defined as anything with his address on it; textbooks; and his Nook e-reader, which he apparently carries around all the time, out of that school locker.

The DEF CON Kids event also included a competition, where kids went around the hacker conference trying to break codes and solve puzzles.

Isabel Holland, 10, made up one-half of a team called "Sonic Death-Monkeys," a name she says is "weird" but went with because the boy who was her partner chose it.

"You have to, like, find people, and it's really hard because they're all over the place," she said of one piece of the challenge which required her to search out hackers.

Her dad, Bo Holland, from Austin, Texas, said it's cool for kids to get a chance to see how the technology and video games they use all the time actually work.

Ultimately, it will make the kids safer, he said, especially in this age of social networking, when the collective memory of the Internet has no expiration date.

"You're building up your reputation and it's not going to go away. If you do bad things, that's going to stick with you," he said.He added: "You can say, 'Oh, we don't want to hear how this (hacking) stuff works and that's scary ... but it's really important kids know how to protect themselves."

Source: CNN

ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

Relax.

I know I have your attention now. Take a deep breath before I continue with this story.

I just arrived at my pad at around 11PM (Saturday, August 6) after a meeting with an old friend.

Like you, I always check my emails every now and then. So I jumped in front of my working table, turned on my laptop and hurriedly checked my emails. Whoa! Alas! Look what I found?

How do you react if you receive an email from a friend with a subject line - “My Gmail Got Hacked”?

I know…

Below is the screen shot of the message I got from my friend. I hid her family name, email address and her friend’s name who is a System Administrator to protect their privacy.


Yes, it’s a big nightmare if someone else is in control of your email accounts whether it’s Gmail, Yahoo or Hotmail. Worse if it’s your company email address! Argh!

Here are some options that you can do:

1) Act immediately, don’t wait.
2) Change the password.
3) Check your sent items / sent folder
4) Contact your Email Support Team (e.g. Google Support Team).
5) Check your other email accounts.
6) Send an apology to all your contacts like what my friend did
7) Pay it forward. If you receive similar incidents, advice your friend to minimize damage.

Have you been in this situation before? How did you handle it?

Oh BTW, what’s your comment about this line on her email:


Is it the fault of Gmail or the user?

Share your thoughts.


About the Contributor:
A self-confessed blogger minus the coffee. He maximizes his skills in consultancy, project management, professional networking, social media campaigns and very active in conceptualizing things. To date he already conducted several IT / Information Security events as his passion since 2007. Currently he's working as a Technical Support Specialist in a local company.

There’s an angel watching over your child on the Internet.

“Project Angel Net,” a 24/7 operation center and website aimed at fighting online sex predators and cyber bullies, was launched on Thursday by the Criminal Investigation and Detection Group (CIDG) of the Philippine National Police (PNP).The CIDG head, Director Samuel D. Pagdilao Jr., said Angel Net sought to protect children from cyber criminals involved in online pornography, gambling, and identity theft, as well as ordinary netizens who bully or take advantage of others.

The launch of the website www.cidgangelnet.ph coincided with the opening of the CIDG’s anticyber crime operation center, Pagdilao said.

The website, officials said, will serve as a complaint center where people can directly report incidents of child abuses related to the Internet.

As of Thursday, however, the “contact us” section did not yet have a mechanism where people could just type in their complaints. It only had the addresses and phone numbers of the operation center.

Tips to parents

The website will also feature warnings about the dangers of Internet addiction among underage kids, as well as tips for parents about keeping their children safe online.

At the launch, Pagdilao noted that even his 8-year-old son was addicted to computer games. “When I return home from work, I notice he’s still glued to the computer screen,” he said.

“As a parent, first, I have to orient him on the old way of disciplining children, which is imposing time and limits,” Pagdilao said in an interview.

“Second, we have to encourage him to engage in other activities; take him to some other place; and third, you have to point out those sites that he should visit safely,” he told reporters.

20 million users

The Philippines is ranked 17th among the nations with the highest number of Internet users, according to the CIDG’s Anti-Transnational Crime Division chief, Senior Supt. Gilbert Sosa.

Records compiled by the CIDG showed that Internet users in the Philippines went up to 20 million in 2010 out of a population of 99 million, representing a 29.7-percent penetration share and a startling 1,385-percent increase from 2000.

“Accordingly, more than 50 percent of Internet users are minors aged 17 years old and below,” the CIDG said.

“Apparently, every house that has a computer is a potential victim of Internet crime. At present, abuses through social networking media are increasing at an alarming scale,” Sosa said.

Tracking predators

Felino Castro V, the director of the Management Information Service of the Department of Social Work and Development, said the 1,000-fold increase in Filipino Internet users from the last decade had amplified the need to protect children.

“We have received complaints of children being sold online… There are children being bullied… and eventually, if we look at our laws, we just have to coordinate among our law enforcers and they will be able to curb this trend,” he said.

The operation center at Camp Crame is equipped with computers and manned by trained technical operatives. It is seen to enhance the capability of the CIDG to monitor and track cyber predators. A walk-in complaint desk will be run by the Women’s and Children Protection Division.

Pagdilao noted that in spite of several incidents of crimes committed through the Internet, “these crimes have been hardly reported and acted upon” because there was no specific PNP unit to accommodate reports on cybercrimes.

Digital tracking

“Adding to that is the fact that law enforcers have limited resources and ability to confront Internet-related crimes,” he said.

“Confronting crimes of this nature cannot be dealt with traditional anticriminality operations, especially with the kind of situation law enforcers find themselves in,” Pagdilao said.

“It is for this reason that the CIDG is exploring other avenues beyond common investigative and detective work to properly address the problem that is bounded by the intricacies of Internet,” he added.

According to the CIDG chief, Angel Net will involve “24/7 digital tracking, collating, collecting, archiving, investigating and interdicting activities that will identify Internet predators.”

The result would be “the proper documentation of their corresponding illegal activities leading to their subsequent arrest,” Pagdilao said.

Angel Net will coordinate and cooperate with other stakeholders, such as the media, Internet service providers, schools, nongovernmental organizations, rehabilitation centers, youth groups, social welfare offices, and telephone companies, as well as the Interpol and the United Nation Children’s Fund.

Site of choice

In June, the CIDG noted an apparent upward trend in general computer crimes in the first half of the year, particularly identity theft, libel, estafa (fraud), harassment and hacking.

Walk-in complaints to the agency about computer crimes from Jan. 1 to June 14 numbered 56, just 26 cases short of the total for the entire 2010.

Of the complaints, Facebook was the social networking site of choice of most of the perpetrators, with six cases each of estafa and libel, three each of harassment and hacking, and five identity theft cases for the first six months.

Two complaints for pornography were also registered in that period.

There were also complaints involving personal e-mail (five complaints), the microblogging site Twitter and Multiply (one each), and the online auction site eBay.

Eleven complaints for threat involving cellular phone use were also recorded during the same period, up from the four cases recorded the whole of last year.

On the other hand, only two credit card fraud cases were recorded in the first six months, compared to six in 2010.

But the figures covered only the walk-in cases directly reported to the CIDG. The agency will have to coordinate with other units and the local police to collect other data.

Source: Inquirer

ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

[August 4, 2011 @ 1:10AM] I was working past 12 mid night when all of a sudden somebody tipped me on Yahoo Messenger about a newly defaced government website. Below is a screen shot of the defaced site of the City Government of Tagbilaran:

One may ask, “Is there a backdoor shell behind this page?”

It is noticeable that there is a high trend of government sites that are regularly targeted by hackers in order to display political reasons; many defacers do it just for the thrill.

But the bottom line here is why it is happening every now and then? Is it to provoke your IT guys or to test how secure your website is?

Statistics shows that there will be more attacks to come. You should be ready to defend yourself. I’m not saying that you should just sit there and think.

It is true that hackers love technology and breaking your security. They are always one or two steps ahead of you but how do you prevent this from happening?

In one of my meetings with the founder of ROOTCON, especially when Semprix and I were invited by http://www.techtalks.ph/ to share about Information Security, Semprix shared a very striking example of how a hacker thinks about technology:

“To ordinary people, you see this spoon or fork as a tool for eating. For hackers, they look at it as a conductor for electricity.”

…and that is the reason why ROOTCON is about bridging these two worlds.

We all learn from each other when your views and opinions are shared.

What are your recommendations? Share your thoughts.

Related Blogs:
[Hacked] Lapu-Lapu City Government website another victim
Philippine Congress Hacked by BashCrew for #AntiSec
Hacker group strikes again, wishes Aquino good luck at SONA
PHL hackers deface PNRI website, hint at more attacks
Catholic Bishop’s Conference of the Philippines (CBCP) website defaced anew
US gov't eyes recruiting hackers
PHL gov't to assess website security in response to hacking
Hacker defaces Customs website amid gov't warning vs hacking

Disclaimer Notice
We will archive defaced websites and it is appropriate that ROOTCON should have a Disclaimer Notice.

To read the complete Disclaimer, click here.

About the Contributor:
A self-confessed blogger minus the coffee. He maximizes his skills in consultancy, project management, professional networking and very active in conceptualizing things. To date he already conducted several IT / Information Security events as his passion since 2007. Currently he's working as a Technical Support Specialist in a local company.

ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

WASHINGTON, Aug 2 (Reuters) - The US National Security Agency has a challenge for hackers who think they're hot stuff: prove it by working on the "hardest problems on Earth."

Computer hacker skills are in great demand in the U.S. government to fight the cyber wars that pose a growing national security threat — and they are in short supply.

For that very reason an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.

The National Security Agency is among the keen suitors. The spy agency plays both offense and defense in the cyber wars. It conducts electronic eavesdropping on adversaries and protects U.S. computer networks that hold super secret material — a prize target for America's enemies.

"Today it's cyber warriors that we're looking for, not rocket scientists," said Richard "Dickie" George, technical director of the NSA's Information Assurance Directorate, the agency's cyber-defense side.

"That's the race that we're in today. And we need the best and brightest to be ready to take on this cyber warrior status," he told Reuters in an interview.

The NSA is hiring about 1,500 people in the fiscal year which ends Sept. 30 and another 1,500 next year, most of them cyber experts. With a workforce of just over 30,000, the Fort Meade, Maryland-based NSA dwarfs other intelligence agencies, including the CIA.

It also engages in cyber-spying and other offensive operations, something it rarely, if ever, discusses publicly.

But at Defcon, the NSA and other "Feds" will be competing with corporations looking for hacking talent too.

The NSA needs cyber security experts to harden networks, defend them with updates, do "penetration testing" to find security holes and watch for any signs of cyber attacks.

The NSA is expanding its fold of hackers, but George said there is a shortage of those skills. "We are straining to hire the people that we need."

MISFITS OR FIT-INS?

It might seem to be an odd-couple fit — strait-laced government types with their rules and missions trying to recruit hackers who by definition want to defy authorities.

George said the NSA is actually an environment where the hacker mindset fits right in to work with "a critical mass of people that are just like them."

But what about culture rifts?

"When I walk down the hall there are people that I see every day and I never know what color their hair's going to be," George said. "And it's a bonus if they're wearing shoes. We've been in some sense a collection of geeks for a long, long time."

The agency has long been known for its brilliant, but sometimes eccentric, mathematicians and linguists.

Jeff Moss, a hacker known as Dark Tangent, knows something about bridging the two worlds. He founded Defcon and the companion Black Hat conference for security professionals and is now a member of the Department of Homeland Security's Advisory Council, which advises the government on cyber security.

"They need people with the hacker skill set, hacker mind-set. It's not like you go to a hacker university and get blessed with a badge that says you're a hacker. It's a self-appointed label — you think like one or you don't," Moss told Reuters.

He drew a distinction between hackers with skills and computer criminals. Of the latter he says with a laugh: "It would not be good to let them in your front door."

Moss worries about young hackers who might cross lines and end up breaking laws that did not exist when he got his first computer in the early 1980s.

"You can absolutely learn the same skills without breaking any law," he said.

While U.S. intelligence agencies' computer systems are believed to be relatively secure, a wave of recent cyber attacks has hit the Pentagon, major defense contractors and others such as the International Monetary Fund.

The NSA's tasks include helping the Homeland Security department secure civilian U.S. government networks.

One government bureaucratic hindrance that can impede hiring top-flight experts is the security clearance process that can take six months, by which time a candidate may have found other employment. For the NSA, prospective employees must pass a lie-detector test, be drug-free for one year and undergo an extensive background check.

BEWARE 'ANKLE BITERS'

Unlike the threat from nuclear weapons where it is clear which countries have that capability, cyber attacks can come from anywhere.

"So we need to worry about everybody," George said. "In fact we need to worry about significant adversaries hiding among the ankle biters."

He explained that it was like finding a single needle in a pile of needles — much more difficult than in a haystack. Among constant pings from teenagers just fooling around, "the real bad guy can hide in that noise," George said. "That's a big problem for us, trying to identify the real threat from among all the stuff that's not really threatening."

George would not name countries that pose high threats but other intelligence officials have expressed concern about China's growing cyber-warfare capabilities, as well as Russia's.

The NSA can attract hackers to work within its cloistered walls by dazzling them with the latest technology, appealing to their competitive nature, and giving them a sense of working for the greater good, George said.

"We have a wonderful atmosphere, we have great people and we have the hardest problems on Earth. And we need help, the country needs help," he said.

But there is one big difference about winning bragging rights at public competitions versus inside the NSA enclosure.

"You're not going to make yourself famous working here, that's the downside. You can be internally famous, but you can't be externally famous," George said.

The NSA's secretive nature also brings a positive side-effect in striking a work-life balance.

"If you come here you really can't take work home with you," George said. "That's a bonus." — Reuters

Source: GMA News

ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.

The Philippine Goverment has become the latest target in the #antisec operation by a foreign hacker team known as BashCrew. The Philippine Congress Website (http://www.congress.gov.ph/) was hacked and some of its data were leaked. The leak has personal information, emails, contact numbers etc via pastebin.