full-disclosure - Re: High Value Target Selection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 06 Dec 2007 16:59:58 -0500
From: gmaggro <gmaggro@...ers.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: High Value Target Selection

>> Really, how much trouble could we get in if we posted up a list of
>> street addresses, each address being a building that contained
>> significant telco and/or routing infrastructure?
> 
> try it, it's amusing.  remember the all the photogs getting hassled by the
> man for merely taking pictures of bridges and plants and such?
> 
> if you're actually effective at amassing a good database of infrastructure
> information you'll get the attention you so desperately crave; i promise!

Yes, but stuff such as the cryptome eyeball series
http://www.eyeball-series.org exist, though I do not know what kind of
problems or requests they have been subjected to.

They mention stuff on there such as the (alleged?) Sprint NAP at 4101
Maple Avenue, Merchantville, NJ. Map co-ords 39°56'55.90"N, 75°
3'56.72"W for you google maps and google earth people. Or a quick photo
link at http://cryptome.org/sprint-map-01.jpg

Love that kind of thing.

Who knows how accurate the intel is, however - it ought to be confirmed.
 It sure would be neat, but would it be useful, to then cross index it
with routing and assorted information? Something sounds enticing about
being able to easily pull up a list of locations, get a (literal)
picture of them and then within seconds be poking around in their space.

Clearly the info exists, such as software like
http://www.maxmind.com/app/city. I haven't used nor do I know how
accurate it is. Now if only folks like that got cracked and the data
posted on usenet. And there's all kinds of visual traceroute tools, none
of which I have ever been satisfied by.

Some kind of free and open yet accurate, updated network image overlay
for Google Earth would be nice. The data would be generated from
different sources, ideally as many (useful) protocols as possible,
customizable, etc. Press a button and various zones become coloured
according some user definable logical and/or physical network
characteristics.

Starting to sound too theoretical now ;) At least the PLC, SCADA and
related hacking is a nice concrete diversion. Time to sharpen up your
lock picking skills and look for the little telemetry shacks in your
area, such as by rivers and lakes, railway lines, etc. Pack a notebook
with the appropriate tools (nmap, sniffers, etc) and start collecting
info; fingerprint it, snmpwalk it, etc. Note makes and models, part
numbers, etc. Grab frequency and modulation info for the RF stuff.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/