But, fact is DNS is insecure by design. Doesn’t mean I am interested in the actual release of details though.

I was politely asked by Dan to discontinue this conversation and I respect that. I suspect that it is not because my thoughts are any closer to the real thing but mainly because he doesn’t want to cause too much chaos. So we will wait until BH and will see what is going to happen.

cheers

If he had the resources to mass spoof 3 nameservers X amount couldn’t he mass spoof 1 nameserver 3X amount (disregarding packet loss).

It doesn’t seem that advantageous. Now, I have little experience with DNS, so I may be wrong; there are not that many nameservers in each recursive chain to make the whole system fundamentally flawed. I believe Dan is leveraging this in some other way.

What do you think, PDP?

this means that Dan spoofs responses for the first or any other DNS server of the recursive chain. I suspect that he might do something like a mass spoof for each ns server of the chain, thus increasing the chances of getting the right transaction ID.

My take is that Dan is simply blasting all the name servers in the recursive chain until one of them has a transaction ID that matches any of his requests. I suspect, although I haven’t tried, this is very much doable.

I personally believe this is the key.

as a 100% noob to any sort of pentesting and to linux fullstop. then being able to understand what they are for will take a little more time than is expected. as compared to a person who is a veteran such as yourslf. you, i suppose have been running and writing script for years and i however have been learning for like three months starting from the very beginning.

i do believe there was a time in your life where you knew absloutley nothing about programming or pentesting. only problem is i just wanted to learn how to make my ap more secure. but now the realisation of just how much there is to learn about, not only the bthh but about all aspects of programming, pentesting and remote exploitation has got me studying perl, c++, backtrack, ubuntu and anything else i find and feel that is relevent. i diddnt mean to sound twatish but i got no direct replies which is what bothered me. so sorry for being upperty but as i say all i wanted was to make my ap real secure. i thought there would be a simple explaination of how to do this but i was wrong. as there is (which i know now) no simple explaination as without knowlege of what hackers can do then basically your screwed.

so i appologise once again if i offended.

if i had of gotten an answer when i first posted that these tests were written to be used within linux then i would of not asked such rediculouse questions.

is there a forum on gnu citizen you could suggest i take a look at. like a newbie area or similar. something basic to build my knowledge.

To suggest we’ve not tried to be helpful is both untrue, and frankly rather rude. Some commercial products receive less support than you lot are getting.

If you can’t understand the processes described above, then you WON’T make any progress with this. Give up.

I only came here to mention the new BTHomeHub 2.0 and to ask if anybody has one yet, but seeing comments like yours from ungrateful people who have made NO effort to understand the subject matter really does annoy me.

You can bet your bottom dollar that if you DO get it working, you won’t bother posting your solution and we’ll never hear from you again.

Weak guys, real weak.

Ed

As well as haveing the functions such as techStore, techDspider, techMutate etc?

Thanks

I don’t think anyone else is worried, and you should now be either. I’ll solve your insomnia right now.

An RSA key of 1024 bits has to be factored to be broken. We rely on the difficulty of this task in order to keep our transmissions secure.

It takes an estimated 10^12 MIPS*years to break an RSA key of this size. At a terraflop a piece (1,000,000 MIPS) it would take 1 computer around a million years to break RSA. Now, if we assume our culprit can buy 1,000,000 such computers and wire/program them to work together, it could be cracked in one year.

Thankfully this is unlikely to happen. No worm is going to be spread that can take advantage of the full CPU and also not get noticed and taken out. The budget of the individual behind this would in the hundred millions or billions at least.

So lets say we really get scared of this happening. We’ll up standard key size. Against a 2048 bit key, this scenario looks (2^1024 times) even more unplausible. Against a 4096 bit key, this looks absurd.

Before any one can break RSA, we’ll have moved onto elliptic curve.

there is a step by step at the top of the thread posted by edward pearson. which i am afraid is the only one you will find.

i have also noticed that ppl on here like not to be asked questions. i have posted twice already and got no reply to any of my questions.

i personally just went on to use backtrack linx and sorted it that way if you ask me personally it sucks to not get a reply in a forum but this ones a bit strange.

any way good luck on finding some info. by the way i believe running the scripts within linux it the answer.

There is a lot of noise around Web2.0 security. But I am observing fundamental shift of the personal computer hardware that will make the current security practices obsolete virtually over night. At the same time I don’t hear anything about it.

Any person that keeps track of the latest video hardware knows that Nvidia just released a GPU with 1.4 billion transistors. Its performance is estimated to be about 1 Teraflops. That is a super computer. The main purpose of the GPU is to decode video and graphical information. At the same time there is war between Intel and GPU manufactures like AMD and Nvidia. As result of this war the GPU manufactures are opening their hardware to be used for general computing tasks. There are prototypes from Adobe for video transcoding accelerated by the GPU and results are very impressive. Those applications are still not available, but there is a project called “Folding@Home” (http://folding.stanford.edu). They already have high performance client that are using GPU. The GPUs are many, many time faster then regular CPUs in some tasks. What is the common between video and folding proteins is that both are very scalable across parallel GPU. As far as my limited knowledge there is one more task that shares the same characteristics - encoding and decoding any data, especially in the case of missing encryption keys. Every one knows that any encryption can be broken if you have unlimited time and computation power. Now what will happen when someone writes an encryption cracking tool that uses the latest Nvidia GPU?!

Is anybody else having sleepless night because of it?

It will be slower as I can’t be bothered to figure out the Vista equivalent of the WMI part.

But it works :)