/cyb/ + /sec/ general: cyberpunk and cybersecurity: warcarting edition

/cyb/ + /sec/ general: cyberpunk and cybersecurity:
/cyb/ + /sec/ general is for discussion of anything and everything related to cyberpunk and cybersecurity.

>what is cyberpunk?
pastebin.com/raw/Jpci0dqD

>cyberpunk directory
pastebin.com/raw/HiTA1yXK

>nothing to hide? please.
youtu.be/pcSlowAhvUk

>cybersecurity essentials
pastebin.com/raw/0AjC2mcD

>cybersecurity resources
pastebin.com/raw/98vvNwcH

>thread archive
archive.rebeccablacktech.com/g/search/subject/cyb/

>thread backup
cyberpunked.org/

>previous thread
>>> Resources > /cyb/ videos
Cyberpunk Miscellaneous Videos: pastebin.com/cc3zmJ1m

>> /sec/
Learning: pastebin.com/VNTsyNKp
CTF/Wargames: pastebin.com/u2QTfmZn
News: pastebin.com/tDn5qzZE
Other useful stuff: pastebin.com/u21XrVaz
Essentials Pastebin: pastebin.com/UY7RxEqp
Books: allitebooks.com/
Network visualisation: dowse.eu/
Unofficial grsec: github.com/minipli/linux-unofficial_grsec/tree/linux-4.9.x-unofficial_grsec
Security tips in order of difficulty: pastebin.com/5XfDX4wL

>>Harden your OS, reroute your DNS and fire up the VPN - shit just got real
The Network of Global Corporate Control: journals.plos.org/plosone/article?id=10.1371/journal.pone.0025995

Suggestions for new resources are welcome. /sec/ is looking for CTF team members, contact at IRC channel.

>irc://irc.rizon.net:6697
join #Sup Forumspunk and #Sup Forumssec (requires SSL)

Other urls found in this thread:

qualys.com/2017/06/19/stack-clash/stack-clash.txt
pastebin.com/Ziit3aa1
journals.plos.org/plosone/article?id=10.1371/journal.pone.0025995
arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/
eff.org/nsa-spying
theregister.co.uk/2015/08/03/gchq_duncan_campbell/
web.archive.org/web/20150509144545/http://www.theguardian.com/technology/2015/may/01/encryption-wont-work-if-it-has-a-back-door-only-the-good-guys-have-keys-to-
torrentfreak.com/microsoft-patents-technology-to-block-pirated-content-track-repeat-offenders-170505/
arstechnica.com/apple/2007/08/aacs-tentacles/
firstlook.org/theintercept/2015/08/26/way-gchq-obliterated-guardians-laptops-revealed-intended/
boingboing.net/2016/06/15/intel-x86-processors-ship-with.html
itworld.com/article/2708437/security/ipmi--the-most-dangerous-protocol-you-ve-never-heard-of.html
activewirehead.com/building-a-cyberdeck/
instructables.com/id/Portable-PC-project-inspired-by-Shadowrun-Cyberdec/
en.wikipedia.org/wiki/OpenROV
youtube.com/watch?v=ii82I1IzFRY
tomshardware.com/news/rnc-data-198-million-american-voters,34827.html
lwn.net/Distributions/#secure
fortv.se/sv/FASTIGHETER-TILL-SALU/Fastigheter-till-salu/
twitter.com/SFWRedditImages

qualys.com/2017/06/19/stack-clash/stack-clash.txt

Well, I'll be adding that to the pasta also.
Thank you, user.

FAQ Incomiming...

Version 5 preview 1 of the alt.cyberpunk FAQ


pastebin.com/Ziit3aa1

Feedback and additions are welcome.

I'll remember that.
Thank you too, user.

This OP is great.

Thank you, user.

Good work.
I, for one, appreciate it.

It is hugely updated - the bit rot was impressive and sadly many good archives have been lost since they used a robots.txt file.

I am missing info on the old days like the Future Culture mailing list and Andy Hawkes.

It is a preview so I set the lifetime to one month. Further updates will come.

I am off to bed (Euro-dude here) but will be back in about 9 hours.

Thanks

I'll still add it to the pasta, for now.

The web browser project have plans for improving the security

Anyone have experience with nftables? Our security firm is moving over to Debian Stretch in 2 weeks and plan on using nftables instead of iptables.

(Used to use MacOS/CentOS)

I hope Sup Forums completes the first release of the browser.

Why are most penetration testing publications keyed toward solely Kali?

>>>Harden your OS, reroute your DNS and fire up the VPN - shit just got real
>The Network of Global Corporate Control: journals.plos.org/plosone/article?id=10.1371/journal.pone.0025995
Check these
arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/
eff.org/nsa-spying
theregister.co.uk/2015/08/03/gchq_duncan_campbell/
web.archive.org/web/20150509144545/http://www.theguardian.com/technology/2015/may/01/encryption-wont-work-if-it-has-a-back-door-only-the-good-guys-have-keys-to-
torrentfreak.com/microsoft-patents-technology-to-block-pirated-content-track-repeat-offenders-170505/
arstechnica.com/apple/2007/08/aacs-tentacles/
firstlook.org/theintercept/2015/08/26/way-gchq-obliterated-guardians-laptops-revealed-intended/
boingboing.net/2016/06/15/intel-x86-processors-ship-with.html
itworld.com/article/2708437/security/ipmi--the-most-dangerous-protocol-you-ve-never-heard-of.html

We definitely need to improve our security.

If these are all as good as they look upon a cursory glance I'll be adding them to the pasta too.
Thank you for sourcing them, user.
The more information we can pool, the pool thoroughly people will be able to teach themselves from the resources.

The network of corporate control is godtier though, make it apart. Maybe we need to counter with some open source designs for hardware and 3d printers or even open source computer and phones (on the making, but we can dream) to counter surveillance.

I support this wholeheartedly.
Open software isn't good enough, we also need an open hardware movement and not just computers, but as you say, 3D printers.

So, how're we going to go about this?

We find realistic projects to support? I think there was an open source phone called Phoenix. Maybe cyberdecks are closer to development though.

I heard something about the FSFs plans on making a commercial computer (laptop if I remember correctly) for free software, along with a free software BIOS and without the corporate backdoors.

I only found info on cyberdecks
activewirehead.com/building-a-cyberdeck/
instructables.com/id/Portable-PC-project-inspired-by-Shadowrun-Cyberdec/


Also found a curious underwater drone supposedly made from common parts en.wikipedia.org/wiki/OpenROV

Can't find information about the phone.

Is PowerPC viable in modern day?

youtube.com/watch?v=ii82I1IzFRY

wtf guys! what are they planning?

Why Firefox? Why not Icecat? I know it's based off FF, but it has some privacy features.

Me too. I hope it allows the user more control than current browsers. That and no bot net.

If it's a kick ass browser I'm going to make a moon man sign with a /net/ marque underneath.

We could always contribute toward the development of plans too.

They're still interesting, but there does need to be more interest into this.
Unless everyone always wants to be at the beck and call of corporations.

Agreed, it would be a handy tool.

Me too, and I hope they give more power of the processes underneath unlike other browsers.

I for one want to see someone making a cyberdeck that is affordable and functional.

Now I know how to make my millions.

A true GNU/Linux mindset.

We're living in a cyberpunk society RIGHT NOW and most people don't know it

A few years ago I skimmed through some of those books about buffer overflows shell coding reverse engineering and so on. But I saw that they no longer worked on modern systems because of all the new hardening techniques like address randomization and memory protections. And so I thought that it wouldnt be a good use of time to study further. Now it seems the frequency is increasing of huge major vulns are being made public and Im starting to wonder if I should regret not studying this in depth and also afraid if I start now it would take so much time by the time Im getting up to speed it would be too late.

Because there is nothing else worth using for pentesting.

Jesus Christ.

I have made this point several times and I don't feel like completely reiterating those points. However, one of the most cyber punk things I have ever seen was a homeless guy browsing the net on his cell phone. Sure, it wasn't in some dark, rainy, neon lit back alley, and on a sunny Saturday, but that doesn't mean it wasn't cyb as fuck.

We certainly are and will only become more obvious as time progresses.

Whilst some of those may no longer work on newer systems, there are always flaws in those systems that can be exploited.
Learning those base blocks and then moving on is the best way to start in the computer security field as it gives you better overall (and someone historical) understanding of the field as a whole.

What about BlackArch and ParrotSec (along with other security research distributions)?

This will become more and more common place. Besides, it might not've been immediately as /cyber/ as you would've hoped, it will become more so (as I said above).
Certainly as advertisement evolves ever more grandiose methods of attention grabbing.
Just look at cities like Tokyo, Vegas; Seoul and Beijing (to name a few).

what are some good cyberpunk anime?
I've watched lain and thought it was really good

Akira!
One of the most pre-eminent examples of cyberpunk in the anime/manga culture.
>It is also really entertaining and a personal favourite.

Anyone interested in creating an install script for hardened Arch with runit instead of systemd and all the daily use / dev / pentesting packages preinstalled with me?

You mean BlackArch, but without systemd?

I think very highly of Ghost in the shell, but at this point who hasn't watched the 1995 movie at the very least ?

Texhnolyze

and maybe to a lesser extent
Sunabouzu and Red Line the movie

haha, i've watched both of those as well!
Although I was quite under the influence while watching akira! I thought it was phenomenal and want to watch it more sober. I've only seen the first ghost in shell. Is the second one worthwhile?

>Akira is phenomenal
You've good taste, user.

actually good thread this time pls

>I've only seen the first ghost in shell. Is the second one worthwhile
Ghost in the shell spans several movies and has multiple seasons.

The movies and tv episodes range in their quality, I would say none of them are poor, but some are better than others.
The second movie largely gets passed over by many people as it doesn't hold well against the substance in the first movie, you've got nothing to lose by watching the second movie and/or everything else

There is a thread on /t/ for ghost in the shell

You do know it is these type of replies that normally set off the shitposting, right?

no

why can't I ask for a good thread

Lets talk about happier things, if you know what I mean.

Is full disk encryion including /boot enough or should I put a bios password aswell? Is linux-libre-hardened almost as good as linux-libre-grsec which is gone now?

bios password is a must and i can not speak for you other question

Now I have to reflash libreboot again.

How do you learn these basic building blocks when the books no longer work on modern systems? What I mean is that I couldnt even run the basic examples on a modern system. I have some old Debian 6 and CentOS 5 isos laying around but I dont think the examples from the books will even run on them.

eye doctor keeps telling me my retinas are going to detach if my vision keeps getting worse. do you think cybernetic implants without networking capabilities are just a pipe dream? i don't want my eyes getting hacked if i spend $100k on them. and i KNOW that they're going to want to have "automatic updates" and all kinds of bullshit streaming live to your implants. we need GNU implants

I guess it was either this thread or /sqt/ but,
I need a new U.S based VPN that isn't a major provider so I can still use certain websites and services that block major VPN providers.
What do?

I have relevant questions too. I've found a couple mail providers and want to know your opinion:
>Teknik
>cock.li
>ProtonMail

How would you categorize in levels of security? In the case of Teknik, do you think is secure enough to use its services? Who is the people behind teknik.io? Who is behind cock.li? Who is the people behind ProtonMail?

lavabit

have you considered go ogling these questions

the admin of cock.li is a wanted criminal and escaped from the US to Romania after being pursued by the FBI after he sent a chemical weapons threat to an entire school district in LA. he also was a heavily armed militia member. his server was hosted in Germany, and got raided by the German feds. twice.

nice

Patlabor

Agree on this man.

It's good to see a general on Sup Forums with actual information like this. Lainchan is impressed.

>what are they planning?
Umm, good coverage on multiple bands in multiple sectors, possibly by multiple carriers perhaps?

Fast mobile internet access does not come from a simple whip antenna.

The comments in that YouTube video is loaded to the brim with garbage. Like using Geiger counters to measure RF signals.

> tomshardware.com/news/rnc-data-198-million-american-voters,34827.html

gg america lol

When will they start handling their data properly?

All of this is pure uncontained stupidity and ignorance. That makes no fucking sense and does not even begin to address real world security problems.

>use top-tier crypto
>not used by big players
Does this fuckhead even understand how encryption on the Internet works ? Is he going to create his own shitty protocol and ask everyone to support it with TLS ?

What have they done to mitigate exploits ? Nothing is isolated, they want to make an HTML parser and a JavaScript engine but don't know fuck about how to secure them.

This project is a huge fucking joke made by people who don't know how a browser is made.

Why not spend the time to contribute to Devuan instead? There is no need for unstable/bleeding edge software when there is a focus on security.

>Is he going to create his own shitty protocol and ask everyone to support it with TLS ?
He never said that. It is perfectly possible to use alternative protocols developed in, say, credible academic circles. And preferably outside the US and UK.

Your outburst relies on top tier being a title bestowed by the big players. That is tragically naive.

Stand alone complex is the next best thing after the 1995 movie and it's a good halfway between the manga and movie

You set up your own lab, many of them cover this, so you can train yourself in whatever exploit without having to actually break the law.

Don't use a U.S based provider as they'll give up on a drop of a pin and I doubt any of them don't keep logs.

We'd like to see the return of classic Lainchan and the Lainzine.

Read again, the plan is reusing a js engine not creating one from scratch.

What is an email provider you guys use? I am sure you have to communicate in some way while keeping secure.

I'm not sure if Protonmail still requires JavaScript?
But it used to be pretty useful.

The dot Hack franchise has a lot of virtual world action you might like.

Also Dennou Coil is about hacking an overlaid virtual reality but many disagree with my view.

To make something good, be it a thread or the entire America, you cannot just *ask* and think that will be it. Instead it takes an effort and you will have to join in on it and on your contribution too make it great.

That is all.

>What I mean is that I couldnt even run the basic examples on a modern system.
There are distributions purposefully riddled with holes for such training.
lwn.net/Distributions/#secure

As said don't use US based provider
There others like Mullvad, AirVpn, Torvpn

Yes, it does

You can build without aslr enabled, but you might as well learn it, and you should be roping now anyways
None of these are insurmountable to learn, just write a simple test project with it enabled, and add a info disclosure to get your base address

That's a shame.

parrot OS is for 1337 haxors with the neon blue stuff. Kali just werks and offensive security has many certifications and guides. There's a reason Kali is used most in Labs and Universities.

Anyone get the Kali freeze where you boot into desktop and don't know what to do, like what to play around with? Not a noob at all but struggle with practical hands on stuff that I can actually learn from

Will bring a few racks of miners online next week. Bought a retired super computer for cpu mining.

>1000 bl465 g7
>2000 opteron 6276s
>$80k

stop using Kali Linux noob.

If you actually have 80k$ to spend on stuff and a place like that to store stuff do you even need to mine cryptocurrency?

Was this based on that nigger from Lain?

Well, its an easy $60k month.

I'll take it. Also, where does that happen to be? In some underground bunker?

What's a good password manager? Preferably one for android if at all possible. I currently have a password protected text file which has a rng password only I know, and then all my passwords are written down encrypted with a ceasar cipher, the key to which only I know also. If there's something a little easier that's still safe I'd like to just use that, plus then it'd be mobile

Yeah, bought it on a government auction, decommissioned cold war air command center.

So you're that bunker user from /diy/ I found while randomly browsing that board some months (year?) ago? Fuck, man, really loved your work. Aside from that what other cool things have you done there? Did you get a datacenter going or still plan to get it?

Where does one even get a bunker for cheap?

He actually got it pretty cheap I believe, for about 200k$ if I recall correctly.

One doesn't.

where do you sell that amount of bitcoins

Reminder that certs are for slow brain IT retards and real security fields don't have any

Turning on power next week. 2mw.

They put up military properties here for auction.

fortv.se/sv/FASTIGHETER-TILL-SALU/Fastigheter-till-salu/

Sometimes there are bunkers.

Just spread it out on Kraken and Bitstamp.

How do you have so much disposable income?