Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: What the UK government care about in a hacker
From: n3td3v <xploitable () gmail com>
Date: Thu, 26 Jun 2008 22:45:53 +0100

On Thu, Jun 26, 2008 at 2:08 AM, n3td3v <xploitable () gmail com> wrote:
I think we've gone beyond the F-Secure has said stage, I think folks
are looking for something more. I think the security space has evolved
already in respect of home user hackers, the security professional
circuit and with the government.

Infact the government are finding it hard to keep up with what's
possible by the government and what's technologically possible by joe
average in his bedroom.

A few years ago it was impossible for joe average to shoot the live
scene of a national emergency via his cell phone, email that footage
to a national television station and that to be used as prime time
evidence of the incident, now it is.

With this I look onto the media, its still using F-Secure press
releases for its news round.

Your average joe is now able to creep behind the media wall and get
the news before the outlet gets time to read up.

The fact, the media is becoming less important in the security arena
for bringing us news.

Your average joe can configure google.com/ig to give them keyword news
thats coming onto the news wires and google.com/alerts can too.

What used to be a government fundamental for the intelligence
services, is now becoming a challenge for them to know what user is
signed upto what and how much they know.

Before it was more straight forward, they would know what news sites
were available as civilian intelligence sources but now its becoming
less obvious.

The intelligence community are having to dig deep into online
community to see what is possibly being plotted and what sources of
information they have and the technique in which its gathered.

Today the world is changing, what used to be charted water only
reserved for the intelligence services is now also being used by the
civilian population.

It's scary times, hackers have the best ability to over come the
intelligence services, not the script kids, but the hackers!

The main focus for the British intelligence service is mobile and
anything to do with radio frequency hacks, including RFID type stuff,
that's high on the British government look out.

The media are hyping about mobile phone worm, while this hype *is*
unfounded right now, thats not to say its not top on the British
government's watch list of most desirable vulnerability threat vector
against national infrastructure of government and civilian population.

The hax0r credibility score board from the government's point of view
isn't hacks in safari, fire fox or internet explorer, its
telecommunications and radio frequency hacks right now.

So while you and your friends might think browser hacks, etc.. think
again, the real stuff that gets the UK government interested in you is
radio, mobile and chip hacks, anything to do with electronics and
communication, they don't actually give a fuck about applications, DNS
hacks, Cisco router hacks and the like.

While those things like  DNS hacks, Cisco router hacks and the like
are internet critical, they aren't national security critical...

So hackers, if you want the most hax0r credibility points and
attention with the UK government, think national infrastructure, radio
frequency, chip hacks and mobile telecommunication interception.

If you want head hunted into the UK government cyber defensive,
offensive and research departments go for those vectors... keep away
from silly stuff like web browser hacks, DNS poisoning, Cisco etc.

How will the UK government contact you? Brute guys will jump out of a
range rover land rover which will have darkened windows and will give
you an offer you can't refuse after abducting you for five minutes
based on your research post on Full-Disclosure.

All the best,

n3td3v


---------- Forwarded message ----------
From: n3td3v <xploitable () gmail com>
Date: Sun, Apr 20, 2008 at 10:42 PM
Subject: GSM Researcher stopped at Heathrow Airport by UK government officials
To: n3td3v <n3td3v () googlegroups com>


I was leaving today from the United Kingdom/Heathrow airport. I am
about to speak at the HITB IT security conference about GSM security
and the USRP (gnu-radio project).

I was searched by the UK government while waiting at the Gate and
reading a newspaper. A UK Government employee flipped his badge and
said "Let's talk. Come over here".

They detained my USRP (Software Defined Radio), my mobile phone and my
personal SIM card.

They did their homework. They knew who I am, where i live, which day I
speak at the conference and who I work for.

I'm involved in the GSM software project where we also developed a new
attack against the GSM encryption A51. We published our research in
February at the Blackhat security conference in Washington DC.

I understand that the government wanted to make sure that I'm not
exporting any cryptanalytic device.

I did not. I will not. The USRP is a radio. My mobile phone is a
normal nokia 3310 phone and my SIM card is a sim card.

They said they do not know what the USRP is and that I can not take it
until they have checked it in the lab. This can take 14 days (1/2
month).

So be it. They have it for 14 days. Guys, enjoy the device! It's fun
playing around with it!

I'm uneasy that they took my mobile phone and my sim card. Having a
pregnant wife at home and not being reachable complicates my
situation.

Is this common practice? Are they allowed to do this?
Any tips how I can get my mobile phone and my sim card back quicker?

Our project: http://wiki.thc.org/gsm
The USRP is available from http://www.ettus.com
The GNU RADIO project: http://www.gnu.org/software/gnuradio


stunning,

THC
---
Appendix: Surprisingly they did not detain my laptop or my paperwork
which would be the most likely place to store any information related
to cracking A51. They were also not interested in my 160GB harddrive
which would have been the obvious place for storing the rainbow
tables. Neither were they interested in the high performance FPGA
chip.

Instead they took all equipment that could have been used for
demonstrating that GSM signals can be received with publicly available
hardware for 700 USD.

It does not appear that they were after cryptanalytic information.

I received a yellow paper about my detained goods. They left the field
blank that reads
"The goods specified below are detained for the following reason:". What reason?

They also crossed out the field "Agent" of the officer who was in
charge of the operation.

---
UPDATE 2008-04-18
Arrived back at Heathrow. Airplane crew announced "All passengers
please have your passport ready. There is a passport check while
leaving the airplane. Passenger Steve Mueller please make yourself
noticeable to the crew. Steve Mueller please."

They told me at the gate that I can get my equipment back. I had a
chat with them and they answered many of my questions. They did not
answer who requested that I should be searched when I left the
country.

I'm happy that I got my equipment back and I appreciate that they had
it checked out quickly.

I'm still not sure why they took exactly the radio receiver parts. I
had to change my presentation for the conference and was not able to
demonstrate the USRP/gnu-radio.

http://blog.thc.org/index.php?/archives/1-GSM-Researcher-stopped-at-Heathrow-Airport-by-UK-government-officials.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault