I’m sitting here on a lazy Sunday afternoon contemplating this question. Hi, my name’s Mike and I’m a security geek. =)

Yes, Myspace is evil when my wife blows a whole week by designing some really cool pictures just so she can put them on MySpace, so I have a little bit of bias (I mean, my $diety, how many times does your profile name need to be changed per day). =)

But it’s interesting if you go poke around on $favorite_search_engine for something like “myspace spam spyware connection”, you start to find some interesting articles.

• Security Protocols just linked to an expose on Myspace and its origins in spammers and spyware pushers. (This is what originally got me started down this tangent)
• Then there’s this article, it’s the text of the YouTube Videos plus a little bit more.
• Myspace Censorship Continues hmmm, seeing a trend here.
• And then, Combing the Shadows of MySpace and Part 2: Deeper into the Shadows of MySpace.

Looking around, it should be a little bit of an eye-opener if you’re naive and living in the backwoods of Idaho. I’m willing to bet that at the heart of most social networking sites there is a little PII-gathering daemon that threatens to share our innermost secrets for $5 per thousand. I’m pretty sure that my old boss in startup land had a history of playing with Herbalife, pr0n, and spam^wopt-out marketing, and we were building shopping cart software. Makes me cringe to think that the endgame was selling information, only they didn’t tell me about it. =)

But then again, I don’t think we’ve figured out yet what to do with the massive amounts of data aggregation that google does on the average web user.

But anyway, I’ve been thinking about a social networking attack over the past couple of years that works like this:

• Build social networking site (let’s call it MikeSpace for the purpose of simplicity, shall we?)
• Harvest email addresses and names from MikeSpace registrations
• Sell email addresses and names
• Make a seed file using MikeSpace account names and passwords
• Probe email accounts using the seed file
• Auto-forward email accounts to your Big Data Hoover (TM)
• Spider other social networking sites using the seed file
• Point the Big Data Hoover at the accounts you’ve compromised
• Agressively pursue password recovery on other sites using captured email accounts
• Data warehousing and some bayesian analysis to determine each user’s preferences
• Sell the aggregated information on people for mucho dinero
• ????
• Profit!

About now, all of you are checking the Interweb to see if I’m behind any social networking sites. Rest assured, I’m not, but the scary thing is that when I’m stepping through this process, I can visualize the database backend and the core code for each step of the ‘sploit.

Nor is this a new idea. My friend Lempi always wanted to create her own cult along the same lines, but she was beaten to the punch by some people who will not be named because they actively sue. =)

• Business Leadership Training
• I’m Big and Open
• Even Better Spam
• Federal CIO Council’s Guidelines on Security and Social Media
• My Lunchtime Hobby: Collecting Badges

While I was in the “giant kitty-litter box” some years ago, our base was 200 miles from anything. Our link to the outside world was a satellite Internet connection through a company in Dubai. We had a small 10-station computer lab with about as many VoIP phones behind a Linux firewall doing NAT.

Because everything was running on generators, and Joe the Infantryman couldn’t remember to fill the generators with fuel, our base had very unstable power. We would have an outage every day at around 2:00 in the afternoon.  The power situation and the sand caused the power supplies of the computers to die fairly quickly.

Then one day, a bad thing happened. The linux firewall lost the boot drive during a power failure and didn’t come back up. It went to the maintenance shell which, of course, requires you to log in with the root password. This is when people came and asked me to fix it.

All the firewall needed was a fsck, but I was out of luck–no password. I ripped open the case and booted off a CD but the drive wouldn’t take a fsck. I eventually ended up turning the firewall into a debian box. Using ethereal, I sniffed out a gateway and unused IP address, then I called the company who owned the equipment. We had a nice conversation about how it would take them a month to send out a tech to fix or replace the firewall, so in the mean time, I owned it.

Now the funny thing is that everything is slow when you don’t have the tools available. I had to take one of the workstations and rip out a CD drive to put one in the firewall. I had to sniff out a network connection just so I could download a bootable .iso. These are all fairly small, but they take time.

I think the whole time to get us up and running was about 12 hours. Definitely not the quickest job I’ve done. But at least our guys could call home.

Now the reason that I’m bringing this is is because I’m looking at the movies from Hack In the Box 2006 and there is one about hacking satellites: Hacking a Bird in the Sky – Hijacking VSAT Connections by Jim Geovedi and Raditya Iryandi. These guys used some of the same techniques that I did.

• Et Tu, TIC?
• Omigod, I’m Part of a Botnet?!?!?!
• Sir Bruce Mentions FDCC, World Goes Nuts
• Build a Hack Bag
• My Lunchtime Hobby: Collecting Badges

I’m just speechless.  I think this has to be the InfoSec news scoop of the year!!

Sex Lube Maker’s 250K Customer List Slides Onto Net

And honestly, it was some other Michael Smith.  Really it was!!

• Self-Quote Time #2
• Barcode Hacking
• Self-Quote Time
• Communicating the Value of Security Seminar Preview
• Evolving the Physical Hacking at Security Conferences

There is both a VMWare appliance for a hard-drive install of backtrack and a CD-boot appliance that you point at a .iso file.

It works flawlessly.  Mike is much happy.

• Backtrack 3 USB Slides
• Internet in the Remote Desert
• Build a Hack Bag
• Is Myspace Satan?
• It’s Wireless Audit Time Again