Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Links

Phrack 55 released 89

Posted by Hemos from the it-took-nine-months dept.
cnvogel wrote to us with the news that Phrack 55 has been released and is ready for download. It took a while, but it's worth the wait. Update: There's an HTML version of Phrack 55 here, and this is the Phrack main page.
This discussion has been archived. No new comments can be posted.

Phrack 55 released More

Phrack 55 released

Comments Filter:
  • Ever been to Japan? Enter (politely, and with permission of course) any middle-class home and check out the 'services'. Hoo boy!

  • That was hardly a troll. A troll is a post intended to illicit negative responses. I was only providing my opinion on Phrack and its place (or rather how I don't think it should have a place) on Slashdot. Maybe I didn't specify why I think the way I do and that's what makes you believe my post was a troll. So here I will expand on my opinion.

    I question the ethics of the makers and writers of Phrack, and as a result I refuse to support them and fail to see why any respectable person in the computer industry would. Clearly most of those involved in the creation of Phrack come from the ranks of current and past crackers and phreakers, which both happen to be illegal activities in most countries. Phrack is not a respectable security information source like CERT or CIAC or BUGTRAQ. They don't just give information on vulnerabilities, but also information on how crackers and script kiddies can exploit those vulnerabilities. They've even provided examples.

    The makers of Phrack certainly don't have any interest in advancing security, but rather their interest lies in cracking, phreaking, "warez", and other clearly illegal and unethical activities.

    Normally, I respect Slashdot as a respectable source of information for technology news. Phrack is not respectable, and therefore Slashdot should not pay them any attention.
  • I already had WAY too much stuff to do today, and now I have to spend an hour or two reading Phrack! Thanks alot.

    BTW, the FTP link was a bad choice. It's about dead, but you can pull it via HTTP pretty easily.

    [phrack.com]
    Phrack 55
  • There's nothing wrong with CNet. At least they don't support cracking/phreaking magazines.
  • Right, cause there's only one way to do something, and that's the right way. And phrack's not it. right? Or maybe you should try reading an issue or two. If you're concerned with only reading serious stuff, try something fairly recent (and dont even think about cult of the dead cow [cultdeadcow.com]). I dont remember the issues off hand, but there was an article about hardening multiuser linux systems, and then a followup about freeBSD that actually provided kernel (and maybe user space prog?) patches. There are some (a very few?) people who believe that understanding a problem is as important, if not more important, than fixing it....
  • I guess he's writing it for me then, because I like the current batch a whole lot more than the older ones I've read. Can't please everyone.

    I had assumed that the increased level of technical detail was an evolutionary step to keep pace with state of the art in infosec. You're seeing articles about deep buffer overflow stuff because, frankly, that's what's being used out there.

    And the loopback section isn't all "you idiot!". There is equal measure of "are you coming on to me?".

  • Phrack was never intended as an infosec technical journal. It was an ezine written primarily by high school kids and some college kids (the founders/editors were both around 16 when it was founded), intended for high school and college kids. It explored areas of security, computer and otherwise, that interested its authors. Hence articles covered everything from "how to pick Master locks" to discussion of Telenet's security. An important focus was always on community and learning about technology. The Phrack Loopback sections were interesting and contained useful dialog between the readers and the editors. Now they're just crap. The Phrack World News was good. The editors weren't egocentric. The list of differences could continue ad nauseum.

    In short, Phrack today is not Phrack, except in name. It's a technical infosec journal that happens to have "borrowed" a name from a popular ezine with a much different purpose and editorial style. IMHO, it's a fine technical journal, but its use of the Phrack moniker is somewhat unfair and incongruous with its history. It's a cheap ploy to get more readership than a technical journal would normally get.
  • span.

    C'mon, if news only mattered for a day our lives would be very, very weird.

  • What is it with cracker / warez d00d types and the RAR archive format?

    Most warez appear to be in RAR format - er, not that I've downloaded any, I just browsed the FTP site, um...
  • hmmm, that's one funny Troll, maybe he'll come out from under the bridge and go on tour.

    New Rule: Moderators must either begin smoking if they don't, or stop if they do (and I ain't talking about them tobaccy things neither)

  • Phrack is for people interested in security. period. Yes some of it might interest "skript kiddies", but a lot of it is good security info, noted both on the white hat and black hat sides. You make references to CAIC and CERT, but these outfits just tell you that a hole has been discovered and how to fix it..... Two problems with that.. 1) if they don't know how to fix it they don't tell you about it.. Phrack and other such sources at least tell you about it whether there's a fix or not. You can always disable the service or change revs, or even better, bother the programmers about fixing it. 2) C&C do not search for problems... hackers do. They then post their findings. Some of those when a soluton is found find their way into C&C pubs. But generally postings like Phracks announce it first allowing for adequate time to resolve the issues.
    Define respectible? Some of those "respecible" agencies were widely known for trying to get holes put in things. And further for asking that security breaches be passed on to them, but then not informing others, who were vulnerable, about the hacks...... I'll take any source of information i can get.

  • I agree entirely with the other guy who responded (I wish I had a short-term memory). Phrack is not some script-kiddie-house-o'-sploits. You'd have better luck looking at securityfocus.com [securityfocus.com] (one of your "responsible" groups) for those. I haven't read all of it, but the articles I did read were much more into proof-of-concept and discussing technical issues than providing .c files to compile and run against your favorite hosts (note to script kiddies: nsa.gov is probably *not* the best place to test your k3wl sploit. Now back to our regular programming.) Bugtraq probably has more 'sploits, and you cite that as a "responsible" group. The only difference is that a lot of phrack contributers find holes because it's fun and challenging, not because they're getting paid to admin hosts that use swiss-cheese-security. (Not to imply that because one is getting paid to be a security consultant one can't still be a hacker, just that I get the impression that a much greater percentage of the people posting to Phrack are hackers in the pure sense just because that's what they are (in the "Gee, I wonder how this thing works" sense, not in the "d00d, let's generate some credit card numbers!", which isn't hacking at all, unless you actually reverse engineered the system to generate numbers and whatnot. Bonus points if you build a magstripe maker from household components, but anyhow). I just wish my C and assembly skills were up to the level necessary to do some of that stuff...


  • I'm glad that Phrack is still around. In the early years of my education, it always seemed to open my eyes to some new aspect of hack politics, electronics or technique. I think Phrack was partly responsible for my major and career. It pulled me away from 'Chuck Yeager's Air Trainer' and made me poke around the TCP/IP stack, caused me to do random scans of Tymnet, and to bend many a VAX to my will. Without Phrack, I might have taken up a worthless profession like Marketing.

    Thank you, Phrack!!
    Viva le Phrack!
  • i was about to say...
  • Slashdot
    --------
    Old News for Nerds. Stuff that mattered yesterday.

  • TOC for issue 55 (Score:4)

    by Anonymous Coward on Friday September 10, 1999 @06:00AM (#1690557)
    For those of you curious about what's in this issue:

    -----------------------[ T A B L E O F C O N T E N T S ]

    01 Introduction Phrack Staff 014 K
    02 Phrack Loopback Phrack Staff 051 K
    03 Phrack Line Noise various 037 K
    04 Phrack Tribute to W. Richard Stevens Phrack Staff 004 K
    05 A Real NT Rootkit Greg Hoglund 066 K
    06 The Libnet Reference Manual route 181 K
    07 PERL CGI Problems rfp 017 K
    08 Frame Pointer Overwriting klog 020 K
    09 Distributed Information Gathering hybrid 010 K
    10 Building Bastion Routers with IOS Brett / Variable K 037 K
    11 Stego Hasho Conehead 037 K
    12 Building Into The Linux Network Layer kossak / lifeline 044 K
    13 The Black Book of AFS nicnoc 011 K
    14 A Global Positioning System Primer e5 015 K
    15 Win32 Buffer Overflows... dark spyrit 078 K
    16 Distributed Metastasis... Andrew J. Stewart 031 K
    17 H.323 Firewall Security Issues Dan Moniz 015 K
    18 Phrack World News disorder 021 K
    19 Phrack Magazine Extraction Utility Phrack Staff 021 K

  • Re:It's for Script Kiddies (Score:5)

    by nyet ( 19118 ) on Friday September 10, 1999 @10:22AM (#1690558) Homepage
    I have read only up to the NT article. If you actually bothered to read it, you would see that its not exactly geared towards the skript kiddie.

    As a matter of fact phrack has ALWAYS demeaned and derided skript kiddies. A quick peek at the flame-ridden, mean-spirited "Loopback" section will tell you this. Sure, maybe it smacks of hypocrisy to you, but the fact remains - it has never been an exhaustive "mini-cracking howto" for dummies.

    I'm guessing when it comes to cracking, you have as much actual computing knowledge as a kiddie. Given that premise, I offer you a challenge.

    I will put up an NT machine on the Internet, and using the NT article (and absolutely NO knowledge of NT or x86 assembler) you will crack it.

    Sound fair?

    And as far as "respectable" goes, where do you think 90% of the stuff from CERT comes from? Hint: it is not from "respectable" corporations like Microsoft who audit their own software. They have no incentive to reveal how bad or insecure their (closed) code is. It is not from "respectable" programmers (like me), who need to actually get their code working. Yes, it is not from skript kiddies either, but there is a happy medium, and that is the marginally sociopathic, intelligent, curious group of computer geeks who think cracking is fun.

    You may not respect them, because they seem immature and at best amoral. You may not respect them because they do illegal things. You may not respect them simply because you dislike them, but the fact remains, THEY are the ones finding security problems with NT and Linux, not Microsoft, not Red Hat, and certainly not people like you (or even me) who find finding and writing cracks and exploits personally distasteful.

    For all these reasons I submit that announcements like this DO belong on Slashdot.
  • A magazine published by a group of I guess the proper term is "security consultants" who are interested in alerting the community about various failures in security.

  • ATTENTION, CITIZEN! (Score:4)

    by Greyfox ( 87712 ) on Friday September 10, 1999 @06:01AM (#1690561) Homepage Journal
    The PICS Rating on Phrak is "Subversive." Please report to your local Ministry of Truth office for mandatory re-education.

    That is all.

  • I would guess that a lot of those people who don't follow Phrack closely do know what Phrack is. They just don't realize that Phrack 55 means "Phrack, issue #55." The first time I saw it mentioned in that format, I thought something along the lines of "I thought Phrack was an e-magazine... Is Phrack XX a new version of some utility for script kiddies or something?" It is kindof confuzzing when words like "issue" get left out. Not that it is bad to name the issues that way, but give the people a break when they don't "get it" right away.

  • Did you try pressing ESC at the logon screen. That works for most people.
  • other quick karma boosters:

    1.) include hyperlinks to supplementary articles, even if they're mentioned in the main article

    2.) include a dictionary definition

    3.) say what the slashdot community *should* be doing

    4.) act intelligent, and say why "jonkatz/microsoft/some popularly opposed group" really is beneficial to us


    i'd include all these things in *this* post, but i don't want to abuse the system :)
  • Well, you see, here's the problem with your arguments. I did thumb through Phrack, and I also browsed through their web site, before posting my messages.

    Also, I never said I believe in security through obscurity. I do like to hear about vulnerabilities. However, my focus is not on how to exploit them, but rather how to protect against them. Often you need to know one to know about the other, but also quite often (ie. when a patch has been issued), you don't.

    Okay, so they don't issue .c files for you to compile and use. But alot of the articles seem to focus on how you might code a .c file instead of how to protect against attacks.

    As an example, if CERT were to send out an advisory, they would tell you there is a buffer overrun, but not where in the code or how to exploit it. A great majority of the time, they also tell you how to fix it.

    Phrack, on the other hand, in their latest issue, had an article on "The Frame Pointer Overwrite" which explained how to exploit a buffer overrun, and even had an example of C code. Or how to build a "*REAL* NT Rootkit". Or how to exploit Win32 Buffer Overflows. Shall I go on?

  • Question (Score:1)

    by Anonymous Coward
    I'm stupid but what's phrack 55?
  • Using lynx, the posted link can't be accessed at the moment.. Can those "first" kids go away please?
  • http://www.phrack.com/main-index.html

  • As good as these are... (Score:5)

    by Millennium ( 2451 ) on Friday September 10, 1999 @04:12AM (#1690576)
    Slashdot really shouldn't post these release notices until the day after a release. Give the mirror sites and more dedicated users some time to get it before Slashdotting the servers.

    Besides which, then a list of mirrors can be posted along with the notice, to help reduce the load. Honestly, Slashdot's popularity is a Good Thing, but that popularity gives us a certain responsibility not to overload servers unless it's necessary (i.e. Web servers which typically don't have mirrors).

    Of course, if Microsoft owns the server in question, all bets are off. But I doubt that's the case here.
  • In all honesty I didn't think Phrack was still producing. Nice to see a longtime tradition (well, kinda) of phrack continue. I still remember the article on programming the serial port for linux that forced me to produce all kinds of useless hardware and waste money - god bless 'em.

    In regards to those asking questions, Phrack is an electronic magazine convering various technical topics from vulnerabilities to tutorials (such as how to make your own shell, etc.)
  • Well, since I'm so nice I mirrored it. PHRACK 55 [sundsvall.se]
    Now don't go kill the mirror

  • Phrack. (Score:5)

    by jelwell ( 2152 ) on Friday September 10, 1999 @04:25AM (#1690580)
    Phrack is underground magazine that started in the days of phreaking. Using different methods to bypass phone charges.

    See the jargon file [fwi.uva.nl]. "phreaking /freek'ing/ /n./ [from `phone phreak'] 1. The art and science of cracking the phone network (so as, for example, to
    make free long-distance calls). 2. By extension, security-cracking in any other context (especially, but not exclusively, on
    communications networks) (see cracking). "

    Now adays, and in the old days phrack exposes new security holes, gives ideas about new directions to look for security holes (as in the last issue when they mentioned client apps should be invesitigated - over servers). They also have informative pieces about new and complicated technologies sometimes exposing the underlying system.

    Phrack is almost always a difficult read, but new releases always mean more tools for script kiddies to run around with for a month or two.

    Joseph Elwell.

  • Mirror! (Score:3)

    by cnvogel ( 3905 ) <chris.hedonism@cx> on Friday September 10, 1999 @04:25AM (#1690581) Homepage
    Download phrack55 here [dabay.net].

  • For new readers (Score:3)

    by Anonymous Coward on Friday September 10, 1999 @04:30AM (#1690583)
    For new readers the Phrack 55 is a

    1) Cloned Goat
    2) New name for Windows 5.0
    3) Beats the hell out of me
    4) Maybe Found Here [blockstackers.com]
  • goto
    http://www.phrack.com/
  • ... and run your scripts on your server, not in my browser.

  • Appeasing the "This isn't newsworthy" crowd (Score:3)

    by Neph ( 5010 ) on Friday September 10, 1999 @07:06AM (#1690588) Homepage

    I suggest a new article category, "New releases", for this kind of story. I myself am happy to see them, but recognize that some might not.

    In that vein, the idea has been bouncing around in my head for a while that it should be possible to put articles in two categories. Many are the times I've seen an article and thought, "Funny, I would've put that under 'Linux', not under 'SGI'."

    Clink, clink, . SNF .

    Steve 'Nephtes' Freeland | Okay, so maybe I'm a tiny itty

  • We should set up some kind of Phrack fund to send the current editor (it seems to change a lot but I guess it's been around a long time) some funding to keep it coming out every 2 months or so. Woohoo I want a Phrack credit card! Cards that come with explanations of how to generate their numbers? :)
  • "Stupid newbies"
    This is exactly the kind of crap that is being addressed here.
    A newbie, by definition, is not stupid but rather unlearned. Everyone starts somewhere and it's sickening to see folks who were once newbies hazing others.
    What it boils down to is that there are too many mean rotten little kiddies out there (by age or action). I say grow the hell up and treat others as you would be treated yourself.
  • Well, it's not really the same Phrack. Somewhere along the line Knight Lightning and Taran King gave it up, but other people started up a new magazine with the same name (due to its popularity). KL and TK eventually "blessed" this new Phrack, and it continued for a while, though certainly not the same magazine as the original. Then sometime 2-3 years ago route (daemon9) managed to take over the magazine (I have no clue what happened to the previous editor(s)) and turned it into his personal ego zone. Reading his responses to the reader emailed questions, it's sickening that somebody like that managed to get control of a magazine that used to be run by nice people...
  • Either that or find a better editor. For years Phrack came out 4-5 times a year, without getting any money for it either. Now route puts it out maybe once a year.
  • Sorry, that "first kids" comment was not meant for the guy I responded to - he was asking a valid question, he isn't one of the first-posters I was complaining about. I agree about elitism. There are several communities with adoration for a specific OS, and that is a Good Thing. But, the diversity must not change into being closed-minded to knowledge from another camp. We can learn a lot a lot here, and that's exactly why Slashdot is so popular.
  • Providing all of the information and analysis that that goes along with finding and reporting a problem is only proper. It is rather like publishing a scientific research paper on an experiment -- you should give people enough information that they should be able to reproduce your results independantly.

    Phrack and other security publications generally don't have the focus of showing you all the cool 'sploits of the day, but instead try to teach you how to THINK about security and other issues from a programming and design standpoint.

    Sure, they have to provide some examples along the way. And as the previous AC mentioned, full disclosure information resources like BUGTRAQ are one of the only reasons that a lot of vendors ever actually fix anything.

    You say that you don't need to know the details about a problem if there is a patch available. This is just wrong. Do you know how many times Microsoft (or other vendors) have issued a patch that only protects you against one specific implimentation of an exploit (usually the one posted on BUGTRAQ) instead of actualy re-designing the problem area properly? (I don't know exactly how many either, but lots of times. Remember

    It is like finding out someone who has a locksmith kit can pick your locks, so you just re-key your door or add another lock. Doh! You still are not any more secure.

  • "Stupid newbies"
    This is exactly the kind of crap that is being addressed here.
    A newbie, by definition, is not stupid but rather unlearned.

    Almost. A newbie is, by definition, unlearned. He/she may also be stupid. "Stupid newbies", then, is a subset of "newbies". "Smart newbies" is another subset of "newbies"; one which does not intersect with "stupid newbies".

    This is not meant to imply that it's okay to haze the newbies. Rather, be nice to the newbies. Teach them stuff. That's how you tell the smart ones from the stupid ones - the smart ones learn.
  • Exactly. Without technical excellence, the only thing setting Phrack apart from every other retarded ezine out there is it's history. The more smart people that write articles, the faster Phrack will hit the stands. SO.. If you're reading this and you're a smart person, please submit an article or an idea!
  • Take a look at how times have changed over the past 15 years. Also take a look at the quality of the articles over the past 15 years.
  • IMHO it hasn't improved. Sure, some technical aspects of the magazine have improved, but it's mostly a dry technical journal these days. The personality that used to characterize Phrack is pretty much non-existant, and the editorial style has shifted towards one of "I know more about buffer overflows than you" arrogance. Take a look at the Phrack Loopback responses during the first 10 years to the recent ones. A much higher percentage of responses are along the lines of "you're an idiot, we at Phrack Staff are much smarter than you."

  • Re:Mirror! (Score:1)

    by Anonymous Coward
    That's a gzipped tar for anyone recieving errors trying to untar the download. use gunzip first, or append a .gz to the filename for all you winzip people.
  • I'll find out what it is later but the first thing that struck me about this is the pronounciation, which is very similar to the obscenity often used in the old "BattleStar Galactica" TV series. In some episodes, this phrase may be uttered by Starbuck or Apollo in addition to "Phelgercarb"...

    -----
    Linux user: if (nt == unstable) { switchTo.linux() }
  • I know what I will be reading tonight. I needed to do some reasearch on a paper I am writing on information gathering, and here is a more advanced article right in phrack.

  • Whats wrong with questions? (Score:1)

    by Anonymous Coward
    Someone responding with arrogance towards ingnorance doesn't deserve much karma. Or do you want to turn Slashdot into a temple of geek self admiration?
  • They don't need two categories, they just need
    to be put in the best category. I know exactly
    what you're talking about re: linux articles. It
    seems a lot of times articles that are only
    interesting to linux people end up in other
    categories (SGI, Games, Hardware, etc).

    -WW

    --
    Why are there so many Unix-using Star Trek fans?
    When was the last time Picard said, "Computer, bring

  • YAM (Score:1)

    by Anarkhia ( 2342 )
    phrack55.tar.gz [dhs.org]

  • Re:Question (Score:1)

    by Anonymous Coward
    Visit their site. The Phrack magazine is a must for people interested in computer security. Often enough the code is worth a read just for learning purposes too.

    You might say too, it's just a crackers' ezine, but for that it's not dumb enough.

  • ftp://128.253.254.56/phrack55.rar [128.253.254.56] (220k)

    ftp://128.253.254.56/phrack55.zip [128.253.254.56] (274k)

    ftp://128.253.254.56/phrack55.tar.gz [128.253.254.56] (234k)

    SlashMirror: Where to put files for fellow /.'ers

  • Re:Whats wrong with questions? (Score:4)

    by Anonymous Coward on Friday September 10, 1999 @08:28AM (#1690616)
    Sigh... I kinda agree. Being in and out of the Linux world since '94, I seem to see a large shift from just about anyone involved being willing to help you in chat rooms/discussion groups/email, to attitudes of "if I know it, and you don't, you're a fucking loser, and don't deserve to be told!!" (quoted nearly verbatim) This kind of slightly grown up script kiddie attitude really gets me down.. and if it becomes the mainstream, will do much to turn people away from becoming knowlegable users of Linux, and back to Microsoft. I do think its still the minority attitude.. but it may be time to examine our collective thinking. Should all the hard earned knowlege you've gained be something to hand down to help up other, newer people, like you probably were? Or, should all those hard won secrets be guarded and kept hidden, so that others who haven't paid their dues stay where they should be, and not compete with you? Hmmm.. is your attitude open source, or closed? Food for thought.. think about it. Now I'm going to lunch...
  • The funding model is very simple:

    He wants articles.

    I've e-mailed Router a couple times about this, and the reason he cites every time is not enough quality articles.

    Folks may have noticed that rather than put out poor quality, Route will write articles himself. If he has to do this, it will take him much longer.

    I have no doubt in my mind that if Route got 20 articles with the same level of quality as Greg's article in a week's time, we'd have issue 56 next week.

    I get impatient too, but I'd rather maintain the technical level.
  • Or here [modnews.com] (zipped, not gziped and tarred).

  • 99% of webmasters could take a lesson from these people. I have never understood the attriaction of "glitzy" webpages (for a fine example check out www.intel.com [intel.com]). Prack seems to be "unslashdotable" due to their extensive use of --gasp-- text.

    Let's face it multimedia, though often useful, was created for the purpose of selling faster procs, CD-ROM drives, and MPC-[1-4] compliant systems. Many people have bought the marketing, and decided that your toilet seat needs to be a multimedia device. (Okay, the term multimedia has fallen out of use in marketing land, but my point remains valid.)

    My point is that WORDS are the basis of communication. Let's here it for words! And let's hear it for phrack for not using scaned images of text on their page!!

  • it's been used for more crappy ui design that I can handle ... Someone's sig on usenet I found pretty funny (in your best yoda voice): "java leads to javascript ... javascript leads to shockwave ... shockwave leads to suffering ...

  • Re:Whats wrong with questions? (Score:1)

    by Anonymous Coward
    you mean it isn't already?

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close