Phrack 72

https://phrack.org/issues/72/1

by todsacerdoti • 11 months ago

164 32 11 months ago

phrack.org

jmclnx2• 11 months ago

Glad to see they are still active

supermatou• 11 months ago

Must read

https://phrack.org/issues/72/19#article

supernetworks2• 11 months ago

This is not unlike the surprise in underground.txt when mendax & co discover that curiosity is not the only state of existence for being a hacker. https://www.gutenberg.org/cache/epub/4686/pg4686.txt

"Riffling through other files, Mendax found mail confirming that the attack had indeed come from inside MILNET. His eyes grew wide as he read on. US military hackers had broken into MILNET systems, using them for target practice, and no-one had bothered to tell the system admin at the target site.

Mendax couldn't believe it. The US military was hacking its own computers. This discovery led to another, more disturbing, thought. If the US military was hacking its own computers for practice, what was it doing to other countries' computers? "

firefax3• 11 months ago

This is not unlike the surprise in underground.txt

I thought that was originally a book?

I distinctly remember reading it during an in school suspension in the 2000s.

I tried to go back to my township library and read it again years later, but someone had stolen it around the time that Wikileaks truthfully revealed that the DNC had kneecapped Bernie in the primaries.

(Many folks don't seem to distinguish between the public airing of unpleasant truths that could not be aired without their own actions, and "disinformation" in the "covid is a hoax" vein. To them, anything contrary to their narrative is evil and bad, and if only those dastardly Russians would stop making them look bad my making them send several illegal emails they could stop voting like Republicans)

guitmz• 11 months ago

Thank you. Glad you liked it!

jpfromlondon• 11 months ago

I can't help but see security professionals as fakers, they seem to mostly be box-tickers rather than the professionally curious, in school and college I was up to no good with tech, but now when my employer is recruiting to establish an in-house cyber team I know I'm not what they're looking for and never was.

I exclude the RE guys who are undoubtedly extraordinary.

awithrow• 11 months ago

I think like most things there is a power law distribution when it comes to these sort of roles. I've worked with a few really good security teams in my career. The good ones work with the teams, possibly embedded on improving security. The better ones also write tools and libraries for service teams to consume. The best ones act like internal white hats, constantly probe and assess, and submit patches as well.

Sadly the vast majority of sec teams are not this and exist solely to run some tool that spits out a list of dubious vulns and then dump said list as a pile of tickets into the dev backlog.

One place i worked, the CISO even came up with some slogan for the info-sec along the lines of "observe and report" after I kept trying to show the info-sec how to run, build, test, and patch our various packages and tools their scanners would complain about.

shiftlessunity• 11 months ago

Does anyone know of an RSS feed for new phrack publications?

torben-friis• 11 months ago

Damn does this bring back memories.

I learned to code specifically because as a kid I wanted to be a hacker; I was reading explanations of a buffer overflow in physical magazines before I learned how to code.

It’s been more than a decade since I even touched these kind of resources, but in a way those people are still the reason I can put food on the table now.

I really should revisit the community at some point, if only to see what the current environment is like. Things must have changed a lot since the time a teenager could bypass any security in their surroundings.

alisonatwork• 11 months ago

There is an ASCII chart in https://phrack.org/issues/72/18_md#article which references https://arxiv.org/pdf/2008.07753 [PDF], a 2020 article showing that open source peaked in 2013. In some qualitative sense that feels intuitively correct, but I am skeptical that in the modern world filled with a zillion NPM dependencies and the cloud YAML explosion and now vibe-coded everything that we are actually producing less lines of open source than we did in 2013. Is anyone aware of newer studies that investigate this?

mid-kid• 11 months ago

I imagine they might be counting actual applications and not libraries/dependencies. Lots of things on the web are closed source.

tgrcode2• 11 months ago

That is my article. The data source (Open Hub) may not be completely representative of open source, but the precise trend I was aiming to cite was hard to find elsewhere (and especially to find a graph for!)

tgrcode2• 11 months ago

And thanks for reading!

JSR_FDED• 11 months ago

This hits home for me.

Then: We were the kids who saw the blinking cursor not as a barrier, but as an invitation. We typed characters into the voids and got back secrets. Our goal was not destruction, it was understanding — to understand the systems better than those who built them.
Now: Hacking is a job title. Curiosity has been commodified. A thousand "Bug Bounty Platforms" are trying to monetize your desire for understanding, to turn it into CVEs and T-shirts.

suchoudh• 11 months ago

sometime back i downloaded a phrack zip on my ubuntu and noticed it had some special character which did not allow me to delete the files once unzipped.

perhaps some safety measure. i am used to only drwxrwxrwx or lrwxrwxrwx on dirs and files never seen srwx.....

Can someone pls point me to some doc that explains how to deal with it.

theblazehen• 11 months ago

That sounds like a socket, are you sure you downloaded a zip and not a tar? And that you didn't extract it as root / another user?

You should check the permissions on it, you may need to chown it to your user, or just remove it as root

jo-lund• 11 months ago

Sounds to me like the sticky bit is set on the directory and you are not the owner. If this is set on a directory, then you can't delete files inside this directory unless you are the owner (of the files or the directory) or root. Having write permisson is not enough. This makes directories like for example tmp a bit more secure.

alecco2• 11 months ago

Highly recommend: Phrack Prophile on Gera https://phrack.org/issues/72/2#article

(Though I'm biased)

jmclnx2• 11 months ago

Odd, did something change with phrack ? I usually go there using lynx, but this time I get "Alert!: HTTP/1.1 308 Permanent Redirect"

Will try dillo but I guess I will be stuck using Firefox.

edit: dillo worked fine.

alecco2• 11 months ago

lynx! Now this is nostalgia. Thank you.

yencabulator• 11 months ago

This WASM sandbox sloppiness was interesting to me: https://phrack.org/issues/72/10_md#article

zzo38computer• 11 months ago

Although I had not used WebAssembly, the problem (and how to mitigate it) were obvious to me right after reading section 2, although perhaps not to everyone (but I expect I am not the only one who finds it obvious; there are probably others).

immibis• 11 months ago

Someone gave me a physical copy at WHY2025 in exchange for telling him about Evan Doorbell's Telephone Tapes[1]. I should probably read it. Seems to have a lot of fascinating content.

[1] https://evan-doorbell.com/

Phrack 72

Related Stories