readx;

Kevin was able to find Lin Hong, and it was only by chance that there were users in other BBS who discussed the topic of computer cracking of the SAM Association, and he found the official BBS of the SAM Association by following the address provided by the other party. Pen, fun, pavilion www. biquge。 info

On this BBS, Kevin went shopping for a long time. I think the cracking project of this calculator is quite interesting, but unfortunately it is too simple to arouse his interest for the time being.

He checked the introduction of the SAM Association, and found that these people from the SAM Association seemed to be the three teenagers from the Latin School who had been to him last time. The location and the name match very well, basically can't be wrong.

So, Kevin easily probed the security of the server, the basic protection is indeed in place, and it can basically prevent the intrusion of ordinary hackers, but of course it is different in his eyes, he has at least ten more ways to successfully invade it without alerting the attention of the administrator.

These vulnerabilities were discovered by him alone, and they have not been circulated in the hacker circle, and perhaps others have also discovered them, but relatively speaking, they are still relatively few.

Kevin hacked in and took a look, only to find a running CQCQ server on the server.

He downloaded the app from the official FTP and researched it.

Although I think it's still relatively rudimentary, it's easier to use than the IRC software that is popular on the Internet.

However, when Kevin learned that the software was written by Stone, he decided to wait online for a while to talk to Stone about security.

As a result, there was the previous forced addition of friends to chat.

He continued:

Your software itself is good, and the information is encrypted, but it's not secure enough: the first is the encryption algorithm, and as far as I know, they already have plans to start listening to IRC channels.

Lin Hong noticed that the "listening" he used was not a commonly used word, but was replaced by another English word.

Are our chats being monitored right now?

Not at the moment, but you should be careful. It's not enough to just encrypt information, and the architecture of your software isn't secure enough. This is based on a client-server architecture, but it's not strong enough to steal your information if someone hacks into your server. ("" Net 7*

Lin Hong thought for a moment, and what he said did make sense. No matter how encrypted the client is, as long as the server side is breached, the entire chat network will be controlled by the other party, just like Kevin forced himself to add himself as a friend before.

Having your servers in place doesn't stop you from doing so? Fixing the vulnerability doesn't stop the intrusion either?

The system on the SAM Association server has been optimized and hardened by Arthur, some unnecessary ports and services have been disabled, and the known insecurity settings that may have been hacked have also been modified, but I didn't expect it to be broken by Kevin.

Remember, there is no absolutely secure operating system. Especially those operating systems that are popular on the market today are simply full of vulnerabilities and are too easy to hack. No matter how many patches are played, it is a design flaw in the operating system, a vulnerability is plugged, and new vulnerabilities will be discovered.

Also, you don't know if the underlying workings of these operating systems are as the engineers have revealed, and they don't disclose all the details.

Many vulnerabilities or insecure mechanisms, they themselves know, but before they are announced by hackers, they will not care, maybe they don't have time for the time being, maybe the vulnerabilities belong to the core level, unless the system architecture is changed, it is not helpful at all, and changing the system architecture is not a thing that can be done if you want to......

Design flaws in the operating system......

Lin Hong remembered the Linux development plan he and Linus were working on, and couldn't help but move in his heart, and replied:

Then, we can design an operating system that is secure enough to patch vulnerabilities as soon as they are discovered. As long as we design a strong enough kernel, all other code can be compiled by the user at any time, so that the security can be greatly improved?

It's much easier to maintain a kernel that is secure enough than it is to maintain the entire system.

In addition, it is possible for a technologically strong hacker to modify his system at will, patch all the vulnerabilities he knows, as long as it is not a kernel-level defect, once the vulnerability is found, it will be remediated as soon as possible, so that the security can be greatly increased?

Lin Hong thought a lot at this moment, including the development route of Linux in the future.

Develop your own operating system? Are you kidding? Today's operating systems are no longer just children's toys as they used to be. Microsoft's operating system......

In Kevin's view, the days when one or two people could write an operating system like the early days of computers are long gone, and the current operating system has gradually developed into a behemoth, without enough people and time, to be up to the task. What hacker doesn't want to write an operating system for their own use? But how easy is that?

However, he didn't know that Lin Hong and his thought friends had actually started to do it.

Lin Hong did not continue on this topic, he knew that what he and Linus were doing now was exactly what many people wanted to do but did not do or dared to do because of various concerns.

Whatever, Lin Hong thought to himself, anyway, he and Linus carried out that project for interest and learning, regardless of how strong Linux's functions are, it is already very good to be comparable to Minix.

Taking advantage of this opportunity, Lin Hong put forward a question he had always wanted to ask:

I want to learn more systematically about network intrusion techniques, where should I start?

The other party is a super hacker, and in his opinion, hacking into the system is as simple as following his own door. Lin Hong felt that consulting the other party's opinion could make him take a lot of detours.

The reason why he wanted to learn invasion techniques was not to invade, but to learn how to defend better.

As the saying goes, "knowing oneself and knowing one's opponent will win all battles", Lin Hong feels that if you want to become a "white hat" hacker, you must first understand the "black hat" technology.

Kevin seems to have expected Lin Hong to ask this question.

He quickly sent a text document via CQCQ.

You hack in the order of the IP addresses in it, and when you contribute all the servers in this list, you're the starter. These servers are relatively secure, but I recommend that you disguise yourself when you invade, otherwise it won't be nice to be on 'their' watchlist.

Lin Hong opened it and found that there was a long list of IP addresses in this document, and after counting it, there were as many as thirty!

Lin Hong didn't continue to ask, he immediately understood what the other party meant, Kevin let himself learn the invasion technique through specific practice and operation.

Kevin chatted with Lin Hong for a while, and finally, gave Lin Hong a little talk about how to avoid monitoring when he called.

His favorite method is to dial through a trunk line.

Whenever he wants to call a special person, he first connects some lines that the other party can't hear, such as some special encrypted channels, and then keeps jumping around in these lines, so that after many jumps, the other party can no longer trace his source and whereabouts, and finally uses an unknown line as an exit to connect with the person he wants to talk to.

After chatting about this topic, Kevin went offline.

When he didn't know something, Lin Hong still felt that it was nothing. But when he heard Kevin talk about security, he felt an inexplicable sense of insecurity, as if every word he sent to the outside world, not a single login to BBS was silently observed by someone somewhere.

Sometimes Lin Hong also feels that Kevin is a little nervous, and always suspects that others are monitoring all channels 24 hours a day, including phone calls and the Internet.

After all, there are so many people in the United States, does the FBI or CIA have so many people?

At best, they can only monitor suspicious targets in a targeted manner.

But then again, Lin Hong can be sure that Kevin is not lying, the SAS system must exist, and Lin Hong has seen it with his own eyes after all. And the FBI is indeed after Kevin.

Although Lin Hong feels that he will not be the target of being monitored, who can say for sure this kind of thing?

In addition, Lin Hong's original intention of writing CQCQ was originally for friends to use, and it is also a more meaningful thing to be able to provide them with communication software that is not easy to be monitored. What's more, the person who monitors the information on the network is not necessarily the government, and it may also be a "black hat" hacker.

In addition, according to Kevin, "their" latest Aurora network monitoring system seems to be much more advanced than the SAS system, and does not require much manpower to intercept and intercept all data traffic in and out of the United States.

After Kevin went offline, Lin Hong thought for a long time about whether to really design the CQCQ software as a software that could not be monitored.

From the current situation, if you want to add this feature, you may have to sacrifice the ease of use and performance of some software, and the development will be much more difficult.

In addition, the invasion of the server is always much more difficult than the invasion of the software, and Lin Hong cannot find a better hosting server for the time being. In the end, he decided to make point-to-point software, where messages were not relayed on the server, and messages were encrypted at the sender end and delivered directly to the receiver.

Messages are sent out of the computer, which is a bit like going through the city gate, the computer is a city, and if you want to send messages to the outside world, you must go through a specific port such as 8000 (city gate). For example, when you enter a line of words in CQCQ, the software will package the text according to the IRC protocol and send it through Gate 8000 (port), but there will sometimes be walls (gateway servers) outside the city.

The network administrator is the gatekeeper, he has the right to control the closing and opening of the "city gate", and also has the right to check the packages that pass through the city gate, and if he does not want you to pass any messages to the outside world, he can block the message transmission by closing the "city gate" number 8000. If he wants to monitor the news, he can also open the package that passes through this gate and see the contents inside.

There is a simple way to avoid the "gatekeeper", that is, to use a proxy server, which is equivalent to a "transit city", and the data package can not go through the exit 8000 that has been closed or monitored, but can choose 8001, and after going out, you will enter the "transit city", and then from this city to the target city.

But this is not always reliable. An experienced gatekeeper doesn't just monitor a gate, he sends sentries to monitor all exits, and whenever a package passes through the gate, they open it and check its contents.

If you want to ensure that the package is safe enough to not be intercepted by the other party, it is best to go through some city gates that are not commonly used. Of course, this is not enough insurance, because the gatekeeper is very powerful, and all the gates cannot escape the surveillance of the other party.

It is safer to add a locked and secure box (encryption) to the data package, so that even if the package is stopped by the other party, they will not be able to see the contents of the package immediately, and the box must be smashed open.

There are not many gatekeepers who can smash open boxes, and some boxes are hard enough that even if it takes ten days and ten nights, they may not be able to smash them, and the gatekeepers don't have so much time to spend on them.

But this is still not enough insurance, if either of the two parties who delivered the message package is found to be transmitting "prohibited news", the government can follow the route of the package and reverse the way to capture the other.

Therefore, not only must the package be locked, but the route of the message must be completely disrupted, so that the other party cannot follow the trace.

Kevin's talk to Lin Hong about the way he evaded phone calls inspired him.

As long as the locked package is transferred multiple times in the "secret stronghold", it can successfully confuse the other party's audio-visual and let him buy the flow track of the package in the end, thus cutting off the clues.

It's relatively simple to lock the package, which Lin Hong has noticed before, but Lin Hong hasn't thought about it clearly for the time being to establish a "secret stronghold".

How do you confirm the identity of the parcel when it is being transmitted in these "secret locations"? Otherwise, if the other party is disguised by the gatekeeper, it is very likely that they will fall into the net.

Lin Hong hadn't thought it through for the time being, and he still lacked the corresponding knowledge reserves, so he put this issue aside for the time being, and continued to read the v0.00 source code of linux that he received before.