Simply Running ./capture.sh & takes a photo every 60 seconds.
While I dont shower with my mac (that much) I will be Zuckerberging my webcam from now so hackers can not see the strange faces I make at my computer when trying to figure out how to get a bash script to work correctly.
While rebuilding my iPad this weekend I noticed that I could name it an emoji. So I named my iPad 📱(U+1F4F1):
While I don’t have any problem using the iPad it basically makes it unreachable on the network via hostname.
From there I renamed all of my lab machines emojis. Mostly variations of 💩 (U+1F4A9) because I am sophomoric:
In case you were wondering this is all totally illegally according to RFC 952 (that was written in 1985) and shouldn’t be allowed but I have not found an OS the enforces it.
While doing some research on hostnames and emojis I read that .ws (Samoa) and .tk (Tokelau) allow emoji domains with the help on punycoder so I registered http://☠💻💩.ws which is either going to be the waste of $6 or the start of a $10B security startup. I have not decided yet.
If all of this isn’t ridiculous enough for you can even name your wireless network with emojis:
…emojis: they just aren’t for 12 year olds anymore. 😎
Earlier today I ran across this blog post on hijacking windows .lnk file so I decided to build out and test a full POC for it using Windows 8.1.
To reproduce this just copy these 7 lines into powershell and ctrl+c now runs calc.exe instead of copying your text:
For extra jerkiness this will shutdown a windows machine when ctrl+c is pressed:
Using this technique you could easily natively remap common commands like ctrl+c , ctrl+v, ctrl-alt-delete to do anything the logged in user can do. You could also copy these links into the common desktop (C:\Users\Public\Desktop\) to make anyone who logs into the machine have these mappings.
While getting ready to teach an “introduction to penetration testing with docker ” class I stumbled across the Shipyard-Project which brings an amazing web based interface to docker.
Installing on Debian on DigitalOcean is as simple as starting a droplet and running these two commands: curl -sSL https://get.docker.com/ | sh curl -sSL https://shipyard-project.com/deploy | bash -s Update: Running scripts you have not read through is a really bad idea (almost as bad as suggesting you do so). Make sure you take a look at the docker and shipyard scripts before you run them.
While the CLI for docker isn’t hard to learn this does seem like the “Killer App” that could help people adopt containers. I know I will be using it to manage my containers from here on out and recommending it to as many people as I can.
…but it is 2016 and you should never run code on your machine if you don’t know what it does. These are mini-virtual machines and not magically secure little shipping containers*. At a minimum you should do these basic things to get some idea of what you are putting on your machine before you run it.
Pull the container first: docker pull jgamblin/tiny-tor
Use Docker Inspect to look at the container’s metadata: docker inspect jgamblin/tiny-tor
You will want to carefully read through that output and take time to look at these fields:
Image The image this container is running.
NetworkSettings The network settings for the container,
LogPath The system path to this container’s log file.
Name The user defined name for the container.
Volumes Defines the volume mapping between the host system and the container.
HostConfig Key configurations for how the container will interact with the host system. These could take CPU and memory limits, networking values, or device driver paths.
Config The runtime configuration options set when the docker run command was executed.
Use Docker History to see how the image was built: docker history jgamblin/tiny-tor
As always if you are *REALLY* worried about security you should be using Tails but this works perfectly to get an “outside-in” real world look of your environment. If you have any questions please reach out to me on twitter at @jgamblin.