The register has corrected a story it ran recently which was also posted here yesterday.

Register duped by crimebusting D.I.R.T. Trojan
By Thomas C Greene in Washington
Posted: 06/06/2001 at 00:04 GMT

My recent article on the D.I.R.T. (Data Interception by Remote Transmission) Trojan, with which law-enforcement agents can secretly monitor a suspect's computer and which is marketed by surveillance outfit Codex Data Systems, contained several inaccuracies, all of which can be attributed solely to my own lapse in the skepticism for which The Reg in general, and I personally, are known.

The full story, as it happens, is immensely more twisted than I imagined when I wrote my original item. Clearly, The Register's readers deserve better -- and here it is:

S.C.A.M.
Thanks to several e-mailed hints from readers, I continued doing background research and have now confirmed that the CEO of Codex Data Systems is one Francis Edward "Frank" Jones, a convicted felon currently on probation for illegal possession of surveillance devices. He was charged with trafficking and conspiracy to traffic in them, but in an agreement he pleaded guilty to simple possession, and the US Government dropped the other two charges.

He was sentenced to three-hundred hours' community service and five years' probation with no jail time, on the strength of his argument to the court that he was not responsible for his illegal acts by reason of mental defect. He has also been required to participate in a mental-health program, which, judging by some of his recent behavior, appears to be less than a screaming success.

Jones is widely regarded as a scam artist with a long history of security/surveillance snake-oil sales. He has, for example, sold bug-detection services, which we're told are completely fraudulent, involving detection apparatus easily cobbled together from the inventory of Radio Shack. He's reported to have planted a bug which he subsequently 'found' during one such charade.

A Legend in His Own Mind
He's also a shameless, Boswellian self-promoter with a Web site devoted to himself in his on-line incarnation, "SpyKing."

Here we're told that SpyKing/Jones is "formerly in military and law enforcement service," and "a popular talk show guest with 15 appearances on national & regional programming and news specials."

As for his law-enforcement experience, we've since learned that he managed to get himself fired from the New York City Police Department in 1975, according to a letter by Association of Counter-Intelligence Professionals (ACIP) Executive Director Michael Richardson.

But the PR beat goes on: "Jones has lectured at M.I.T. (Massachussetts [sic] Institute of Technology) on TEMPEST computer eavesdropping techniques," his Web site claims. Indeed, "No other speaker has their thumb on the pulse of changing world trends in immerging [sic] surveillance technologies."

The security 'experts' our illiterate subject has conned include hacker trivia master Winn Schwartau and AntiOnline's "JP" John Vranesevich (no surprises there), and such publications as PC World, E-BusinessWorld, TechWeek, the Wall Street Journal, and, thanks to my carelessness, The Register as well.

The D.I.R.T. on the Trojan
The truly inexcusable element of my first story was my failure challenge rigorously Codex's claims regarding the amazing power of its D.I.R.T. Trojan.

Had I taken the time to learn that SpyKing/Jones was behind this, I would have immediately suspected that it's a lot more talk than technology. But I ran with the piece out of eagerness to work my own agenda, motivated by personal outrage that anyone would be so irresponsible as to sell a Trojan to law-enforcement and governments as a surveillance device.

And the reason for that outrage survives even now; D.I.R.T. unquestionably permits police to upload bogus evidence to a suspect's machine and offers no auditing controls by which they might be caught, which was the focus of my original report.

That much hasn't changed; D.I.R.T. is absolutely ripe for abuse without accountability, and Jones is utterly damnable for trying to sell it to governments and police organizations.

But I was on very shaky ground in reporting its true capabilities. My subsequent investigation indicates that Codex's claim that D.I.R.T. can defeat all known PC firewalls is, quite simply, false.

Furthermore, their claim that "the software is completely transparent to the target and cannot be detected by current anti-virus software," is misleading, if not completely false. There is no technology in D.I.R.T. responsible for this sort of stealth; the server isn't detected simply because no anti-virus vendor has as yet added it to their signatures catalog.

Defeating D.I.R.T.
My suggestions in the original article for defeating D.I.R.T. remain basically sound, if perhaps a bit over-cautious due to my mistaken belief that it defeats all known firewalls (though there is reason to believe it may defeat a few).

Because it isn't presently detected by anti-virus software, one does have to look for evidence of it. By default, it installs two files in the C:WINDOWS directory -- DESKTOP.EXE and DESKTOP.DLL. Find either of those files, and it's time to re-format your HDD.

One can also check their Windows registry under:
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCurrentVersion HKEY_USERSSOFTWAREMICROSOFTWINDOWSCurrentVersion HKEY_USERSDEFAULTSOFTWAREMICROSOFTWINDOWSCurrentVersion for any references to DESKTOP.EXE or DESKTOP.DLL.

For those not intimately acquainted with the incontinent complexities of the Windows Registry, it would be best simply to search the entirety for references to both files mentioned. (It's also worthwhile to check out some of the suggestions in my previous report.)

Now, because those file names are defaults which can be modified by savvy operators, I'm not saying, 'if you can't find the files, then you're not infected.' The names can be changed; but we can rely on the fact that most operators will be using D.I.R.T. in its default configuration -- after all, its chief selling point is that it can be used successfully by the technically illiterate.

One final point regarding defenses against the Trojan: soon after I posted the first article recommending disk re-formats for those unsure how to combat D.I.R.T., which was mentioned and linked at Cryptome.org, a reader submitted the following warning:

"D.I.R.T. uses 'unused' space in the file system, so high-level reformatting will not destroy it. (This 'unused' space is used by operating systems to handle classified information with data structures similar to that in SE_Linux). Removing D.I.R.T. requires wiping the disk at the device-driver level."

I spoke with Eric Schneider, who wrote the program before leaving Codex on ethical grounds; and he told me that so far as he knows "there is no technology in D.I.R.T. which comes close to surviving a high-level format."

So there you have it. Codex's D.I.R.T. is a remote administration tool that functions in large part just like the free Trojans SubSeven and BO2K, which is being sold by a disgraced former cop, current felon and self-confessed lunatic for thousands of dollars a pop to creepy Feds in countries where the sort of abuse it invites is routine and impossible for a victim to challenge in court.

In all, a loathsome scam run by an equally loathsome con artist. ®

www.theregister.co.uk/content/4/19480.ht...

add your own comments

When Nessie reported it as absolute truth and fell for it being un-stoppable, un-detectable I said it's JUST a trojan and an anti-trojan utility will detect it.

And gave several measures to prevent being infected, to detect it's presence and to get rid of it.

(WinTop alone will show it - show exactly what file is running it)


For the average user an anti-trojan will stop it...

Our security measures (preventing the gateway from becoming infected, avoiding executing files that can contain it or only running such files on intrAnet machines so that it could never communicate to the internet, WinTop or ATM detecting it - able to kill it - show it's source file and deleting it.) completely protect against it.

A high-level format isn't even needed - you can use a utility to wipe all unused freespace (they offer them to prevent people from recovering "deleted" files/data)



Then he brought it up again in the context that "they" can get you anyway (as if our security measures were worthless)


As far as firewalls go it is possible for it to attack the firewall its'elf and alter it to not show the trojan talking to the internet however that only applies to "known" (and not all) firewalls. If you use private IP's then have only proxies talk to the internet only the traffic the proxies pass can get though - all other packets are dropped by your ISP, in effect the internet it'self becomes your firewall...

The trojan cannot get around this either because the many proxies that you can use to do this aren't "firewalls" and the IP layer it'self becomes your firewall...

The trojan only deals with the next higher layer - TCP/UDP, so by blocking at the IP layer it's impossible for the trojan to breach.



All-n-all this shows there are *several* things you can do - several easy solutions to prevent this or ANY trojan from breaching your security.


People who have no direct experience in security - who only know what they read are not qualified to be dispensing advice about security, especially when they attempt to discredit those who DO have direct *extensive* experience in security...

Enough said.

>My recent article . . . .contained several inaccuracies,

None of which invalidate the central thesis.

>all of which can be attributed solely to my own lapse in the skepticism

That’s what he says. Another, equally plausible, explanation is that the first story was a set up for the second, and that the second was intended to discredit and belittle the fears about D.I.R.T and it’s clones that journalists such as myself have been expressing.

Or maybe Green is just a sloppy researcher. This is likely. He obviously missed my article, or else he would have already known that

>the CEO of Codex Data Systems is one Francis Edward "Frank" Jones,

I pointed this out a year and a half ago. Green missed it. This speaks volumes to his competency as a researcher.


>Thanks to several e-mailed hints from readers,

Who, we must wonder, were these readers, and what is their agenda?


> Jones, a convicted felon

So what? That, in and of itself, doesn’t make him a bad person or a liar. It doesn’t even make him guilty. Many felons are innocent of the crime for which they were convicted. Mumia comes to mind. So does ji Jagga, Peltier, Salvati and Limone.

Being a felon only makes Jones a victim of law enforcement.

But even if he’s guilty, that in no way negates the truth about D.I.R.T. and it’s clones.

If anything, his being

>currently on probation for illegal possession of surveillance devices.

makes him appear to be more, rather than less, qualified to speak knowledgeably on surveillance. It may very well indicate that he is not a master criminal, but that’s a separate issue.


>He was charged with trafficking and conspiracy to traffic in them, but in an agreement he pleaded guilty to simple possession, and the US Government dropped the other two charges.

This seems to indicate that he had a good lawyer and/or paid a sufficient bribe. Or maybe he ratted out one of his friends. It says nothing about his expertise as a a programmer.


>He was sentenced . . . on the strength of his argument to the court that he was not responsible for his illegal acts by reason of mental defect.

That’s a clever defense. Good for him.


>He has also been required to participate in a mental-health program, which, judging by some of his recent behavior, appears to be less than a screaming success.

In a society where “mental health” is judged, legally at least, on the basis of one’s degree of conformity and submission to the will of the powers that be, to be considered “crazy” is a badge if honor.

This is a sick society. Anyone it considers sane is, IMHO, mentally ill.



>Jones is widely regarded

How widely? By whom? Notice that Green omits these details.



>as a scam artist with a long history of security/surveillance snake-oil sales. He has, for example, sold bug-detection services, which we're told are completely fraudulent,

“We’re told,” eh? Told by who? Did Green, a man who by his own admission fails to adequately check his sources, bother to find out if they were telling the truth about this? We don’t know. He doesn’t tell us. Why not?


>involving detection apparatus easily cobbled together from the inventory of Radio Shack.

So Jones is clever enough to construct a cheap bug detector from commercially available components. And this proves that he’s a fraud, how?

Let’s be frank, here. RF bug detectors are incredibly easy to “cobble together” on the cheap. Rocket science it ain’t. Ultrasonic bugs are easy to miss because RF detectors don’t pick up ultrasonic signals. Ultrasonic detectors are a little more difficult and expensive to “cobble together,” but they don’t require a Ph.D either. They’re also for sale on the open market.

The trouble with finding a bug is then what do you do with it? If you destroy it, its planters then know that you’re on to them.


>He's reported to have planted a bug which he subsequently 'found' during one such charade.

If his detector found the planted bug, then by definition, it wasn’t a charade. It was salesmanship. It was like when the guy selling vacuum cleaners pours dust on your rug and then sucks it up. It’s a sales technique, that’s all. It in no way discredits the device or the ability of Jones to construct one. Au contrair.


>He's also a shameless, Boswellian self-promoter with a Web site devoted to himself in his on-line incarnation, "SpyKing."

>Here we're told that SpyKing/Jones is "formerly in military and law enforcement service," and "a popular talk show guest with 15 appearances on national & regional programming and news specials."

He’s in business. He advertises. So what? That’s how business done.

It is also irrelevant to the issue of the danger posed by D.I.R.T. and it’s clones.

> As for his law-enforcement experience, we've since learned that he managed to get himself fired from the New York City Police Department in 1975, according to a letter by Association of Counter-Intelligence Professionals (ACIP) Executive Director Michael Richardson.

So he was willing to admit being a former cop. And this makes him a liar, how?

Well, maybe he was a little dodgy about the circumstances of his separation. He said he was retired. Richardson said he was fired. Which one is lying? We don’t know. In their profession, lying is part of the job description. Cops lie. Ex-cops lie. Private cops lie. Many people outside the profession also lie about being fired once. So what? Either way, it has nothing to do with the danger posed by D.I.R.T. and its clones.


>But the PR beat goes on: "Jones has lectured at M.I.T. (Massachussetts [sic] Institute of Technology) on TEMPEST computer eavesdropping techniques," his Web site claims. Indeed, "No other speaker has their thumb on the pulse of changing world trends in immerging [sic] surveillance technologies."

He advertises. So what? That’s how business is done. His spelling abilities are irrelevant to his skills as a programmer. Why bring them up? It sounds to me like Green is clutching at straws.


>The security 'experts'

Putting the word in quotation marks in no way changes its meaning. Winn Schwartau and John Vranesevich are widely recognized in the field for their expertise. Green is not. Perhaps what we are witnessing at work here is professional jealousy.


>PC World, E-BusinessWorld, TechWeek, the Wall Street Journal,

While certainly not always correct about everything, the above named publications all enjoy a far greater reputation for credibility than does the Register, or Green himself. Take note, for example, that Green and the Register were a year and a half behind me on this one, and I’m just an enthusiast. He’s supposed to be a seasoned pro. Which is more accurate? judge for yourself.



>and, thanks to my carelessness, The Register as well.

He says it was carelessness. But we would be seriously remiss if we did not (at least) consider that more sinister motives may be at work here. It could just as easily been an intentional set up for his following article.

People do this sometimes. See:

http://www.sfbg.com/nessie/20.html

http://www.sfbg.com/nessie/21.html



>our illiterate

“Illiterate” is an egregious and inaccurate hyperbole to apply to a man who once or twice misspelled a word. What is Green’s agenda? Who put him up to it. How much are they paying him?


>The truly inexcusable element of my first story was my failure challenge rigorously Codex's claims regarding the amazing power of its D.I.R.T. Trojan.

What prompted that failure? Was it mere incompetence, or was Green setting us up for his follow up article and it’s message that D.I.R.T. isn’t such a big deal after all? Try as I might, I simply cannot think of a third possibility. Can you?


>the reason for that outrage survives even now; D.I.R.T. unquestionably permits police to upload bogus evidence to a suspect's machine and offers no auditing controls by which they might be caught, which was the focus of my original report.

So why the second article? And why use the word “scam” with all it connotes?



>That much hasn't changed; D.I.R.T. is absolutely ripe for abuse without accountability, and Jones is utterly damnable for trying to sell it to governments and police organizations.


Indeed, D.I.R.T. is dangerous, very. But to say it is “ripe for abuse” implies that the abuse hasn’t already begun. Why, we must ask, has Green chosen to phrase it this way? What is his agenda in doing so?



>But I was on very shaky ground in reporting its true capabilities. My subsequent investigation indicates that Codex's claim that D.I.R.T. can defeat all known PC firewalls is, quite simply, false.

Green is correct here. Compare his report to my own at:

http://ss.gettingit.com/cgi-bin/gx.cgi/AppLogic+FTContentServer?pagename=FutureTense/Demos/GI/Templates/Article_View&parm1=A2197-1999Dec10&topframe=true

You will quickly see that I made no such claim. Any measure can be defeated. D.I.R.T. can be defeated. It’s clones can be defeated. Your firewall can be defeated. That’s the way it is. Cyberspace is a glass house. Get used to it. Adapt your tactics or suffer the consequences.


Why should we trust a guy who says, in effect, “Yesterday I mislead you, but today I am not misleading you”?


>There is no technology in D.I.R.T. responsible for this sort of stealth; the server isn't detected simply because no anti-virus vendor has as yet added it to their signatures catalog.

When they do, so what? That does not address the issue of clones, of which there may well be a great many.


>we can rely on the fact that most operators will be using D.I.R.T. in its default configuration -- after all, its chief selling point is that it can be used successfully by the technically illiterate.

Why, we must ask ourselves, should we let a guy who by his own admission recently mislead us, tell us upon what we can rely and upon what we cannot rely?



> I spoke with Eric Schneider, who wrote the program before leaving Codex on ethical grounds;

That’s what he says, or at least that’s what Green says that he says.



>and he told me

This is hearsay from a guy who admits he misled us before. Burn me once, shame on you. Burn me twice, shame on me.



>that so far as he knows "there is no technology in D.I.R.T. which comes close to surviving a high-level format."

Let’s hope this is true. Let’s not, however, rely on hope alone to keep us out of jail.



>In all, a loathsome scam run by an equally loathsome con artist.

How loathsome Jones is, is a political value judgment. Personally, I don’t like the guy. I don’t like guys like him. But that in no way invalidates my valid concerns regarding the treat posed by D.I.R.T. and it’s clones. They’re dangerous. Watch out.

************

So much for Green. Now about “triple anon,” whoever he is.


>When Nessie reported it as absolute truth and fell for it being un-stoppable, un-detectable

I said no such thing. “Triple anon” is lying about me again. It seems to be one of his hobbies. Or maybe it’s a job. There’s no way to tell. Either way, he’s full of crap. Read what I actually said and see for yourself.

I never said Green’s article was “absolute truth.” I posted neither disclaimer nor endorsement. I merely pointed out that Green was a year and a half late.


>I said . . . gave several measures to prevent being infected, to detect it's presence and to get rid of it.

And maybe they’ll work, on D.I.R.T. But what about it’s clones?


> (WinTop alone will show it - show exactly what file is running it)

This assumes that WinTop itself can be trusted.

More to the point, can TA be trusted? You’ll have to judge that for yourself. Don’t take his word for it, or mine either for that matter. Do your own research.



>Then he brought it up again in the context that "they" can get you anyway (as if our security measures were worthless)

TA may, I repeat MAY, know more about computer security than I do. I sincerely doubt that he knows more about computer security than do a couple of my comrades. But about security in general, he is clueless. He has a Maginot Line mentality about the subject. He trusts the defenses in front of him while the enemy comes up from behind. Be like him, and you risk near certain defeat.

TA repeatedly accuses me of “defeatism” because I persist in warning you of the dangers you face. But if you really want to be defeated, you will listen to TA and blunder on ahead without care or concern for the dangers.

If, for example, you are on a field of battle, and are advancing upon the enemy, and you come upon a mine filed, what do you do? Is it “defeatist” to postpone your advance until the field can be cleared, or to attempt to find a safe way around it? Of course not. To blunder on ahead would only assure your defeat.

Life is like chess. The most important move in the game isn’t the pin, the check or the mate. It’s the blunder. TA repeatedly advises you to blunder. Whose side is on, anyway?


>People who have no direct experience in security - who only know what they read are not qualified to be dispensing advice about security, especially when they attempt to discredit those who DO have direct *extensive* experience in security...

People with REAL experience with security, on the ground, in the field, up close and personal, don’t brag about their skills and their weaponry. They conceal them. Only a fool tells the enemy in advance what to expect.

The only thing I have revealed about my defenses is that I can, and will, use deadly force when appropriate. Everything else is going to be a surprise.

That’s how it’s supposed to be done.

One thing here, John Vranesevich is definitely not a computer security expert. He's another con-artist dirt-bag, and that's about it. Do a quick web search on the name and find out.

The only thing this article in today's Register is saying is that the man who's trying to sell this program is an ex-con with dubious business practices, and it can't smash through every firewall out there. Does that change the fact that there is such a trojan? Or that it's being sold to law enforcement? Even the implication that they're interested should be enough to wake people up.

Oh yeah, far as computer security, I know enough to realize I don't really know anything at all. :-)

(Jones is known)>as a scam artist with a long history of
security/surveillance snake-oil sales. He has, for example,
sold bug-detection services, which we're told are completely
fraudulent, involving detection apparatus easily cobbled together
from the inventory of Radio Shack.

"So Jones is clever enough to construct a cheap bug detector from
commercially available components.
And this proves that he’s a fraud, how?

Let’s be frank, here. RF bug detectors are incredibly easy to
"cobble together" on the cheap. Rocket science it ain’t.
Ultrasonic bugs are easy to miss because RF detectors don’t
pick up ultrasonic signals. Ultrasonic detectors are a little
more difficult and expensive to "cobble together," but they
don’t require a Ph.D either. They’re also for sale on the open market.

The trouble with finding a bug is then what do you do with it?
If you destroy it, its planters then know that you’re on to them.







I wasn't even going to bother commenting on your "paranoia for all occasions"
defense, except for this statement is blatently inaccurate.



1.) The point of the retraction was that Jones was being dishonest by
building *FAKE* bug detectors...

You attempt to twist that into "Jones simply built real bug detectors and
"they" didn't like that. (which just happenes to support & excuse YOUR
incompetent BS - how convienent !)

and

2.) "bug detectors are *incredibly easy to COBBLE TOGETHER on the cheap*,
rocket science it aint.


3.) that Jones built said detectors with parts available from Radio Shack.





NOW THE FACTS



1.) bug detectors are VERY DIFFICULT to build because they have to have an
extremely wide operating frequency range AND be able to ignore high powered
(radio/TV/pager) transmitters *within that range*.

2.) "cheap" bug detectors not only will miss bugs they will false on such
high power signals making them *ineffective*

3.) Radio Shack *doesn't sell the parts needed* (even by special order) to
make a good bug detector


How I know this is because *I* make bug detectors, and I know exactly what's
required to make an effective one, plus I know what parts are available
though Radio Shack and know they don't sell the needed parts.


You've already admitted even in your BS "technical" observation that NO
normal (RF) bug detector can detect acoustic (ultrasonic) bugs but your
incompetence once again shows when you ignore *other* types of bugs (that I
design and build) the reason being you just wont find data on the internet
for them.


Even the very best commercially made (expensive) bug detectors miss several
types of bugs much less some "low cost cobbled together with Radio Shack
parts" toy detector.


Let's review what types of bugs NO (normal) bug detector can find



1.) R.F. bugs that are outside the range (15 KHz to 100.KHz - > 3.GHz)

This is the bottem end of the VLF band and higher microwave bands.

(I design & build them)



2.) acoustic bugs (that's one you caught ONLY because you read about it
somewhere) The same VLF frequencies as sound waves up to a few MHz which is
the practical limit of acoustical operation, above this and the phase
distortion becomes so great that the signal is too noisy to be usable.

(I design & build them)



3.) Infared bugs - any frequency including spread spectrum

(I design & build them)


4.) resonant cavity bugs - excited by (usually) microwave source


5.) spread spectrum bugs - these hop around in frequency in either a set
repeating pattern or a puedo-random

(I design & build them)


6.) laser listeners - bounce off glass window panes (visible/infared/UV)
turning the window pane into a microphone

(I design & built them)


7.) microwave reflection bugs


8.) snake microphones (I use them - simply a long thin hose, vinyl tubing
attached to a mic)


9.) shotgun, parabolic mics (I use them for outdoors)


And this list doesn't even cover the really advanced bugs that I know
about and UNDERSTAND (I just don't have the equipment to work with them)



With my direct experience in actually building and detecting bugs I could be
said to be an "expert" (I don't like that word) on bugs and I *KNOW* Nessie
is *full of shit*



>He's reported to have planted a bug which he subsequently
'found' during one such charade.

" If his detector found the planted bug, then by definition, it wasn’t a
charade. It was salesmanship. It was like when the guy selling
vacuum cleaners pours dust on your rug and then sucks it up.
It’s a sales technique, that’s all. It in no way discredits the device
or the ability of Jones to construct one. Au contrair. "



BULLSHIT ! How stupid do you think people are ?



He didn't have to detect the bug (his "detector" didn't have to work) because
since he planted it himself *he already knew where it was* !

Besides even if his "detector" did work it was only for a bug (his) that he
*already knew it would detect* (which leaves out MANY other types of bugs,
even R.F. ones which is the only class of bug his "detector" could detect
(if it even worked at all)

Comparing that to "pouring dust on a carpet and vacuming it up" is patently
misleading - the job of a bug detector is to *find a bug in an unknown
location* not to just function at all (if that) For a person who might USE
his "detector" it would be USELESS unless it really worked and needs to be
able to detect a wide range of bugs.


I have a special type of R.F. bug detector *I designed* that I'm rather proud
of because it detects *all* types of R.F. bugs, even microwave, VLF and
*spread spectrum* This is a special design that no one else offers that I
could easyly patent. I'm willing to give it away (the design) just to prove
your full of shit. (because I design stuff all the time and can afford to)


Once I do you can have electronics experts varify that it really works AND
that it's not offered on the market (your sure in the hell not even remotely
qualified to tell) because it's a new unknown type of detector - a new
invention.

It's possible (even likely) that the NSA/military have it (secret/classified)
but it's not offered on the market.



>But the PR beat goes on: "Jones has lectured at M.I.T. (Massachussetts [sic]
Institute of Technology) on TEMPEST computer eavesdropping techniques," his
Web site claims. Indeed, "No other speaker has their thumb on the pulse of
changing world trends in immerging [sic] surveillance technologies."

" He advertises. So what? That’s how business is done. His spelling
abilities are irrelevant to his skills as a programmer. Why bring them up?
It sounds to me like Green is clutching at straws. "


Notice that referance to Tempest in the same way I use it ? (not trying to
split hairs about "tempest v. Van ECK" BS.. That's because (just as I
said) most people just use the word Tempest for the whole subject.

Nit picking about words is BS. This just goes to show thats all it is to you
- WORD GAMES.




>The security 'experts'

" Putting the word in quotation marks in no way changes its meaning.
Winn Schwartau and John Vranesevich are widely recognized in the
field for their expertise. Green is not. Perhaps what we are witnessing
at work here is professional jealousy. "


More word games...


>PC World, E-BusinessWorld, TechWeek, the Wall Street Journal,

" While certainly not always correct about everything, the above named
publications all enjoy a far greater reputation for credibility than
does the Register, or Green himself. Take note, for example, that
Green and the Register were a year and a half behind me on this one,
and I’m just an enthusiast. He’s supposed to be a seasoned pro.
Which is more accurate? judge for yourself. "


Ah - your paranoia is showing again - earyler you claimed (in referance to
the news of Matt's arrest) that NO mainstream media could be trusted that we
needed to varify Matt's arrest in person or at least court papers, etc.

Now *just because it suits your BS argument* you try to beat Green over the
head using those very media outlets ! Where's that "no mainstream media
can be trusted" paranoia NOW ?



>and, thanks to my carelessness, The Register as well.

He says it was carelessness. But we would be seriously remiss if we did not
(at least) consider that more sinister motives may be at work here. It could just as easily been an intentional set up for his following article.

People do this sometimes. See:

http:///nessie/20.html

http:///nessie/21.html



He was man enough to admit his mistakes, when it was shown he was wrong he
issued a public retraction out of concern for the TRUTH. You refuse to
admit yours (I've proven you dead wrong on a number of points) and his
wrong is YOUR wrong, all you come back with is "the whole world must be
wrong so I can always be right".


And once more all "proof" is tied back to your bread & butter...


Honest salemanship ?







>The truly inexcusable element of my first story was my failure challenge
rigorously Codex's claims regarding the amazing power of its D.I.R.T.
Trojan.

" What prompted that failure? Was it mere incompetence, or was Green setting
us up for his follow up article and it’s message that D.I.R.T. isn’t such
a big deal after all? Try as I might, I simply cannot think of a third
possibility. Can you? "



Paranoia becomes the shelter of last resort. He admits he was duped, and is
honest enough to say so, and all you can say is he's still wrong (or worst
yet imply he's intentionally lying) never mentioning YOU were wrong as well
(because he's not wrong to the extent that it implicates you - how convienant)



>the reason for that outrage survives even now; D.I.R.T. unquestionably
permits police to upload bogus evidence to a suspect's machine and offers
no auditing controls by which they might be caught, which was the focus of
my original report.

" So why the second article? And why use the word "scam" with all it
connotes? "



Because it IS a scam dumbass. I know myself because I have direct experience
in the field. I know for a fact you can't make even a halfway decent bug
detector with parts from Radio Shack. You don't know this because all you
know is what you read. Your absorbed, confused and defeated by paranoia
caused by overexposure to things you know nothing about.



>That much hasn't changed; D.I.R.T. is absolutely ripe for abuse without
accountability, and Jones is utterly damnable for trying to sell it to
governments and police organizations.


Indeed, D.I.R.T. is dangerous, very. But to say it is "ripe for abuse"
implies that the abuse hasn’t already begun. Why, we must ask, has Green
chosen to phrase it this way? What is his agenda in doing so?



Dirt is JUST A TROJAN - it is NOT "very dangerous" I know of other trojans
that are *much more* dangerous but even they are *just trojans* (all
trojans can be controlled/stopped by the same measures so NO trojan is
"very" dangerous) Again you total lack of experience shines through (but
you have plenty of paranoia - anyone who disagrees with you must be an agent)



>But I was on very shaky ground in reporting its true capabilities.
My subsequent investigation indicates that Codex's claim that D.I.R.T.
can defeat all known PC firewalls is, quite simply, false.

Green is correct here. Compare his report to my own at:

http://ss.gettingit.com/cgi-bin/gx.cgi/AppLogic+FTContentServer?pagenam


You will quickly see that I made no such claim. Any measure can
be defeated. D.I.R.T. can be defeated. It’s clones can be defeated.
Your firewall can be defeated. That’s the way it is. Cyberspace is
a glass house. Get used to it. Adapt your tactics or suffer the
consequences.



WHAT BULLSHIT ! You posted the original dirt warning (on here) that SAID it
could defeat "all known firewalls" Everyone on here who read that was
mislead - BY YOU ! Now your bald face LYING again.

The report (that you swallowed and posted here) said "all known firewalls" -
if you (now claim) knew that was false WHY DID YOU POST IT ???

You mislead people by posting false information now your trying to worm you
way out of it. You didn't say ONE WORD about that link (above) or ONE WORD
about the issue (all known firewalls claim is false) in the post...


Your a dispicable bald face LIAR. All your selling is rabid paranoia, and
lie left & right anytime it suits you to sell your BS paranoia soaked
rubbish that you harvest off the 'net.

All your writings are, are the collected "worst of" the internet - you simply
collect other people's paranoia.




" Why should we trust a guy who says, in effect, "Yesterday
I mislead you, but today I am not misleading you"? "


Because he honest enough to admit when he's wrong - HOW ABOUT YOU ???

He only made a mistake of not varifying his data - you are INTENTIONALLY
MISLEADING to cover your own LIES. LIE UPON LIE.

Why in the HELL should anyone trust YOU ???


>There is no technology in D.I.R.T. responsible for this sort of stealth;
the server isn't detected simply because no anti-virus vendor has as yet
added it to their signatures catalog.

" When they do, so what? That does not address the issue of clones,
of which there may well be a great many. "



Well here you touch on one tiny bit of truth. That's true that if you
depend JUST on anti-trojans that *only* use signatures they could miss it
(actually those type of anti-trojans can miss many trojans due to stealthing
and encryptenation) and are not the best type of anti-trojans for just this
reason.

Good anti-trojans work by watching your ports and (optionally) watching your
apps for changes.





>we can rely on the fact that most operators will be using D.I.R.T. in its
default configuration -- after all, its chief selling point is that it can
be used successfully by the technically illiterate.

" Why, we must ask ourselves, should we let a guy who by his own admission
recently mislead us, tell us upon what we can rely and upon what we
cannot rely? "


That's quite a twist - he's big enough to admit his mistake and all you come
back with is intentionally misleading LIES, then you frame it as HIM that's
the one who shouldn't be trusted...





> I spoke with Eric Schneider, who wrote the program before leaving Codex on
ethical grounds;

That’s what he says, or at least that’s what Green says that he says.



>and he told me

" This is hearsay from a guy who admits he misled us before. Burn me once,
shame on you. Burn me twice, shame on me. "


Shame on you for not ever admitting your own mistakes. YOU are the one who
posted the bogus scare mongering BS on dirt on here. There's nothing you can
to to hide that fact.



>that so far as he knows "there is no technology in D.I.R.T. which
comes close to surviving a high-level format."

" Let’s hope this is true. Let’s not, however, rely on hope alone to keep us
out of jail. "


Paranoia used once again to further YOUR AGENDA of making us all so scared we
don't use any technology *you don't approve of* to do anything "illegal"


(like say make anonymous threats to you - that's the heart of your agenda)




>In all, a loathsome scam run by an equally loathsome con artist.

" / that in no way invalidates my valid concerns regarding the treat
posed by D.I.R.T. and it’s clones. They’re dangerous. Watch out. "


BULLSHIT ! "They" are just trojans. That's all. Trojans are NOT very
dangerous. You just want to make people believe they are to sell your own
personal agenda and to cover up your incompentence and bald face LIES.





ME> When Nessie reported it as absolute truth and fell for it being
un-stoppable, un-detectable

I said no such thing. "Triple anon" is lying about me again. It seems to be
one of his hobbies. Or maybe it’s a job. There’s no way to tell. Either way,
he’s full of crap. Read what I actually said and see for yourself.


The context was it's "very dangerous" (still is) and you posted the data as
FACT (in other discussion with me you claimed the reason your always right
is because YOU CHECK YOUR SOUCES - this was specificly the reason you gave
for trying to say your data was right v. my *direct experience* was wrong...)


One of the specific claims (in the context of varifying your sources) was
that dirt could breach "all known firewalls"...

Your paranoia lead you to this - you just swallowed it as truth, LYING about
checking it out. You have repeatedly characterized dirt as "very
dangerous" - that a damn LIE. It's *just* a trojan, (and not even a very
good one at that) and trojans are NOT very dangerous.

The proof that they aren't is in the fact that there's SEVERAL things you can
do to stop them. If they were "very" dangerous they would be *difficult*
to stop and you would have few options...




ME> I said . . . gave several measures to prevent being infected, to detect
it's presence and to get rid of it.

And maybe they’ll work, on D.I.R.T. But what about it’s clones?



See this once more shows how stupid you are (stupid and paranoid).

All trojans work the same way - they all hide in your system and attempt to
open a "back door" to the outside (internet) either by allowing incoming
connections (usually on high ports, often using UDP), or make outgoing
connections. They allow communications that you aren't aware of...


All measures to stop them center on not allowing this back door communication
to take place. (some trojans also do virus-like activities but virii don't
open back doors - by defination they are a trojan if they do)


All you need to do to stop trojans is *deny these channels of communication*,
and there are several ways to do that.


Hell some *spyware* is more dangerous than trojans because it's "sneakyer" -
it tries to hide it's communication in your browser's traffic (so-called
"backchannel" operation)




ME> (WinTop alone will show it - show exactly what file is running it)

" This assumes that WinTop itself can be trusted. "


Paranoia. WinTop is only one of many process utilities out there - it just
happens to be my personal favorite.



" More to the point, can TA be trusted? You’ll have to judge that for
yourself. Don’t take his word for it, or mine either for that matter. Do
your own research. "



Let paranoia prevent all trust and constructive interaction...

You count on the factor that people won't go to the trouble and so remain
untrusting of everyone (paranoid) - as paranoid as YOU are...

You try to INFECT others with your paranoia.



ME> Then he brought it up again in the context that "they" can get you anyway
(as if our security measures were worthless)


" TA may, I repeat MAY, know more about computer security than I do.
I sincerely doubt that he knows more about computer security than do
a couple of my comrades. But about security in general, he is clueless. He
has a Maginot Line mentality about the subject. He trusts the defenses in
front of him while the enemy comes up from behind. Be like him, and you
risk near certain defeat. "


There's the heart of what second guessing incompentence brings you...

Not only do you refuse to provide any proof of your own to back up a SINGLE
allegation you make, but then try to directly damage my reputation with
outright SLANDER in the void of any proof !


Your greatest fear (in relation to me) is that people will use the information
I provide (how to be anonymous using chaned selected proxies) to make
anonymous threats at you (which you have a clear mental problem with).


So you directly say, over-and-over to NOT do what I suggest to forestall this
possibility. "certain defeat" MY ASS.. The truth is that you are
certaintly a LIAR. (a paranoid misleading liar)



" TA repeatedly accuses me of "defeatism" because I persist in
warning you of the dangers you face. But if you really want to be
defeated, you will listen to TA and blunder on ahead without care or
concern for the dangers. "


My record speaks for itself. And with the info about proxies I provide(d) a
TEST to varify what I said. What varification do YOU provide ?




" If, for example, you are on a field of battle, and are
advancing upon the enemy, and you come upon a mine filed, what do
you do? Is it "defeatist" to postpone your advance until the
field can be cleared, or to attempt to find a safe way around
it? Of course not. To blunder on ahead would only
assure your defeat. "


That's a simplistic unrealistic analogy, and "blunder" is simply a
characterization.


" Life is like chess. The most important move
in the game isn’t the pin, the check or the mate. It’s the
blunder. TA repeatedly advises you to blunder.
Whose side is on, anyway? "


Obviously this is a game to YOU :

1.) post misleading factually WRONG paranoid data to support your own
personal agenda of trying to infect people with so much paranoia that they
become as benign as you wish them to be for your own insecurity.

2.) never admit your wrong when you play the expert game and sooner-or-later
you slip up, insted fault those (Green) who ARE honest enough to admit they
were dupped, while applying even more paranoia excuse-for-everything to
demonize them with even worse intentions than YOU HAVE.

3.) attack anyone who doesn't fit your version of a "safe world" (no one
should be anonymous because they might use the safety of anonymidity to make
idle threats to me which due to mental problems I can't stand)


4.) if anyone points out your errors go on a total campaign to discredit them
in every possible way again never admitting you have any stake (personal or
otherwise) in this smearing.


5.) play word games and think you can wash away the truth and reality with a
sea of words always keeping your false lying misleading game plan hidden.



So yes - I see that life IS a game to you...



ME> People who have no direct experience in security - who only know what
they read are not qualified to be dispensing advice about security,
especially when they attempt to discredit those who DO have direct
*extensive* experience in security...

" People with REAL experience with security, on the ground,
in the field, up close and personal, don’t brag about their skills
and their weaponry. They conceal them. Only a fool tells the
enemy in advance what to expect. "




1.) if that were true no one would ever learn from the "experts" - the
knowledge would never be passed on or spread around

(besides I have to say SOMETHING to refute your lying BS - this is just a
case of "damned if you do - damned if you don't)


If I don't say anything to prove you wrong you get to be right

If I DO say anything to prove your wrong you still get to be right just
because I said it (said what was needed to prove you wrong)


This is called circular reasoning...



2.) The situation goes well beyond both what I've mentioned AND what you can
comprehend about it. (there's the incompetence factor again)





" The only thing I have revealed about my defenses is that
I can, and will, use deadly force when appropriate. Everything else
is going to be a surprise. "


That's one of my points - you prove NOTHING and just expect people to buy
what your trying to sell, try to place the entire burden of proof on me then
when I do give out *some* details that prove you wrong you attempt to fault
me for doing THAT.

Just a game...




" That’s how it’s supposed to be done. " (when someone threatens you verbally
you become physical and escalate the situation due to mental problems about
being threatened)



If that were true we would all be dead having killed eachother over WORDS.

(as I've pointed out before)



This post about Greene shows you are a lothsome dispictable unrepentant
compulsive liar who's only concern is what you can get out of trashing
anyone or anything that doesn't fit in to your twisted paranoia soaked world
and doesn't lead the gullable back to your web page where you try to get
money out of them for a constant feeding of worthless paranoid flake shit
you've collected off of the internet.

Your game and agenda is crystal clear.










" Oh yeah, far as computer security, I know enough to realize
I don't really know anything at all. :-)"

Well consider hackers - they breach security on commercial and government
websites constantly. They RARELY get caught. The "experts" admit all
the time that they couldn't trace the attacks because the "hackers
covered thier tracks". The internet is one of the few ways/places where
you really CAN be anonymous and CAN do things and get away with it.

Even the simple example of going to a public library or school where many
computers sit there, anyone can walk up and launch an attack (to start
then or anytime thereafter - once they are safely away) and totally get
away with it because like a public payphone they are long gone by the time
(IF) they trace the call.

Walk up to a payphone when no one is around and call 911 and hang up...

The police will show up eventually, but you are long gone by the time they
get there, and no one saw you...

No apply that concept to a computer in a public access area (library/school)
and insert a floppy, run... Have the attack delayed by a few minutes to
hours to days weeks months YEARS... You are long gone.. Even if anyone
did see you if the attack was delayed it would occur when *someone else*
was using it (not you)... You are safe from being traced in this situation.


Nessie's next paranoia tactic is to claim that since you are not "100 %"
safe (there's still a TINY chance maybe someone did see you or they were
monitoering the computer and connected it to you, etc) that means don't
do it because if you can't be *100 %* (an absolute) safe then you aren't
really safe at all. But this ignores statistics... The *chances* of
getting caught are so low that for all practical purposes you are safe.

Like what's the chance of being killed by a falling asteroid ?

VERY LOW... We don't even worry about such things because in practical
reality they happen so rarely they don't matter.. (the risk is very low)


He's trying to confuse issues by saying that a very small risk matters
enough to never take it...

Specificly saying that efforts to be anonymous (to cover your tracks) on
the internet have a tiny element of risk - that this level of risk is
unacceptable or even REAL in a practical sense...

We have YEARS of real experience that prove that the risk is so low as
to be non-existant in a practical sense....

Everyone knows hackers get away with far more serious shit than making
idle threats to someone who isn't even important (like the president or
someone) But Nessie would have you languish in total de

add your comments

spyware did become a big problem

add your comments

E- gads

add your comments

Well there you go

add your comments

I only do windows

add your comments

Now I only run open source code.

add your comments

it's Ms. Waste `O Time

add your comments

it doesn't matter what the OS is

add your comments

What I do

add your comments

I don't have a problem....

add your comments

hi

add your comments

Open Office was reverse engineered

add your comments

Okay, sure

add your comments

(541) 245-8***

add your comments

wmv

add your comments

Nope

add your comments

I use these

add your comments

it's faster for me to just do a search

add your comments

oh well

add your comments

"f**ks sheep, eats babies and pulls the wings off kittens"

add your comments

No one speaks for me

add your comments

that's mud but what about D.I.R.T. ?

fairies_frauds__fuss_.gif, image/gif, 107x132

add your comments

I don't post on SF IMC

add your comments

"BUT I STILL HAVE THEM"

add your comments

I've always liked you

add your comments

I don't want rancid buttered D.I.R.T.

add your comments

"I'm not interested"

add your comments

playing dumb but still no DIRT

add your comments

I still don't see anything about D.I.R.T.

add your comments