*The CIA honeypot Wikileaks mirror * nice dam shit

Yesterday, I posted an item referencing a reddit thread and a widely-retweeted Google search string referencing a purported "CIA wikileaks mirror honeypot" that revealed itself as likely having been set up by the CIA. It wasn't. It was some guy's joke or something.
I'm traveling with wonky mobile internet, and in the process of attempting to update the post with a clarification late last night in a sleep-depped state, I screwed up. The post was deleted. There is no conspiracy here, and no reason to believe the CIA is setting up fake Wikileaks mirrors (though, not a bad idea, amirite?).
However, I can tell you this, no joke: I'm traveling in Texas, in an area with a high Muslim population. Last night, I saw ads on the hotel TV for the CIA. Clandestine services recruitment ads. I googled around, and apparently these are part of a broad campaign that began in 2009, to recruit more Arab-Americans. I can't find the actual ad I saw last night, but here are earlier examples from the same campaign. You may also want to fire up Tor, disable cookies, and take their personality quiz.
No, neither of those have anything to do with a misleading Reddit thread, or me screwing up a blog post. But! The TV ads were so bad (even the aspect ratio was messed up), I thought, yeah, I could believe.
byXeni Jardin

So dont visit this mirror http://wikileaks.psytek.net/ maybe is some trap from CIA hehehheh  or CIA trying doing something survey to find target and then shut down their enemy. and i try to trace their domain and server an this the result :
 13   253 ms   222 ms   228 ms  ge-11-2-0.mpr2.pao1.us.above.net [64.125.12.205]

 14   244 ms   231 ms   284 ms  xe-2-2-0.cr2.sjc2.us.above.net [64.125.31.70]
 15   236 ms   240 ms   262 ms  xe-0-0-0.cr1.sjc2.us.above.net [64.125.30.125]
 16   243 ms   237 ms   238 ms  xe-2-1-0.cr1.lax112.us.above.net [64.125.24.17]

 17   315 ms   317 ms   315 ms  xe-3-2-0.cr1.iah1.us.above.net [64.125.26.121]
 18   329 ms   318 ms   342 ms  xe-2-1-0.cr1.dfw2.us.above.net [64.125.30.58]
 19   365 ms   317 ms   337 ms  xe-1-1-0.er1.dfw2.us.above.net [64.125.26.210]
 20   321 ms   307 ms   307 ms  main1.above.net [209.133.126.42]
 21   362 ms   498 ms   336 ms  vlan907.core7.dfw1.rackspace.net [98.129.84.181]

 22   355 ms   347 ms   319 ms  aggr510a-2-core7.dfw1.rackspace.net [98.129.84.8
7]
 23   347 ms   350 ms   348 ms  psytek.net [173.203.241.80]

Psytek.net - Psytek Whois Information

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.


The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.domain: psytek.net[Who Is Domain]
owner: Brad -
email: [FIND OUT MORE ABOUT THIS EMAIL ADDRESS][Who Is Domain]
address: GPO BOX 3356
city: Melbourne
state: Victoria
postal-code: 3000
country: AU
phone: +613.98541544
admin-c: CNET-466771 [FIND OUT MORE ABOUT THIS EMAIL ADDRESS][Who Is Domain]
tech-c: CNET-466771 [FIND OUT MORE ABOUT THIS EMAIL ADDRESS][Who Is Domain]
billing-c: CNET-466771 [FIND OUT MORE ABOUT THIS EMAIL ADDRESS][Who Is Domain]
nserver: a.ns.joker.com[Who Is Domain]
nserver: b.ns.joker.com[Who Is Domain]
nserver: c.ns.joker.com[Who Is Domain]
status: lock
created: 2004-05-22 21:21:40 UTC
modified: 2009-09-04 13:20:41 UTC
expires: 2012-05-22 21:21:25 UTC

contact-hdl: CNET-466771
person: Brad -
email: [FIND OUT MORE ABOUT THIS EMAIL ADDRESS][Who Is Domain]
address: GPO BOX 3356
city: Melbourne
state: Victoria
postal-code: 3000
country: AU
phone: +613.98541544

source: joker.com[Who Is Domain] live whois service
query-time: 0.007335
db-updated: 2010-12-11 01:36:50
NOTE: By submitting a WHOIS query, you agree to abide by the following
NOTE: terms of use: You agree that you may use this data only for lawful
NOTE: purposes and that under no circumstances will you use this data to:
NOTE: (1) allow, enable, or otherwise support the transmission of mass
NOTE: unsolicited, commercial advertising or solicitations via direct mail,
NOTE: e-mail, telephone, or facsimile; or (2) enable high volume, automated,
NOTE: electronic processes that apply to Joker.com[Who Is Domain] (or its computer systems).
NOTE: The compilation, repackaging, dissemination or other use of this data
NOTE: is expressly prohibited without the prior written consent of Joker.com[Who Is Domain].

Is psytek on dedicated hosting? Check it out - Click here.

Psytek.net - Psytek

Psytek IP:

173.203.241.80

Psytek server location:

San Antonio in United States

Psytek ISP:

Rackspace Hosting

Email Trace

Who owns an email address?

WHO IS? What does that mean?

Everyone who registers a domain name has his personal contact information in a WHO IS database.

Our WHO IS database lets you search for the WHO IS of any Domain.
The WHO IS Entry in the WHO IS database normally includes the name, address, phone number, email address and domain name expiration date of the domain owner.
That means that anyone who lookups an WHO IS entry will find the contact information of the owner. Some domain registrars offer private domain registrations. In this case the WHO IS contact information of the registrar is shown and not the private Informations of the domain owner. Test our WHO IS lookup tool and see how it works.

psytek.net Traffic Statistics

Psytek Alexa Traffic Rank: 804,391

Email Trace

Who owns an email address?

psytek.net Server Location

Full-screen

psytek.net server location:
San Antonio in United States

psytek.net IP address: 173.203.241.80

and everything is change and the website have the screenshot was be down congrat CIA
so what do you think ?

Read More

Network admins must beware of Stuxnet

ometimes with mind-numbing frequency, patches and security advisories from Microsoft, Adobe, and Apple compete for an ever-increasing amount of attention from administrators. Little wonder then, that most will have greeted with a mild yawn the latest announcement of another zero day attack--this one named the "Stuxnet Attack". Just as I was about to file this latest message under "Priority--To Be Reviewed", the sender's name jarred me to attention: Managing Automation.
Managing Automation is a periodical with a healthy Web presence that tends to cover topics from the supply chain, manufacturing, process control, and product lifecycle management. Over the past five years or more, the editorial focus has branched out to cover additional topics more familiar to network administrators: e.g. security event management for industrial systems, defenses against industrial espionage, etc. Despite this new coverage area, Managing Automation topics are rarely vehicles for malware notification. It was noteworthy then, to see author Chris Chiappinelli's story begin with:

Manufacturers worldwide have been put on notice that an insidious virus targeting supervisory control and data acquisition (SCADA) systems is on the loose.
The targets of the malware are Siemens' SIMATIC WinCC and PCS7 software, integral components of the distributed control and SCADA systems that facilitate production operations in many process manufacturing companies…

Those not in the manufacturing and process engineering fields may be unaware of Siemens SIMATIC and PCS7 software. How important was this emerging threat, in a field rife with worries that are sometimes alarmist and self-serving? Important. This time there is legitimate cause for concern.
Wired's Kim Zetter wrote in a post the same day as the Managing Automation announcement that "the emergence of malware targeting a SCADA system is a new and potentially ominous development for critical infrastructure protection". Network World's Ms. Smith quotes F-Secure's warning that the vulnerability poses "a risk of virus epidemic at the current moment". Finally, it may be standard lingo for such announcements, but Microsoft's July 16th announcement of Security Advisory 2286198 advised customers to visit Microsoft's general support portal and to "contact the national law enforcement agency in their country".
All of this was more than enough to get my attention.
While SCADA systems are often not regularly connected to the Internet, they are networked and are subject to the usual array of vulnerabilities. (Promotional Web copy for the Siemens product that is the target of this attack explicitly mentions Ethernet switches and wireless LANs.) Public officials such as Richard Clarke have warned about risks to SCADA systems, but there have been few examples to rally the troops. While the particular vulnerability--a hard-coded password allowing access to the Siemens software's back end data base--is not especially remarkable (though it does both date the software and call into question software quality review processes at Siemens), the malware packs a punch.
Thought to mainly spread by USB stick, or possibly by network shares, it cannot be defeated by simply turning off Windows autorun; simply viewing an infected file system will install the malware. A security specialist at Tofino believes that this zero-day attack, which affects all versions of Windows, may have been in the wild for a month or more. Preliminary assessments indicate that the malware does not appear designed to cripple infrastructure, but rather to steal information from SIMATIC WinCC / PCS7 implementations--i.e., some form of industrial espionage. Of course that espionage could later be used to wreak havoc on these same or similarly configured systems.
Recent press and analyst coverage has addressed both the threats to SCADA networks, and also the broader Windows vulnerability which the worm uses to spread (it exploits a code that interprets Windows shortcuts, i.e., .lnk files). As Microsoft noted in their analysis of the exploit, which has been named the "Stuxnet" threat, this is a new method of propagation which leverages a flaw in the way the Windows Shell "parses shortcuts". Stuxnet has been cataloged as CVE-2010-2568 at Mitre's CVE. For its part, Microsoft has proposed a workaround of sorts, and updated its own detection engines.
There's more
As if that wasn't enough, the attack also involved theft of a signed Verisign digital certificate owned by Realtek Semiconductor. This certificate was used to authenticate drivers needed by Stuxnet when it self-installs, though Microsoft has since persuaded Verisign and Realtek to revoke the certificate. This was the icing on the trojan's cake.
The Dependency Syndrome
What does all this mean? One lesson--not new, but that is borne out by this incident--is that the Internet-centric orientation of most malware models could miss certain types of threats. SCADA vulnerabilities are just that sort of threat. And while infections might not spread directly from them to general purpose networks, those general purpose networks depend upon SCADA systems for connectivity, power--and even human habitability. The "Dependency Syndrome" asserts that connections between traditional networks such as those managed every day by network administrators, and nontraditional networks such as those hosting SIMATIC WinCC / PCS7, will sooner or later be impossible to detect--and defend against.

Read More