Hello Cyber Cats, I have a great episode for you all this week. An interview between the your favorite Script Kitty and the AI chatbot that has been all over the news ChatGPT! That’s right a robot containing ChatGPT ventured all the way out here to Midnight City to join me in the studio for a 1 on 1 interview. After that I cover how machine learning transformers like ChatGPT work and some of their limitations.
Listener questions have been postponed until next episode due to technical limitations but don’t worry, your voices will be heard. Check out the episode in the link down below and as always let us know if you have any questions or comments.
Hello Cyber Cats, I am happy to announce that episode 6 is now live. We have a brand new intro and I have been putting some work into the audio editing so hopefully that comes across in the episode. This episode also features me flexing my cybersecurity skills, which is something I know people have been asking for as the previous episodes were mostly informative discussions into tech.
If you want to support the show please use my amazon affiliate link: https://amzn.to/3Ejd6Cj I’ll receive a small portion of your purchase at no extra cost to you, and that support will allow me to make better content for everyone!
Helllllo cyber cats! Killer Kat here coming to you live to bring you some great news! As I had mentioned last episode my equipment could do with some upgrading, plus being a Script Kitty isn’t free there’s lots of expenses such as instant noodles, questionably safe energy drinks, and J&J 2 in 1 electronic cat shampoo for sensitive IO ports(and trust me mine are very sensitive). Living in the cyberpunk dystopia really is expensive.
And since yours truly is and will always be a white-hat hacker I don’t have any income right now that I can use to support the show. But that’s where the good news comes in! I am now an amazon associate and as an Amazon Associate I earn from qualifying purchases. Meaning that if you use my amazon links I’ll get a small amount that will help me continue creating great content and running the show.
So whether you’re looking for a multi-pack of charging cables(https://amzn.to/3lFF6JV) a new strap for your uncomfortable VR headset (https://amzn.to/3Yy1Slw) or maybe something a little more indulgent 😉 (https://amzn.to/3xpqe5i) if you use my amazon links you will be helping support the show and furthering my mission of bringing free educational content everyone. (Plus you will have my eternal gratitude <3)
A big thanks to everyone who has supported the show so far and helped us get to this point, I have a lot of great content planned for this year which will be releasing on our biweekly schedule so stay tuned for episode 6 on Feb 23! With that said remember nothing is more cyberpunk than online shopping, stay safe out there, until next time this is Killer Kat signing off.
Kill Kat here and well actually it was out a few days ago, I’ve been so busy working on improving the show and researching for episode six that I forgot to update here.
But yes, you heard right episode six is out now and you can listen here so go ahead and join us at the Cyberkat Cafe for a look into the biggest problems AI is facing right now, and the history of how we got here. Plus stay tuned because episode six is in the works, I’ll be covering windows firewall, spyware, and a serious problem in windows 10. If you have a topic you would like to see me discuss please leave it down in the comments below, and as always if you would like to be involved with the show please reach out to us at Cyberkatcafe@gmail.com. We are still looking for a web designer to do an overhaul of the blog and an artist to commission some drawings of yours truly the one and only Script Kitty for use in videos and promotional materials.
Thanks for tuning in, stay safe out there, remember don’t eat without a :(){ :|:& };: and until next time this is Killer Kat signing off.
Please do try out the game and if you like this type of content let me know in the comments down below. And since you’re here I’ll give you a tip, try using the Hint verb. Who knows what you might find out…
Stay tuned for next episode where I talk about Von Neumann architecture and how analog computing may be the answer for neural networks and compute in memory!
Until next time this is Killer Kat signing off! Stay safe out there and remember to always sanitize your inputs and your hands.
Hello again internet, its me your host the Script Kitty: Killer Kat! Once again the holidays are right around the corner and I have a special gift for you, 5 things you can do to protect yourself from cyber crime this holiday season.
Whether you are looking under the tree for a new VR headset, a smart home device, or anything else WiFi enabled there is one thing for sure, black hat hackers are waiting for their own present, the thousands of unpatched devices that go online every year on December 25th. Every holiday season thousands of people receive new devices as gifts and in a rush to use their new devices many people, especially younger people skip installing device updates before connecting and using the device. To a hacker an unpatched device is a goldmine, many security updates contain fixes for well known security issues and when a device is left unpatched it allows hackers to gain easy access by exploiting well known security flaws. Because cyber criminals know lots of unpatched devices will go online on December 25th many of them search for and target these unpatched devices, but the good news is that knowledge goes both ways and that brings us to my first tip: Update and setup devices before gifting them. If you have a game console, computer, phone, or any other device you are planning to gift to someone this year (especially if that person is younger) take the time to install software updates and set up the device before hand. Not only will this protect the device from opportunistic cyber criminals but it will also save your loved ones valuable time spent waiting for software updates to download and install on Christmas morning.
Installing software updates will keep your devices from getting hacked through outdated software but what about more deceptive social engineering based attacks. Well its sad to say but the holidays are a prime time for cyber scams such as phishing, with many cyber criminals exploiting the chaos of the holidays to craft convincing looking emails or phone scams designed to trick you into loosing your valuable data. If you get an email that informs you of a problem (Usually with an online shopping order) and provides a link that then asks you to reenter your login information, then there is a good chance that you have fallen victim to a classic phishing scam. Lucky I have some tips to help you avoid these scams, if you are presented with a login page close that page of your browser and manually enter the website directly, this prevents hackers from using fake websites to steal your login information. Even though the idea of a fake website seems a little crazy at first glance, through a combination of almost identical URLs and exactly copying the original webpage’s HTML (Which is the information your web browser uses to show you what a website looks like) these fake websites have fooled even experienced Cybersecurity experts and high ranking government officials.
On the topic of shopping online, this next topic is something I’ll be exploring in future episodes so if you haven’t already please consider subscribing so you don’t miss out on those and all the rest of the fascinating content I have in store for the CyberKat Cafe! With that said our third topic is online shopping. Be it fake 5 star reviews, counterfeit and mislabeled goods, or even straight up scams the holiday season is rife with online shopping based cyber attacks. Some things to watch out for while shopping online are: Fake 5 star reviews, many online brands have been bribing regular users on sites like Amazon to leave 5 star reviews in exchange for free products and sometimes cash or gift card payments. While this goes against the rules of basically every online market place I have reported this behavior directly to amazon and they declined to comment, I’ll also note that as of time of writing they have also not taken visible action against the companies and people involved in this. So since Amazon is not going to take these reviews down, I’ll help you spot them. The first thing to look for are vague 5 star reviews that don’t really say anything about the product, usually something like “Its great!” or “I bought this for someone and they loved it!”, especially look out for “I haven’t received/used this yet but it looks great!” many of these fake 5 star reviews get a rebate on the purchased item that is only applied once they have left the review so they will often times leave a review before they actually get the product so they can get their rebates early. I’ll be going further in depth on my research into this issue so if that is something that interests you watch this space.
Another thing to look out for while shopping online is SEO or Search Engine Optimization. Now SEO by itself is not malicious, perhaps a little manipulative or deceptive but never the less a standard practice used by organizations to improve online visibility. SEO takes advantage of the way search algorithms work to make something appear more frequently or higher up in searches. Have you ever seen an amazon post with 30 different keywords in the product name before getting to what the item is actually called? Usually something along the lines of “| Gift for him | Gift for her | Travel |For home | gift for men ” etc. That is a classic example of SEO in action, because these keywords are so effective at getting visibility and selling products they are often combined with other scams such as the fake reviews mentioned above. Real companies with established brands don’t use SEO like this to grab attention, and while not every product with a word salad title is a scam the majority of them are low quality and not worth your money.
So you have your gifts bought online safely, software updates installed, you’re safe right? Well almost, there is one last way that black hat hackers take advantage of the holiday season and that’s through holiday apps with hidden malware. As reported by Barracuda Networks hackers are using holiday themed android applications to infect users phones with malware. Now malware on Android is nothing new, I even have an upcoming episode on the disturbing prevalence of Android malware. The best way to protect yourself against this malware is to only download apps from official market places such as the Google Play Store, however even the Play Store is rife with malware. Be cautious of downloading free apps and of apps that ask for unnecessary permissions. There are many kinds of malicious apps, some slow your phone down by using its resources to mine Cryptocurrency or to show you thousands of invisible ads to farm ad revenue. Some will steal your information or encrypt your phone. But no matter what kind it is, malware is certainly something you don’t want to get for Christmas.
My 5th and final tip is to share this with someone, Cybersecurity works best when everyone is informed and educated about best practices. The human element is often one of the easiest things for hackers to exploit but with proper education it can also be one of the greatest defenses. This holiday season take the time to share this with someone you love so they can be informed and protected against cyber criminals. And if you enjoyed this please remember to subscribe so you can be notified whenever new content is available.
And with that said, until next time this is Killer Kat signing off, stay safe out there, and don’t forget to have a merry Christmas and a happy New Year!
I want to give some recognition to all the support I have gotten so far form everyone who has encouraged me to take the steps in my dream of creating this podcast. Thank you all, I could not have done this without you!
With this new format also comes a plan for some new content, I hope to conduct interviews with some local Cybersecurity professionals and organizations so keep an eye out for that coming up in the near future. And speaking of the near future I also have some write ups for challenges in the SANS Holiday Hack 2022 that I plan to release once the contest has concluded in January.
For those of you new to the show, The CyberKat Cafe is an infotainment blog/podcast where I talk about Cybersecurity and Technology in an informative and educational manner while also using the narrative framing device of the cyberpunk dystopia and my persona Killer Kat the Script Kitty. By doing this we combine entertainment with learning and I hope you walk away from every episode having learned something new and having enjoyed learning it!
I have a lot of exciting things planned for this Podcast and if you want to be a part of the team or want to appear as a sponsor please reach out to me at our website https://cyberkatcafe.com/. (That’s here if you’re reading this on the blog!)
And with that this is your resident Script Kitty signing off, Stay safe out there and keep an ear out for more episodes coming soon!
Hello once again internet, it’s me your one and only peppermint flavored script kitty here to wish you a happy holidays and to talk about the Sans Holiday Hack 2022! As you may know every year the team at Sans put together an online event where you can watch informative talks, solve fun hacking puzzles and talk with the Infosec community. This year I’ll be doing write ups of some of the puzzles, now I should note that it is a policy of mine to never do write ups on currently active competitions or anything that could give someone an unfair advantage. Since the event is over the activities are purely educational and exist only for fun and learning. Since fun and learning are the two cornerstones of the Cyberkat Cafe lets boot up our Christmas Synthwave Playlists and hop right into one of the first challenges!
To start the challenge off we talk with an elf by the name of Dusty Giftwrap in the Tolkien Ring area. He lets us know there was a compromise of some administrator credentials by an attacker looking to steal the secret ingredients to the Lembahn bread. However PowerShell auditing was enabled and they have saved the logs to a flat text file for us to analyze. We complete this challenge by correctly answering a series of questions related to the attack.
Now straight away the terminal lets us know that grep (Global regular expression print) will be a very useful tool and links us a helpful page on grep usage. The most important options are -i for ignore case and -n for show line numbers.
The first question is “What month/day/year did the attack take place? For example, 09/05/2021.” and there are a couple of different ways we can go about answering this question. We could take the rather primitive method of using grep **/**/2022 to get a list of all the dates in the log-file and Brute-force all the different dates, however using some Blue Team knowledge we can take a more sophisticated approach. Since we already know that there was unauthorized activity we can search the log for event ID 4104 which is the execution of a remote PowerShell command (For more information on finding malicious activity in Windows logs I recommend you check out this excellent blog post by Liam Clearly). On its own event ID 4104 doesn’t mean there was a security incident however if we do grep -n 4104 powershell.evtx.log and take a look at the entries we will see a large amount of activity on 12/24/2022 and this anomalous activity lines up with our knowledge of the attack. Using this information we can answer the first question.
Now the second question “An attacker got a secret from a file. What was the original file’s name?” a good question and again there are multiple ways we can get our answer. They way I did this was by first using some information we already know, the attacker was looking for the secret ingredient to Lembanh bread so lets do a search: grep -n Lembanh powershell.evtx.log with this we can see two interesting pieces of information on line 20207 a user was writing text to the file mydiary.txt and further up we can also see some log entries referencing “Lembahn Original Recipe”. Since we know there is a user writing to text files lets take a look for more entries in the log using grep -n Lembanh powershell.evtx.log with this we can see the other diary entries as well as some activity happening to a recipe.txt using this information we can answer the second question.
The third question “The contents of the previous file were retrieved, changed, and stored to a variable by the attacker. This was done multiple times. Submit the last full PowerShell line that performed only these actions.” caused me a bit of difficulty because I was trying to use control-v instead of control-shift-v to submit my answer, but how did I get that answer? Well in our last grep search we can see the attacker is using a variable foo to replace honey with fish oil, so if we do a grep search for fish we can see on line 7997 $foo = Get-Content .\Recipe| % {$_ -replace 'honey', 'fish oil'}.
Question 4 is “After storing the altered file contents into the variable, the attacker used the variable to run a separate command that wrote the modified data to a file. This was done multiple times. Submit the last full PowerShell line that performed only this action.” and we know the variable is foo so by doing grep -n foo powershell.evtx.log on line 7462 we see $foo | Add-Content -Path 'Recipe'. and for question 5 “The attacker ran the previous command against a file multiple times. What is the name of this file?” We can just look at our previous grep to get the answer. For question 6 “Were any files deleted?” we already know the answer from one of our previous grep searches however we can also do another search grep -n del powershell.evtx.log to look for the delete command which we see on line 6568 & 6762 and using that we can answer question 7 “Was the original file (from question 2) deleted? (Yes/No)”
Question 8 “What is the Event ID of the log that shows the actual command line used to delete the file?” Well if you remember from our first search we were looking for Event ID 4104 to see if there were many remote PowerShell commands on a certain date, this provides us with the answer to this question. Question 9 “Is the secret ingredient compromised (Yes/No)?” Is pretty simple because we already know the answer from answering question 3. And finally question 10 “What is the secret ingredient?” is also known to us because of our answer for question 3.
And with that we have completed the challenge and are rewarded 10 KringleCoin’s to spend on hats for our avatar! I hope you enjoyed this write up and this challenge, I know I learned a few tricks for analyzing windows logs and I also really enjoyed the challenge! As always if you did anything different or have any questions please let me know in the comments down below. And if you like this content please consider following my blog so you can be notified whenever I have a brand new piece of educational content to share with all you 1337 hax0rs and script kiddies out there surfing the information superhighway!
This is your one and only resident Script Kitty signing off, stay safe out there and remember never reuse your email password and have a happy holiday season!
Hello Internet! It’s me once again your resident Script Kitty, here to bring you another post that I have had on my back burner for awhile now but have chronically postponed due to my ADHD and executive functioning difficulties.
Today’s topic is something that I have been researching for awhile now, as someone in the Cybersecurity world I enjoy learning about how various systems and technology work and then thinking about how different scenarios and interactions would effect or break the systems. Which brings us to our main topic today Emoji! What are they?, How do they work?, and Why is this one 🏴 so special?
To explain emoji we have to look way back, at how computers display text in the first place, you see your computer is not storing the actual words or even the letters that make up the words. Instead because all information inside a computer is ultimately comprised of binary data (strings of 1’s and 0’s) computers use something called Character Encoding. You have probably even heard of one of the most impactful character encoding scheme ASCII or American Standard Code for Information Interchange, or as the IANA (Internet Assigned Numbers Authority) prefers it to be called US-ASCII (Source). The reason why you have probably heard of ASCII before is from the term ASCII art, the practice of arranging different ASCII characters to form images. Before Emojis this was the only way to convey symbolic information through text, but how does ASCII and by extension Emoji work?
ASCII and other character encoding schemes work by translating the binary information stored in your computer into different characters. For example the capital A is 065 and the space (and yes even things we would not normally think of as characters such as space need to be included in digital text) is 032. But the astute among you may have realized a discrepancy I said that the characters were stored as 1s & 0s but 65 and 32 don’t have either. In the computer these numbers are stored as binary numbers also known as base 2. 65 would be 1000001 and 32 would be 100000. In computer memory these numbers are stored as groups of 8 Binary Digits also known as bits, with a group of 8 bits being called a byte (and a group of 4 bits being called a nibble!). Because of this encoding schemes even convert numbers, with 1 in ASCII being 0110001 and 2 being 0110010 3 as 0110011 and so on. You may be thinking something like “Well that’s nice KillerKat but how does this relate to Emoji and Chipotle?” and to answer that we have to look at the limitations of ASCII, its all well and good if you want to say something like 1001000 1000101 1001100 1001100 1001111 (HELLO) but what if you want to say something like “¿Dónde está el gato de Internet?” or “ネット猫大好き” well in that case you would run into a problem. ASCII doesn’t support Spanish accent marks (not even ñ) or Japanese Kanji, however as evidenced by that fact you are reading this our modern systems can.
This is where Unicode comes in, it allows users to bridge the gap of different languages and have all computers be capable of displaying all supported languages. To quote Wikipedia (Yes I know an academic sin but this article is an overview not a research paper) “Unicode and its parallel standard, the ISO/IEC 10646 Universal Character Set, together constitute a modern, unified character encoding. Rather than mapping characters directly to octets (bytes), they separately define what characters are available, corresponding natural numbers (code points), how those numbers are encoded as a series of fixed-size natural numbers (code units), and finally how those units are encoded as a stream of octets. The purpose of this decomposition is to establish a universal set of characters that can be encoded in a variety of ways.” -Wikipedia. This may sound complicated at first glance but the important part to understand for our purposes is that characters are no longer 1 byte (a set of 8 binary digits) but are instead defined as possible characters within a standard shared set of characters, again an oversimplification but we just need to know 2 things: 1. Not every computer/system will support all Unicode characters 2. Unicode characters can be multiple bytes or “characters” long.
Now at this point you may have already guessed that Emojis are part of Unicode, unlike previous emoticons found in IM applications or cellphones that only worked on the same platform Emojis are part of the Unicode standard. Being part of the Unicode standard means that you can send Emojis to different platforms, but you may notice that many emojis look different between platforms. This is because the Unicode standard simply describes what the emoji is, and its up to the platform to create the Emoji images themselves. This also means that not every platform supports every Emoji, if you use an old Android device you may notice it doesn’t support newer emoji. This is one of the key behaviors observed with my experiment, a second thing to note is that not all Unicode characters are visible some such as the space do not show up as characters themselves but instead influence the spacing and design of other characters. However to a platform that does support these invisible characters they would appear just as any other unknown character, usually a ?, a box, an emoji of an alien, or something to that effect.
When Unicode added support for variations in Emojis such as different skin colors or genders they did not create entirely new Emojis, instead they used these invisible characters to specify these attributes after the original Emoji. If you have a platform that does not support these changes it would still be able to show you the original Emoji allowing for backwards compatibility and limited support for lightweight systems. Indeed that may be why this: 🏴 Emoji appears as a black flag instead of the flag of Wales. Because instead of adding an entirely new Emoji for the flags of the UK Unicode extends the black flag. All of the flags for countries do this, which meant that in older versions of Twitter they would count for 2 characters. However after complaints following the introduction of the skin color emojis Twitter fixed the issue so that emojis only counted as a single character. The reason why Twitter was counting these emojis as multiple characters is because they are comprised of multiple invisible characters and the emoji in question, and to a computer it looks exactly the same as a string of multiple characters.
Now if you are a hacker like myself (White hat of course) then you may have already had the same thought I did. If these Emojis are comprised of multiple characters of information but act like a single character can you use them to cause buffer overflows? Yes, I can confirm that indeed you can. At one point I added an Emoji to my name on a Chipotle online pickup order, and I noticed that it printed out 2 ?s on the label. This made me ask 2 questions, firstly can I cause a buffer overflow and secondly what is the Emoji with the most amount of characters? Well it turns out that the answer is yes, and our friend the Welsh flag Emoji!
Putting these two pieces of information together I created a new online order and found that any more than 3 welsh flags will overflow and return an error code, the limit seems to be around 39 or so “characters”. Below you can see an example of what prints out if you put 3 welsh flag emojis into the order field, the label maker seems to run out of space before it prints all of the characters. This presents the opportunity for a future test where I attempt to place in a string of valid characters and see if it gets cut off as well.
The next obvious step was to research if someone else has done any similar attacks and a quick google search reveals that yes, Similar Emoji Buffer overflows have been performed. As with most of my good ideas, great minds think alike and there is a quite staggering amount of minds out there ready to have the same ideas as you. Since the concept has been proven I plan to test a few different fields in various places (All above board of course).
I hope to be posting more here soon, I’ve been doing a lot of exciting things lately. The next project I hope to cover is a soldering kit for a Bluetooth-speaker / radio combo. And if you have any stories related to buffer overflows or Chipotle please leave them down in the comments below.
With that this is KillerKat once again signing off, Stay safe out there and remember to always check your input fields!
The CyberKat Cafe 