Trying to Connect with a Hacker Online

So, every hacker [s/is slowly forgetting due to global gaslighting and abuse/knows firmly/] that plaintext, unsigned communications are pointless because all the political influences between you and the person you're communicating with will alter your communications. In order to connect we have to find each other on networks that are more reliable than e-mail. A clue to finding these networks, people, and other exotic information, is weird strings of numbers and letters that seem like random gobbledygook, almost as if we were copy and pasting computer glitches to each other. No, these confusing strings of characters are the words of computer hackers: especially if the alphabetic characters never exceed 'f' in the alphabet, which does not stand for 'fuck this is confusing', but rather for 'we made computers highly efficient by braking them into powers of two'. It's called hexadecimal.

On 10/12/20, Stefan Claas wrote: [snip...]

...

Regards Stefan

-- NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 The computer helps us to solve problems, we did not have without him.

Here, we have a hexadecimal string associated with the phrase 'NaClbox'. 'NaCl' is a stupid-people-who-use-computers word for encryption and verification. 'box' is the same for computer. Let's search for it and see i we can find this random string of hexadecimal! This time, I'm going to [s/heal my injured spine/wise up to the manipulative marketing AIs/] just a smidge, and use a search engine other than google. Even better would be _asking a human being_, but we're not quite that smart yet. I'll try duckduckgo. I typed 'naclbox' into duckduckgo and the first hit is ... https://www.naclbox.com/ ! This has to be it, right? It has the right domain name! A computer game thing! This hacker must have been asking us to play computer games with them, how friendly! Let's do some wizardry called a 'dns lookup' on that url. There's a way, given _any url_, to get information on who purchased it and stuff like that. If [s/you're actually part of a major corporate conspiracy and are frequently hired to kill people who look into the origins of coverups/you have schizophrenia from too many dns lookups/] you may have trouble doing this important research, but it's not very hard to do. Searching the internet for "lookup dns purchase command line", I see a way to copy the term that [s/gives me severe traumatic flashbacks/i haven't learned to use yet/]: "whois". My system doesn't have "whois" installed because I'm a normal person, not a mumbo-jumbo computer wizard, but I can install it like any other package, and run it on www.naclbox.com: ``` $ whois naclbox.com Domain Name: NACLBOX.COM Registry Domain ID: 1653881042_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.gandi.net Registrar URL: http://www.gandi.net Updated Date: 2020-03-27T19:42:08Z Creation Date: 2011-05-01T15:51:02Z Registry Expiry Date: 2021-05-01T15:51:02Z Registrar: Gandi SAS Registrar IANA ID: 81 Registrar Abuse Contact Email: abuse@support.gandi.net Registrar Abuse Contact Phone: +33.170377661 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: NS-1219.AWSDNS-24.ORG Name Server: NS-1965.AWSDNS-53.CO.UK Name Server: NS-259.AWSDNS-32.COM Name Server: NS-544.AWSDNS-04.NET DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/

...

...

Last update of whois database: 2020-10-12T13:36:17Z <<<

This record claims that the domain was purchased on 2011 and expires
2021.  It's been a really long time since I've done this, but I was
expecting to see some information on e.g. a technical contact or
something: a real human being associated with the website.  Maybe I
have too look somewhere else.  I tried this:

$ whois -h whois.gandhi.net naclbox.com ``` which just sits there and hangs. Anyway, it sounds like the _cryptographic_ nacl project would be able to purchase this domain in 2021 if they wanted. Farther down the duckduckgo results is a more promising link, that leads to https://pkg.go.dev/golang.org/x/crypto/nacl/box . Unfortunately, this project now calls itself "package box", not "nacl box", which is discouraging. Still, we can look it over. Woohoo! "package box" says it is a generic frontend for NaCl encryption, which implies that it's possible that the signature we found is a public key for sending somebody private messages in a reliable manner, and that any tool that does this NaCl encryption can communicate with him. "package box" links to a central nacl website: https://nacl.cr.yp.to/box.html . A great way to check if we interpreted these letters-and-numbers-mumbo-jumbo correctly is to try to use them. We'll try to send this guy ... what's their name?

...

NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675

We'll try to send cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 a message ! This might mean learning to use nacl. The page I found is a c++ interface, so I'll just use that since [s/my fingers and eyes spazz out uncontrollably when i use the web now/it's a good exercise for me to write a small C++ program/]. ``` $ sudo yum install nacl-devel # nacl is a software development library for secure communication that's been available on linux systems for some time now ... ``` If you've been through [s/an abusive enslavement experience where you suffered severe injuries and learned to dissociate from your memories as way of life/a corporate or government training program/] you may have difficulty forming encrypted communications with a hacker online, but rest assured everything is fine: since the worldwide digital coronavirus has thoroughly filled your device with malware, all the corporate goonies can make sure everything is okay, and since this guy is an experienced enough hacker to communicate with letters and numbers, they'll be able to tell that you aren't one of them. That doesn't mean they'll be able to keep themselves safe from your oppressive surveillance and control situations! It's your job to [s/manage those by communicating with your contacts/mourn your wake of dead hackers after the fact/]. So please make a record of what you do so that others can learn from it after somebody new [s/dies horrifically or gets forcibly enslaved by a criminal corporate dictator/gets bored and ignores the rest of us/]! First we need to generate a naclbox of our own, to send the communication from. It's just a set of small personal letters and numbers. The website has this in it: ``` #include "crypto_box.h" std::string pk; std::string sk; pk = crypto_box_keypair(&sk); ```

The crypto_box_keypair function randomly generates a secret key and a corresponding public key. It puts the secret key into sk and returns the public key. It guarantees that sk has crypto_box_SECRETKEYBYTES bytes and that pk has crypto_box_PUBLICKEYBYTES bytes.

The secret key is like your brainstem and your heart. You don't let anybody else even get a whiff of them, _certainly_ never touch them or see them, or you could get hurt. Since [s/I'm a corporate slave/this is just an example/], I'll be storing my brainstem on the malware that's infesting the system I am typing this on. On my system, I'll have to mutate the example from the website just a tiny bit, to get it to compile. ``` // nacl-generate.cpp #include #include <fstream> #include <iostream> int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide new delicate brainstem file as first argument." << std::endl; return -1; } std::string pk; std::string sk; pk = crypto_box_keypair(&sk); std::string brainstem = argv[1]; std::ofstream delicate_precious_guts_we_are_going_to_figure_out_how_to_protect(brainstem.c_str()); delicate_precious_guts_we_are_going_to_figure_out_how_to_protect << sk; // this is a c++ way to convert from computer innards to hexadecimal letters and numbers std::cout << brainstem << "'s name is: " << std::hex; for (char const * byte = pk.data(); byte != pk.data() + pk.size(); ++ byte) { std::cout << ((*byte) & 0xff); } std::cout << std::endl; std::cout << "Don't lose track of it or nobody will be able to find 'em!" << std::endl; } ``` I actually had to work with it quite a bit while handling my issues. ``` $ g++ nacl-generate.cpp -o nacl-generate -l nacl $ ./nacl-generate delicate delicate's name is: 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 Don't lose track of it or nobody will be able to find 'em! $ mv delicate 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 `` This file of letters and numbers is now _our_ identity. We can make similar programs to send and receive messages with them. There are likely tools out there already to do this automatically, and if not it would be a problem to be solved. Here's some code to receive messages with the file we made: ``` // nacl-receive.cpp #include #include <fstream> #include <iostream> #include <sstream> std::string binary2hex(std::string binary) { std::stringstream ss; ss << std::hex; for (char const * byte = binary.data(); byte != binary.data() + binary.size(); ++ byte) { ss << ((*byte) & 0xff); } return ss.str(); } int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide delicate private file as first argument." << std::endl; return -1; } std::string pk, pkhex; std::string sk; std::string n, nhex; std::string c, chex; std::string m; std::ifstream skfile(argv[1]); skfile >> sk; std::cerr << argv[0] << " receiving." << std::endl; // Although hackers like to share things in confusing ways, for example by // cramming the public key, the nonce, and the ciphertext all together, // we're separating them out here to ease my learning this new system. // When sending the greeting to the hacker, we may want to jam all the data // together, offering it as either a reasonably-confusing puzzle or a guess // as to having already put the time in to learn the system, so that we // speak their language more. Hackers tend to assume that everybody has as // much free time as they do, and might misinterpret things if somebody // didn't act as if they also did. This assumption would be easy to change by // playing their hacking games with them or preferably simply talking // clearly and directly and publically, rather than [s/fucking up their open // source people and projects/waiting for them to notice/]. But obviously // we can't do that, since we're [s/a bunch of people who want to help, // not the people in charge/too busy to get personally involved/]. std::cerr << "Enter public key of sender: " << std::flush; std::cin >> pkhex; pk = binary2hex(pkhex); std::cerr << "Enter nonce: " << std::flush; std::cin >> nhex; n = binary2hex(nhex); std::cerr << "Enter cyphertext: " << std::flush; std::cin >> chex; c = binary2hex(chex); m = crypto_box_open(c,n,pk,sk); /*The crypto_box_open function verifies and decrypts a ciphertext c using the receiver's secret key sk, the sender's public key pk, and a nonce n. The crypto_box_open function returns the resulting plaintext m.*/ std::cout << m << std::endl; } ``` In the next possible episode, we would either make a sourcefile to send a message to the hacker by again copying from that same website, or find a pre-existing tool that already does so, and then try sending a message to see if we even interpreted their signature at all correctly. We might also make an embarrassed reply, asking what their signature means, or search the archives of the list to find a clear explanation of it sitting there.