Baixe The Fine-Tuned Universe and the Existence of God e outras Manuais, Projetos, Pesquisas em PDF para Informática, somente na Docsity!
Something about Network Security. Exploits, research … profit!
Thoughts on Security
Home
About
Building Secure Networks
Copyright/License
Important Stuff
Links
msfgui
sessionthief
« Easy Smart Card SSH Setup
Exploiting Ammyy Admin – developing an 0day
Background
For the past few years, a number of groups of scammers have been cold-calling thousands if not millions of people in what‘s been referred to as the ―Ammyy Scam‖ or the ―Microsoft Tech Support Scam‖ among other names. The scammers pretend to be from Microsoft or another official group and claim to have detected errors on the users‘ computers. They have the victims pull up internal logs that show errors, and convince them to download and run the Ammyy Admin software to allow them to remotely control the system. After that point, they may install backdoors or other malware, or simply ask for hundreds of dollars to ―fix‖ the problem. The phone scammers have prompted numerous responses from Microsoft as well as warnings from Ammyy itself on its website. Even though at least two groups have been prosecuted, many more continue to operate. Ammyy Admin is one of many remote control software programs; it is not inherently malicious. The scammers just use it because it‘s an entirely self-contained executable that runs without any installation, it‘s the easiest to use for an ad hoc connection.
The internet is also full of technical users who have trolled the scammers, wasting their time, making fun of them, or forcing them to see disgusting images. Like most of us in the security industry, I was amused, but thought little about it until the scam hit closer to home when I discovered one of these groups had managed to scam my grandparents and leave their computer an infected mess for me to clean up. So I set out to find out if I could counter an attempted scam with a full fledged remote exploit, and turn the tables on the scammers.
The Challenge
This was also a very interesting challenge, because most of the time, exploiting software begins with fuzzing the network protocol or file formats used based on format specifications like HTTP or FTP, modifying samples of legitimate files or network traffic, and/or examining source code for vulnerabilities. Exploiters often take advantage of debug symbols, which
Microsoft provides for their binaries, or other public documentation. For example, for some targets, finding an exploitable vulnerability is as easy as throwing a long string in the protocol and watching a stack overflow give you control of the instruction pointer. And if your target is like that, awesome for you! But it gets harder for widely-used software (Ammyy claims that the software is used by over 36 million personal and corporate users) especially if it wasn‘t selected for being a weak target.
In this case, Ammyy Admin not only did not have publicly described protocols, source code, traffic samples, or debug symbols, as I found out, its traffic was also incomprensible. The first thing I did was to set up an Ammyy Admin connection between two virtual machines and capture the network traffic. I started comparing it against other well-known remote desktop protocols, such as VNC and RDP, but quickly discovered that Ammyy uses a completely proprietary network protocol. Not only is the protocol not well known, but all the network traffic was encrypted, making it impossible to reverse-engineer or even replay and reproduce with network traffic alone:
You can keep staring at that all day, but I‘ll save you the trouble; it‘s just encrypted data.
Being a reverse engineer by heart, I first set out to identify the code that parses the first few packets to see if there was any kind of vulnerability I could find in it. Ammyy Admin is a decently large (764 kilobytes) executable that does not include the C runtime library, and it appears to be written in C++, which means the call graph between functions is generally lost in a mass of vtable function pointers. But with a little debugging, it wasn‘t hard to find. This code snippet parses a number of flags that aren‘t really important and then begins initializating the crypto functions, but it was very small and doesn‘t contain exploitable vulnerabilities.
Much nicer, clearly plaintext and structured, and best of all, repeatable.
The next step was to turn the injected internal protocol sniffer into a fuzzer. I took a brief look at some of the publicly available fuzzers, but none of them appeared to make the process any easier. Fuzzers like minifuzz are easy for fuzzing file-parsing programs, and Peach can easily generate network traffic starting from a protocol specification, but I‘m not aware of how to set up any to perform modifications via injected code, while synchronizing and looking for crashes across multiple VM‘s. So I accomplished this by using the ―hookfuzzer‖ I had written. I modified it to receive a seed over the network and generate pseudorandom numbers to flip about one out of every two hundred bits. I set up the ―controlled‖ end to send the manipulated data back to the ―controller‖ side. There‘s not really any point in trying to crash the controlled side, since the controller already owns it.
After running the fuzzer manually a few times, the Ammyy controller crashed! Ammyy caught the error and displayed an error message with the faulting instruction. I modified the injecting sniffer/fuzzer to replay that transcript and verified that the crash was reproducible.
The instruction was an invalid memory access, which didn‘t appear immediately easily exploitable, since it didn‘t show control of the instruction pointer and the functions responsible seemed extra-awful to reverse, so I decided to automate the fuzzer and run it until I got a better crash.
This is some of that awfully complicated flow graph for that awful function.
I wrote a few helper executables and two PowerShell scripts, one on the controller side and one on the controlled side, to form my ad hoc fuzzing framework. They automated starting a new instance of Ammyy Admin, injecting the fuzzer, clicking the appropriate buttons to connect, waiting a few seconds for a crash, detect whether or not a crash had happened, saving the crash address and transcripts of the plaintext traffic that had caused the crash, and restarting the whole process. Next, I cloned a bunch of Windows Vista VM‘s, loaded the fuzzers on there, and let them go.
After running for a few days on 5 pairs of VM‘s, the fuzzer had collected a few thousand crashes, at 11 unique addresses. The vast majority of them fell on the same address as the first crash, and most of the unique crashing addresses were in different functions in the same executable, but two of the crashes demonstrated control of the instruction pointer.
I pulled up the saved transcript and loaded a debugger into my test VM, and traced back the crashing code. For all the effort I had put into building the fuzzing framework, the flaw was the same root vulnerability in the same awful function as the first crash I found. Oh well, looked like I needed to get back into RE and find out exactly how the protocol worked.
Exploitation
After a few days tracing the code, the protocol became clearer. Upon negotiating a successful connection, the controller spawns a thread to handle rendering the remote screen. The first data sent from the controlled end includes header data and global flags for the connection. It then contains system information such as operating system and system name. Finally it includes screen dimensions and various other fields. The controller then allocates a screen buffer using Windows GDI functions based on the screen dimensions, stored in RGBA format; four bytes to a pixel. After a chunk of data describing the cursor, the data stream sends what I call ―stroke sets‖ which draw or update a rectangle on the screen
since we can easily reserve a million pixels (4MB) or more if we want. So I just used the Metasploit Unicode encoder to create shellcode that will work when every other byte is a 0, which will work with basically any shellcode.
As far as the out of bounds write, the stroke set parser return address is at 0325FEBC when pixel data starts at 03360000. That‘s a 0x144 or 324 byte OOB overwrite from start of image, which is 81 pixels. So, with an 800×600 screen buffer, a stroke set with X offset 719 and Y offset 600 (since rows go down in address) will write to the appropriate offset.
With this work done, I put together a metasploit module that will generate a plaintext transcript to send to the remote end via the injected DLL into a running Ammyy instance that will exploit the remote end trying to take over your computer. In order to run it, you still need to run Ammyy Admin, save the plaintext transcript in its directory, and inject the DLL into the process which will load up the transcript. So I put together an executable package to automate this. I wrote the exploit for Ammyy Admin 3.4, including both the direct and ROP targets, and I updated for 3.5 when it was released. The vulnerability has been present for as long as I checked, at least back to 3.0, and probably before then.
You can download the complete package here, including a fully commented metasploit module and detailed README with more information on running it: https://www.scriptjunkie.us/aaa.html The one remaining caveat is that Ammyy can connect in two main ways; either by ID, which routes a connection through relay servers run by Ammyy (rl.ammyy.com), or directly by IP. I have only written and used the exploit with a direct IP connection to avoid sending it over the internet, so although the vulnerability should be present either way, I recommend blocking rl.ammyy.com in a hosts file and simply using direct IP connections. Or at this point, feel free to look into making it work over the relays, but I have not.
Aftermath No scammer group has ever called me, and I have never used this except to test it and in demonstrations. I don‘t normally release zero day exploits, but I made an exception in this case because given the reporting and usage of Ammyy Admin I consider it highly unlikely to be used to compromise innocent victims. The primary users at risk of compromise are the scammer groups. Hopefully, it will be a deterrent to those who would attempt to compromise and take advantage of innocent victims.
This entry was posted on September 11, 2014, 4:15 am and is filed under Exploits, Metasploit, Uncategorized. You can follow any responses to this entry through RSS 2.0. You can skip to the end and leave a response. Pinging is currently not allowed.
http://www.scriptjunkie.us/2014/09/exploiting-ammyy-admin-developing-an-0day/
About
Building Secure Networks
Copyright/License
Important Stuff
Links
msfgui
sessionthief
Important Stuff
You first touched a computer when you were n years old, where you discovered Carmen Sandiego/minesweeper on the
generic PC your university/family had. Intrigued by the amazing abilities of the system, you immediately wanted to know
how it worked, but were intimidated by the complexity. Nevertheless at n+1 you were familiar with operating all the
software you had. By n+5 you had written a few simple programs, and by n+10 you could bend the API‘s to do whatever
you commanded. At some point, you went to school for your CS degree, and a few years later, you had found the world of
security, and could get whatever access you wanted. Around n+20 you had written some serious exploits. By n+40 you
were a CSO at a profitable company, and by n+60 you were happily retired, and just trying to keep up with the news. And
at the age of n+80 you died.
Then what? You‘ve spent years learning about technical details of systems, and that may serve you well for the next few decades. But what about the next few centuries? Where will you be a million years from now? Most people believe everyone has a soul that will go on forever. It is a question that has more weight than anything else I can cover here. And no one should be scared, confused, uniformed, or in denial over it.
As some of you know, I am a Christian. It is a title I am proud to wear; for as I have matured, I have done my best to take a hard look at everything I have heard from my family, friends, and teachers, especially when they disagreed. So let me tell you about my faith. (Faith: the system of facts I know that are central to life, not just a hope in something I want to be true)
Mark Cahill has done a good job putting down his thoughts on the matter, and you can take part in a Q&A conversation by going to his website: http://www.markcahill.org/. I highly recommend reading this excerpt from One heartbeat Away as well. If you have read that and want to read the book (woah! book! no way! relax. It only took me a few hours. It‘s brief.) let me know, and I will get you a copy, and would love to talk with you about it.
But maybe you need to see more of those technical details. Like many educated people, such as those in the security and other technical fields, you want to base your view of life, the universe, and everything in terms of the best deductive logic and peer-reviewed science. Good for you! I feel the same way. So I encourage you to please review just four of the reasons I believe, and read and consider them. And as the stakes of eternity imply, it is well worth your time.
Why God? Creation Christians have always insisted that the universe had a beginning; that it was created by God, the First Cause. Since Einstein‘s discovery of general relativity in the past century, scientists have also become convinced of this simple fact; that
Fulfilled prophecies
One clear indication is in the fulfilled prophecies which would have been impossible without God. For example, many prophets foretold the exile of the Jews to Babylon before it happened. Then Jeremiah and Ezekiel prophesied their return about 70 years before it happened.
Many prophecies were fulfilled by Jesus, who also made many prophecies. Example: about 800 years before it happened, Micah foretold the birthplace of the Messiah. Jesus prophesied that the temple, the pride of Israel, would be destroyed so that not one stone was left on top, and it was fulfilled about 40 years later. He also prophesied that the Jews would be again exiled, which was fulfilled after the destruction of the temple. And the same had been prophesied by the prophet Micah about 850 years before it happened. Psalm 22 contains many details about Jesus, that were fulfilled in his life and death.
For those who like figures & numbers: This page http://www.reasons.org/fulfilled-prophecy-evidence-reliability-bible contains a few more examples of fulfilled prophecies, along with a corresponding probabilities of fulfillment. Another example: ―Some time before 500 B.C. the prophet Daniel proclaimed that Israel‘s long-awaited Messiah would begin his public ministry 483 years after the issuing of a decree to restore and rebuild Jerusalem (Daniel 9:25-26). He further predicted that the Messiah would be ―cut off,‖ killed, and that this event would take place prior to a second destruction of Jerusalem. Abundant documentation shows that these prophecies were perfectly fulfilled in the life (and crucifixion) of Jesus Christ.‖ In case you‘re wondering, the listed prophecies have a combined probability of less than 1 in 10^138 of happening without Divine guidance; which, as pointed out, is stronger than our confidence in certain laws of physics, like the second law of thermodynamics. All Biblical prophecies have an estimated probability of 1 in 10^2000 of just happening by chance.
A note on these probabilities. Just as a matter of perspective, if your friend asks you to pick a card out of a deck without showing him, and then he ―randomly‖ picks the same card, you would know that it was rigged; your friend had to ―cheat‖ somehow to figure out which card you pulled. And that‘s just one chance in less than 10^2. For comparison, an estimated number of atoms in the observable universe is 10^80. These numbers are literally inconceivable; the chance of these prophecies being randomly correct is far less than if two people each completely randomly picked a single atom out of the entire universe and they both happened to pick same one. Nerdy analogy, but you literally can‘t come up with a bigger deck to pick the card out of. That doesn‘t happen by chance; it can only happen by God‘s design.
Why Jesus?
The resurrection.
It is one of the central tenets of Christianity. When Jesus came, he performed many miracles that quickly drew and astonished the crowds; a big reason the number of Christians basically exploded in just a few years, only God could have done them. But the most well-known and important miracle God performed was after Jesus‘ death, his resurrection. A brief outline of why you can believe it is here from Stand To Reason. But I‘ll just list five basic facts, accepted by almost all scholars. See this page http://www.str.org/site/PageServer?pagename=PL_article_dead_or_alive_1 for a little more info.
Fact #1: Jesus died by Roman crucifixion. (numerous eyewitness accounts including medical reports, ancient historians, pre-burial procedures, and the Roman executioners all confirmed it) Fact #2: The disciples believed they had seen the risen Jesus. (numerous eyewitness accounts; most chose to die rather than deny this fact, and no one dies for what they know is a lie) Fact #3: Saul of Tarsus (Paul), an enemy of the church, converted because he believed he had seen the risen Jesus. (after dedicating his life to beating up, imprisoning, and killing Christians – no other believable explanation) Fact #4: James, the brother of Jesus and a skeptic, converted because he believed he had seen the risen Jesus. (a skeptic his whole life until this event) Fact #5: The tomb of Jesus was empty. (Once again, numerous eyewitnesses, as well as the inability of religious & political leaders to produce a body) Over 500 individuals saw, met, touched, ate with, and/or talked with the risen Christ. From which I conclude that Jesus in fact did rise again from the dead.
So what does all this mean? This faith is not a nice story, it‘s a fact. There is a real God who is beyond our universe and our conception. Yet he has put this incredible design together for us, and has given us his word, with a seal of authenticity. Jesus, who told us how to live, who claimed to be God, equal to the Father and the only way to God, proved it with his life, death, and resurrection. What does that mean for you? You can trust what the Bible says. You can trust in Jesus as your Lord and Savior and know where you are going after your death. Then love the Lord with all of your heart, soul, and mind and love your neighbor as yourself. It‘s the best way to live.
#1 by Adam on April 26, 2011 - 2:17 am
No offense is meant by the comments below but I have just a few questions…
Why Jesus and why Christianity? Isn‘t it possible that some other force or being is responsible? I agree that it is very remarkable how the universe works and that in order for our existence things need to be a very specific way. But, is that to say there are NO other intelligent beings in the universe? If God put all those circumstances in place to allow us as humans to live, why would He leave the rest of the universe empty? And if they are other intelligent beings in the universe, which it is almost impossible to deny in my opinion, Do they also believe in God in the same sense as you? Or have they more scientifical answers for these questions than we do, and therefore have no ―faith‖, but only science and fact?
o
#2 by scriptjunkie on April 26, 2011 - 11:40 pm
000 (10^333).
So the chance that even one such life-support body would occur anywhere in the universe without invoking divine miracles is 1 in 100 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000. (10^311)
Yes, there is a huge number of stars. No, there aren‘t nearly enough for this to happen by chance. And to support advanced life is about 1 in over 10^1000. (See linked research compendium for source) And those figures do not even take into account the requirements for matter to exist as we know it at all. Unless things like the strong nuclear force and the ratio of the gravitational force constant to the electromagnetic force constant were precisely within 1 part in about 10 000 000 000 000 000 000 000 000 000 000 000 000 000 (10^40), there wouldn‘t be any planets at all to fit into. The universe still speaks of design.
Even if there could be another chemical basis of life, or heck, another billion ways life could happen, you still have to explain the fine tuning of the universe to within one part in over 10^150 for basic chemistry and then you have a billion (109) chances in 10^1032 for long-term life support, or still 1 in 10^1023 in total. The evidence is so overwhelming for design, even the vast number of planets in the universe cannot explain it.
Some people still argue that well, since we are here, everything that needs to be fine-tuned must have been. Unfortunately, that‘s not an explanation. To borrow an analogy, suppose you faced a firing squad of a hundred executioners with rifles, and after they all fired, you had not been hit. You don‘t say ―of course they didn‘t hit me, I‘m still alive‖ to explain why no bullets hit you. That doesn‘t explain anything. You know it didn‘t happen by chance. You know they didn‘t hit you by design. Either by choice (they all decided to aim away), or since someone replaced all the ammo with blanks, or some other design, you were not hit. And there is a much much much better chance of that happening by chance than the design of the universe. This universe didn‘t happen by chance.
edit:stars
#5 by Kim Guldberg on April 27, 2011 - 12:43 pm
its not 10^22 planets, it‘s 10^22 stars and if the solar system is average (and why shouldn‘t it be) every star has an average of 10 planets. Anyway it‘s a matter of faith and for me the whole idea of intelligent design is ridiculous and
unnecessary. your estimate of the chance is a arbitrary number. I could with just as much credibility state that the chance is one in 10^12 in which case many many millions of stars has planets that potentially holds life.
The problem is the word ―theory‖. The theory of relativity is a theory. The theory of Darwin is a theory. My theory that pigs can fly is a theory, so is intelligent design. you just cant compair the two. One s substantiated by science and can be replicated in a lab one is….heavily advocated by religious fanatics and has nothing to do with science.
But as with all faith you are welcome to belive what yu want, just don‘t call your beliefs science
#6 by scriptjunkie on April 29, 2011 - 9:51 pm
Corrected on the stars. It is true, you can believe in whatever theory you want. But I would prefer to believe in the theory that is backed by the best analysis of the most evidence. The difference in the theory that pigs can fly or pegging the chance at 1 in 10^12 and what I am presenting is that the parameter fine-tuning I presented is all backed by peer- reviewed research. You may check the references. We may never agree, but I wish you the best.
#7 by Kim Guldberg on April 30, 2011 - 3:28 pm
That‘s the problem. The ―theory‖ of intelligent design is not ―backed up by the best analysis of the most evidence‖. It is often not backed up at all and when it is, it is backed up by pseudo scientifically analysis of what can best be described as possible interpretations of possibilities. I have searched high and low and not for evidence and analysis based on science. Let me give you an example of that kind of interpretation. When I look at life here on earth, I see it in the most extraordinary places, where life shouldn‘t exist. Thousands of meters below the surface of the ocean, where sunlight never reaches, with no oxygen, close to hydrothermal vents where the water is several hundred of degrees warm one moment and close to freezing the nest. You would probably take this as a sign of the genius of the divine god and as a fact that this planet has REALLY been designed well. I take it as a sign that life really does not need very specific conditions to spring and that life in fact will be quite abundant in the universe I do however understand why people would find the ―theory‖ of intelligent design enticing. Think about the alternative, that I am right. That we are not created by a divine god, in his image. What would that make us? Just another ape really. And not even a cool, admirably, just ape that ―one‖ could look up to. Rather a greedy, vicious, self- righteous, selfish ape with as much right to live as the next ape or common slug for that matter.
This is an interesting topic, and I would like to join and talk about what I believe in (That there is God) from the point of view of another religion (Islam) and thanks in advance for giving me the chance. — Usually when people talk about God, the views are 1)there is God (regardless of religion or of it‘s nature) or 2)there is no God.
What I usually hear as an explanation as to why there is no God, comes to a scientific evidence. There is no scientific evidence to support the existence of God, and hence there is no God. Despite how the universe is complex, and that it came/happened by chance is almost none.
God in Quran asks people to look into the creation of themselves, the creation of the heaven and earth, the creation of oceans, of trees. How our body works? How babies grow in the womb? The stars in the sky and their locations and a lot more.
Travel in the land and see how He originated creation (29:20)
We shall show them Our portents on the horizons and within themselves (41-
Verily! In the creation of the heavens and the earth, and in the alternation of night and day, there are indeed signs for men of understanding. (3:190) Those who remember God (always, and in prayers) standing, sitting, and lying down on their sides, and think deeply about the creation of the heavens and the earth, (saying): ―Our Lord! You have not created (all) this without purpose, glory to You! (3:191)
Today we know about the universe, the stars, about ourselves, etc. and how complex they are. We know more than any of the previous centuries ever knew.
We can insiste that despite all the knowledge we have that there is no God, or we can believe based on this knowledge that there must be a Creator.
God gives us the choice And say: ―The truth is from your Lord.‖ Then whosoever wills, let him believe; and whosoever wills, let him disbelieve.‖ (18:29)
On the day of Judgement one will know if he made the right choice or not.
Peace
#11 by CJ on June 7, 2011 - 10:40 pm
Hello, first of all let me say that it is absolutely amazing to see people stand up and support their faith. It is hard to find someone who proudly exclaims that they are a christian, so kudos on that. Secondly, I would like to point out that the bible is the most accredited piece of literature we have today. It is extremely hard to argue that we were made by a product of chance, and that we all are endowed with perceived morals. So even though it should be a simple assumption that there is an infinite being who is the creator, there is plenty of evidence to also point you in the right direction.
#12 by packetdude on August 11, 2011 - 12:48 pm
Pretty gusty and honest move to include this information on your site. I think infosec is the kind of field where people can do this, as we are used to fierce debate coexisting with collegiality.
I‘m with you. I think it‘s important for people to understand that evolutionary thinking is essentially what nearly every religion other than Judaism and Christianity teaches. Look at the Norse/Germanic gods — they emerged from the pre- existing physical world.
All ―scientific‖ analysis on origins is inherently flawed. Science depends on forming a hypothesis and then testing it. We have no means to test the origins of the universe. It‘s not repeatable or observable, and therefore any hypothesis about it cannot be verified in a proper scientific fashion.
#13 by rk on September 12, 2011 - 1:53 pm
This is a touchy issue but as a fellow netizen/techie I would take the liberty to discuss it and no offense meant at all. I won‘t go into restating what majority of the world including most scientists think, but here are some good starts – http://www.youtube.com/watch?v=9V_2r2n4b5c&feature=related http://www.youtube.com/watch?v=SSxgnu3Hww8&feature=BFa&list=HL1316615359&lf=mh_lolz&index= http://www.youtube.com/watch?v=vss1VKN2rf8&feature=BFa&list=HL1316615359&lf=mh_lolz&index= Also dont you think it is ironic to use science when it favors your argument but disregard it when it doesn‘t? Another case of double standard is you like to slectively point out a few things in the Bible/Chistian texts, what about all the questionable points of how old the earth is, how Mr. ‗God‘ preaches peace but himself commits mass murder etc. etc. Again nothing personal but please dont disrespect the humble ‗Science‘ which accepts its mistakes and strives to find an answer verus apparently all-knowing ‗God‘ and his ‗preachings‘ all of which is highly dubious.
- Nazis, eugenics Once again, I didn‘t make any of those arguments (and wouldn‘t; they do demonstrate a misunderstanding of evolutionary theory).
You also mentioned the age of the earth debate. I personally don‘t know exactly how old the earth or universe is, but there are a huge number of Christians, including myself, that believe the various scientists when they say it looks billions of years old. (and the discussion of how that can be interpreting the Hebrew text is also interesting, but less important) Once again, not an argument I made or would make.
I do not believe the mass murder argument makes sense in this case. If there is a God who created everything including moral law itself, and he said that at one point in history there was a group of people who were so evil that they all deserved death, and you had never met any of these people in your life, why would you doubt it? Because you didn‘t feel like that was very likely and you didn‘t think God would do that on purpose or you never saw anything like that in your experience? I do not believe anyone alive has seen anything like that. The argument convincingly shows that a god who claims to be good and yet lies about ordering the death of innocent people is not good. This is absolutely true, and I also believe this. It does not argue against what I believe.
In summary, I appreciate your willingness to discuss these issues, and I absolutely mean no disrespect or disregard to science. I also apologize if there are dozens of illogical or false arguments going around. But I encourage you to not simply dismiss the idea of Christ, because there are many good reasons to believe as well. So don‘t make the mistake of some scientists and ignore any explanation involving God, assuming he does not exist. Look at all the evidence and you‘ll find it strongly points to Christ.
#15 by rk on September 12, 2011 - 3:29 pm
Again I would love to discus point to point but I can‘t write such long comments as you :), I‘m impressed! All I would say is give a serious look at events in your own history which has shaped your point of view, then put yourself in another set of shoes and think of this issue as a child would – looking for a logical reason to everything, without exceptions. Do not fall in the trap of anything unexplained must be God. Thank you for kindly listening to me
#16 by Neanderthal on September 14, 2011 - 2:58 pm
Hi Awesome presentation on Defcon, both material-wise and orally. Really enjoyed that one. You are clearly a very brilliant
guy, so this page was a surprise. I‘m not here to troll, and I‘m not here to offend you, or any who hold beliefs far away from mine. People may believe whatever they want, as long as they don‘t impose rules and laws derived from ancient scriptures on me, my loved ones – or any other person not heavily invested in that particular belief. You seem like an open minded person, willing to air your beliefs in open unperturbed (as in ―you can‘t say that, it‘s blasphemy!‖) discussion and take honest criticism, so I‘ll dare comment this. I made some remarks on a paper as I read your beliefs and I will just comment them – not necessarily in order. I‘m from Norway, but my English should be understandable (thanks spellchecker).
―Soul‖: my personal view on this is that it‘s a ―brain bug‖. Evolution have given us a mindblowingly complex structure, and there‘s lots of old technology in there – inherited from earlier times when that particular technology gave us an edge in life. On the way we somehow picked up the ability to attach personality to objects – children do this all the time. They give name to rocks and sticks, some sticks are bad, some rocks are sad, etc. They can‘t avoid projecting, and neither can we (grownups). This is why it is almost impossible to avoid the fallacies: ―me and my brain‖, and ―what happens after I‘m dead‖. We just have to put something ―living‖ in there.
―Mark Cahill‖: I have not read this particular book (read the excerpt though), but I have read others like it. Beautifully written, but you soon get a very strong feeling that you are dealing with a car-salesman. Every sales pitch is in there, screaming at you. For some good hours of entertainment, read ―Influence. Science and Practice‖ by Robert B. Cialdini.
―First cause‖: 1‘st law of thermodynamics – matter and energy is conserved, nothing can come from nothing, ergo there must be a God. This is not a good argument, and it is in fact a very old one. The first mover argument is broken. And for another view on that 1‘st law of thermodynamics stuff, read (or see and listen on youtube) Lawrence M. Krauss: a universe from nothing.
―Designed‖: it has definitely not been rigorously scientifically documented that the universe is designed. The word ―designed‖ is a trap – it psychologically invents a ―designer‖, projection again. But the ―fine tuned‖ argument is annoying. We should, and must, be able to explain that one more clearly. But it is only annoying, nothing more. The leap from ―the universe as is, is strongly dependent on the values of constants‖ to ―it must have been designed by a grand intellect we don‘t have to explain‖ is rather arbitrary. And all of these constants comes from the ―Standard model of particle physics‖. Albeit amazingly accurate, consists of twenty-something parameters that must be estimated and put into the model for it to work as well as it does. I‘m a strong believer in, that if there is a TOE(theory of everything), the ―Standard model of particle physics‖ is not in it. All these probabilities of some god – or improbabilities that shit just happens, seems like a case of ―I blinded you with science‖ to me. If you change just this or that constant everything falls apart – but what if you change 2, or 5? And what about multiverse hypotheses? Each multiverse comes with their own set of physical laws and constants – we just happens to live in one of those, and we are what we are just because we live in this particular one (read e.g. Lee Smolin/Stephen Hawking. Victor Stenger has written stuff on the fine tuning argument, worth while reading). To me, all this is blindingly simple: we are ants, amateurs, n00bs. The universe is clearly amazingly complex, and our current version of physical laws is clearly not the last version. We have just scraped the surface. And with an awesome force like
