04/30/12

Cyber Weapons and Cyber Attacks

gAtO wAs -reading my friend Pierluigi Paganini’s Security Affairs blog – http://securityaffairs.co -  about “Google Used as Cyber Weapons and it got me thinking. To put it in todays terms, cyber Iran is in the news lately and they do control oil coming from the middle east. Their oil fields are controlled by the Internet (SCADA) and thus vulnerable to a cyber attack. So talking about cyber weapons is not far fetched.. so.. What are Cyber weapons and how do we use them in today’s digital infrastructure. Cyber weapons today are not just about security but also as a geo-political tool and it’s power to control the price of oil as well as an a attack vector. 

We have targeted and un-targeted cyber weapons. If we look at Stuxnet and DuQu style of targeted attacks we have a cyber weapon that is guided to make sure it has the right target then uses unpublished certificates to give the software a trusted attack vector, then it goes about doing it’s dirty work. DuQu is different and these two codes do different things one is a computer to kinetic cause and effect like messing with their centrifuges in their enrichment plant and telling the monitoring stations that everything was cool and dandy and then deletes itself from the face of the earth after a self-kill date.

One lone person can with today’s tools develop, control and execute a massive cyber attack to any physical device that is connected to the Internet.

 

What is a Cyber Weapon? – http://hackmageddon.com/2012/04/22/what-is-a-cyber-weapon/

On the other hand DuQu goes and does recon and gathering of information to make an attack transmit it back to Command & Control, then sits back and waits quietly and undetected. What a dynamic dual these two are, why mention these two because, Stuxnet was the first and DuQu was the son of…stuxnet. We now have an evolving Code-Based warrior class of cyber weapons that using this framework other cyber weapons can be created.

 

The Internet was design as a weapons-class communication medium.

Spammers and phising criminals have got a new tool social engineering: it is used in:Advanced Persistent Threat (APT) style attacks just a simple email attachment and your their next victim. Then the Chinese did a clever legal plain overt in your face thing— they created an FACEBOOK account for “James Stavridis”  who happens to be an American Admiral in the Minister of Defence in NATO and then other officials from NATO accepted his Friend request and gathered tons of personal information about high ranking NATO officials.

This is the plain in sight social engineering planning that goes into today’s complex cyber operations. It’s a numbers game. The question needs to be asked. How many dead unknown family relatives have died and left me billion of dollars from Nigeria? Like I said someone will click on the link, greed, stupidity or just drunk, they just created another zombie computer. This zombie can now be given a dictionary attack code to hack your site and the hack begins a new. The life-cycle of hacking botNet.

The bad guy’s are everywhere -  The social engineer aspect in today’s social networks is so new that nobody has the rules. 

Let’s go into a hackers mind. I’m a game player and we figure out the games and then find the weak spot and slide right in and killing that monster to that level 22 knight elf warrior. To make it more fun Google and Facebook are changing their security policy to allow more and more information about ourselves is available online. Make sure you know that anything you say online is stored, collected and examined until you go down the rabbit hole like ToR “Smile your on candid camera” – all the time.

 

In today’s digital matrix just about anything can be used to hack you. 

We today have attacks like the LuckyCat attack from China that has a Chinese professor with a masters and PHD in computer science leading the team. The LuckyKat hack was very well though out and planned with “state-sponsored individuals in China”. Lucky Cat:

To avoid detection, the hackers used a diverse set of infrastructure and anonymity tools. Each attack used a unique campaign code to track which victims were compromised by which malware, illustrating that the attackers were both very aggressive and continually targeted intended victims with several waves of malware, according to Trend Micro’s report.

The security company was able to connect an email address used to register one of the group’s command-and-control servers to a hacker in the Chinese underground community.

The hacker has been using aliases “dang0102″ or “scuhkr” and has been linked to the Information Security Institute of the Sichuan University in Chengdu, China, where he was involved in a research project on network attack and defense.

The person behind the aliases and the email address is Gu Kaiyuan, who is now apparently an employee at Tencent, China’s leading Internet portal company, The New York Times reported on Thursday.

While we spend time on low hanging fruits like the Anonymous attack from the LulzSec crewz and Sabu. Come on this was an embarrassment and the FBI took it personal while the RSA (March 27, 2012 NSA Chief:China behind RSA Attacks: ( http://www.informationweek.com/news/government/security/232700341 ) and Locckheed Martin (May 31, 2011- Lockheed Martin Suffers Massive Cyber attack – http://www.informationweek.com/news/government/security/229700151 ) hacks from foreign nationalist hacking into our defense contractors was a much bigger deal but we ate up the LuLz and three months later we gave Loockheed Martin a National contract to protect our National electrical grid(July 27, 2011 – Lockheed Promised Electric Grid Security Contract – http://uscyberlabs.com/blog/2011/07/27/lockheed-promises-electric-grid-security/ ).

Now why is “gAtO going LoCo” over all this is because while all this madness is going on these professional hacks are being given to smaller countries and even smaller terrorist cells that can use these same tools professionaled managed and all in a box. How to Hack a Box going to your local nut case living in mama’s basement, another unemployed person with time on their hands and reading all about it. This is the bottom of the connect the dot contest. One lone person can with today’s tools develop, control and execute a massive cyber attack to any physical device that is connected to the Internet now that’s a cyber weapon

 

How many devices connected to the Internet that you know about??? -?— gAtO oUt. .

 

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit
03/2/12

Hacking The Deep Web – AntiSec Embassy Backdoor Open

gAtO wAs - in the deep web today just for the lulz and found that yes even-no especially in the deep web a miss-configured website can open the door to everything. How can we find simple hacks that even the best leave open – you go back to square one. The URL is the key to most every website clearWeb or dark Web it does not matter. The .onion only hides you but if you find a form anywhere a simple 1=1 and you just may find that WoW it works. The reason is that HTML is HTML and the .onion does not do anything differently. Testing a website for Sql-injection with a simple ‘ will work anywhere if you think that just because you build a dark website that everything is cool and they can’t find you- your right but the web is the web and the same everywhere.

the site backdoor to the files

http://ibhg35kgdvnb7jvw.onion/final/

Front door

http://ibhg35kgdvnb7jvw.onion/

I noticed that my clearWeb site uscyberlabs.com displays differently in ToR than in the normal web. Why – first thing it’s the Time Clock I have and second is my categories, my tweets code did not come thru either…Now one is code and the other is just a wordpress widget so how come??? First thing I though is that TOR does not like geo location information. This would make sense but why the Categories in wordpress, what so especial about them. The tweet is just code too… Just a few things I noticed about my site in the Deep Web and the clearWeb.

 The deep Dark Web is nothing without good security on your site. If you think that ToR will hide you’re right but will it protect your site from bad code or mis-configuration NO. Hacking is hacking in the .onion or the clearWeb people will try to hack you. In the deep web you may have more information than other because you feel safer and that safe feeling is were you may leave stuff that you do not want out, so don’t think for a second that you will not get hacked in the deep web I just did. I cannot tell you until the site is secure and this site did have lot’s of confidential information, maybe some a little outdated but be careful other gAtOs may not be so nice especially if you tried to hack his site before -gAtO OuT

 

Index of /final/ca/

Name Last Modified Size Type
Parent Directory/ - Directory
cpizzotti/ 2011-Nov-09 03:58:34 - Directory
ddelariva/ 2011-Nov-09 03:26:48 - Directory
kfair/ 2011-Nov-09 03:26:58 - Directory
3strikes.sql 2011-Nov-06 01:43:36 152.0K application/octet-stream
amvicforum555.mdb 2011-Nov-04 09:29:37 784.0K application/msaccess
backup.sql 2011-Nov-06 01:12:11 13.5M application/octet-stream
cariiforum555-2.mdb 2011-Nov-04 09:33:46 1.1M application/msaccess
cariiforum555.mdb 2011-Nov-04 09:32:07 580.0K application/msaccess
colre_forum_555-2.mdb 2011-Nov-04 09:34:00 2.6M application/msaccess
colre_forum_555.mdb 2011-Nov-04 09:32:31 2.6M application/msaccess
cslea_passwords.txt 2011-Dec-31 22:28:02 613.9K text/plain
file_listing.txt 2011-Nov-04 07:19:39 5.6M text/plain
forum.mdb 2011-Nov-04 09:35:36 576.0K application/msaccess
hpacforum555.mdb 2011-Nov-04 09:32:28 368.0K application/msaccess 

 

 

the site backdoor to the files

http://ibhg35kgdvnb7jvw.onion/final/

Front door

http://ibhg35kgdvnb7jvw.onion/

http://ibhg35kgdvnb7jvw.onion/final/ca/kfair/HTML_INBOX/threads.html

http://ibhg35kgdvnb7jvw.onion/

http://ibhg35kgdvnb7jvw.onion/final/ca/kfair/HTML_INBOX/msg05626.html

http://ibhg35kgdvnb7jvw.onion/final/ca/ddelariva/HTML_INBOX/maillist.html

http://ibhg35kgdvnb7jvw.onion/final/ca/ddelariva/HTML_INBOX/bmpHJsZxBZeRw.bmp

http://ibhg35kgdvnb7jvw.onion/final/ca/cpizzotti/HTML_INBOX/threads.html

 

 

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit
12/27/11

Phone Hacking Timeline-Is Rupert Murdoch a Criminal

News of the World: UK Police Put Phone-Hacking Victims At Around 800

LONDON — The total number of people whose phones were hacked by journalists at the News of the World tabloid is around 800, British police said Saturday.

Scotland Yard said investigators have spoken with 2,037 people, of whom “in the region of 803 are victims” whose names appeared in notes seized from a private investigator working for Rupert Murdoch’s now-shuttered News of the World.

“We are confident that we have personally contacted all the people who have been hacked or who are likely to have been hacked,” it said.

Police had identified 5,795 potential phone-hacking victims in material collected from Glenn Mulcaire, the private investigator at the center of the scandal who was jailed in 2007.

Scotland Yard said Saturday that while there are still “a raft of people” it needs to speak to who were identified as potential targets, those individuals are unlikely to have been hacked.

What had for several years been a trickle of allegations by people who claimed to have been hacked by the News of the World – from celebrities like Sienna Miller and Jude Law to politicians including former Deputy Prime Minister John Prescott – exploded this summer with the revelation that the paper had hacked into the phone of a 13-year-old murder victim, Milly Dowler, in hopes of getting material for news stories.

Two top London police officers and several senior Murdoch executives resigned in the scandal, and the investigation into phone-hacking has seen more than a dozen News of the World journalists arrested, including former editor Andy Coulson, who resigned his post as Prime Minister David Cameron’s media chief as the scandal widened.

It also has prompted multiple investigations and an official inquiry into media ethics, which has heard from the Dowler family and celebrities such as Hugh Grant about the effects of media intrusion on their lives.

1843
News of the World is first published, by John Browne Bell

1969
Australian Rupert Murdoch buys the newspaper, his first toehold in Great Britain

1984
Murdoch revamps News of the World from a broadsheet to a tabloid format

1989
Rebekah Wade
(she married horse trainer Charlie Brooks in 2009 and took his name) is hired at News of the World, as a secretary

March 2002: 

British tabloid News of the World began intercepting Dowler’s voicemail messages

Days after the disappearance of 13-year old Milly Dowler, British tabloid News of the World began intercepting Dowler’s voicemail messages. The paper deleted old messages to make room for new ones, leading some to speculate that she was alive. The Guardian reports: “The Dowler family then granted an exclusive interview to the News of the World in which they talked about their hope, quite unaware that it had been falsely kindled by the newspaper’s own intervention. Sally Dowler told the paper: ‘If Milly walked through the door, I don’t think we’d be able to speak. We’d just weep tears of joy and give her a great big hug.’”

April 2002:

Police first became aware that the paper was listening to Dowler’s messages after it reported that an employment agency had called Dowler about a job vacancy, but didn’t take action “partly because their main focus was to find the missing schoolgirl and partly because this was only one example of tabloid misbehaviour,” according to the Guardian.

November 2005:

A News of the World item about his knee injury lead Prince William to believe that his aides’ voicemail messages were being listened to by a third party. Three royal aides also noticed that new voicemails were showing up as old. Months later, the New York Times reported, News of the World editor Clive Goodman wrote a piece about Prince Harry’s visit to a strip club that quoted a voice mail message from his brother William word-for-word.

January 2007:

Goodman (right) and private investigator Glenn Mulcaire (left) received jail time for intercepting hundreds of voicemail messages meant for royal aides. The pair accessed the voice mailboxes of three aides 609 times, according to BBC News. An earlier search of Mulcaire’s home turned up “dozens of notebooks and two computers containing 2,978 complete or partial mobile phone numbers and 91 PIN codes; at least three names of other News of the World journalists; and 30 tape recordings made by Mulcaire,” reports the Times, but the pair were only charged for hacking the royal aides.

July 2009:

New allegations from the Guardian that NoW paid £1m to suppress evidence of phone hacking prompted Parliament to hold new hearings two years after News International exec Les Hinton (bottom left next to Murdoch) first testified that Goodman was the only person at NoW who knew about the hacking. At the new hearing, Coulson (top left) maintained that he was unaware of phone hacking during his time at NoW.

September 2010:

A New York Times piece alleged that phone hacking was pervasive at NoW and Coulson was aware of conversations about the practice, despite denying any knowledge about it. According to the Times: “‘Everyone knew,’ one longtime reporter said. ‘The office cat knew,’” and reporters “described a frantic, sometimes degrading atmosphere in which some reporters openly pursued hacking or other improper tactics to satisfy demanding editors.”

January 2011:

Coulson stepped down as communications chief, blaming media speculation that he knew about phone hacking during his tenure of NoW. News editor Ian Edmondson was fired after allegations of phone hacking, and new information prompted police to re-open the investigation on NoW.

April 2011:

The News of the World admitted its role in phone hacking in a public apology on its website and paper. Former editor Edmondson and reporters James Weatherup and Neville Thurlbeck were arrested on charges of intercepting voicemail messages.

June 2011:

Levi Bellfield was found guilty of murdering Milly Dowler, but a second charge that he had attempted to abduct another schoolgirl was abandoned after tabloid publicity made it impossible for the jury to reach a fair verdict. News of the World paid Sienna Miller £100,000 in damages after publishing 11 articles that used private information from her messages in 2005 and 2006, according to the Guardian.

July 2011:

Police notified Milly Dowler’s family that NoW intercepted and deleted the young woman’s voice mail messages, destroying possible evidence in the search for her killer. New evidence also shows that NoW targeted families of London’s 7/7 bombings.

July 8, 2011:

Andy Coulson, former communications chief to David Cameron and ex-editor of News of the World, was arrested in the investigation on phone hacking at NoW.

July 10, 2011:

The News of the World released its final issue after James Murdoch, head of parent company News Corp’s operations in Europe, made the decision to shutter the paper. The move was expected to “take some of the heat off immediate allegations about journalistic behavior and phone hacking.”

July 11, 2011:

Multiple news outlets reported that the Sun and the Sunday Times, also owned by parent company News International, had been hacking the voice mail box and other records of former Prime Minister Gordon Brown for years. The Sunday Times allegedly posed as Brown to obtain his financial records, and the Sun allegedly received details about Brown’s son’s cystic fibrosis. The revelations mark the first time allegations have targeted News International’s other papers.

July 11, 2011:

News Corp referred its bid to take over satellite broadcaster BSkyB to the Competition Commission, which will delay the deal by at least six months as the company awaits regulatory clearance. British leaders have called for Murdoch to drop the bid, with Labor Party leader Ed Millibrand calling the deal “untenable” and Liberal Democrat Nick Clegg calling on News Corp to “do the decent and sensible thing.”

July 13, 2011:

Rupert Murdoch withdrew its $12 billion bid for BSkyB, the largest pay-TV broadcaster in Britain, after the British government withdrew its support the day before. The deal, which would have substantially increased Murdoch’s foothold in the British media, appeared like it would sail through until last week. News Corp, which began to seek full ownership of BSkyB in March 2011, will keep its 39% stake in the company.

July 14, 2011:

The FBI launched a probe into allegations that News Corp. attempted to hack the phones of September 11 victims after Representative Peter King and other members of Congress wrote to FBI Director Robert Mueller demanding an investigation. Murdoch also agreed give evidence before a parliamentary committee. He had previously said that he was not available to attend the hearing, but relented after receiving a personal summons delivered to him and his son by a deputy sergeant-at-arms.

July 15, 2011:

Les Hinton announced his resignation as Dow Jones CEO, and Rebekah Brooks stepped down as chief executive of News International. Brooks presided over the News of the World during the phone hacking of murder victim Milly Dowler, and is scheduled to appear before a parliamentary committee next week. Murdoch also met with Dowler’s family to apologize.

July 17, 2011:

Brooks was arrested in connection with the scandal, throwing her scheduled appearance before Parliament on Tuesday into serious doubt. In addition, Sir Paul Stephenson, the head of Scotland Yard, resigned his position, becoming the highest-profile public official yet to lose his job because of the scandal. (The Met has itself been plunged into crisis for its lax handling of the scandal and for the corrupt ties police officers developed to News International.)

July 18, 2011:

John Yates, assistant commissioner of the British Metropolitan Police, stepped down after the resignation of chief Paul Stephenson the previous night. The scandal has focused on British police for failing to investigate evidence of News of the World’s phone hacking activities and for accepting bribes for information from tabloid writers. Yates decided not to reopen the investigation two years ago, saying he did not believe there was new evidence to consider.

July 19, 2011:

Rupert Murdoch, son James and former News of the World editor Rebekah Brooks testified in front of a parliamentary committee. All three insisted that they were not aware of phone hacking activities at the tabloid. Rupert Murdoch also made clear that he would not resign. Someone attempted to pie Murdoch in the face with shaving cream.

July 21, 2011:

A former editor and a top lawyer for the News of the World accused Murdoch of lying in his testimony that he had no knowledge of phone hacking at the tabloid. The two recall showing him an email between private investigation Glenn Mulcaire and then-reporter Neville Thurlbeck with transcripts of hacked voice messages. Sun editor Matt Nixson was fired following allegations that he knew about phone hacking during his time at the News of the World. The investigation also threatened to spread to other newspapers that were named for using a private investigator to illegally obtain information.

July 28, 2011:

The Guardian reported that the News of the World hacked the phone of Sara Payne, the mother of an 8 year old girl who was abducted and killed by a pedophile. The 2000 murder had prompted Rebekah Brooks to launch a campaign for a sex offender’s law in Britain now known as “Sarah’s Law.” The phone that the tabloid hacked may have been one that Brooks personally gave to Payne in the aftermath of the tragedy, which Payne had praised as for helping her “stay in touch with my family, friends and support network.”

August 16, 2011:

Clive Goodman, a former News of the World reporter, has alleged that there was a massive coverup of phone hacking at the tabloid. He was arrested for phone hacking in 2007, and now claims that former editor Andy Coulson offered to let him keep his job in exchange for saying that he was the only person at the tabloid who hacked phones. The allegations are deeply damaging to Coulson and Rupert and James Murdoch, who have all maintained that they knew nothing about phone hacking.

August 18, 2011:

Glenn Mulcaire, the private investigator hired by the News of the World to intercept voicemails, sued News Corp. over the payment of his legal fees. The company had been paying his fees since 2007 when he was found guilty of hacking the phones of aides to the royal family, but recently terminated the arrangement after Rupert and James Murdoch’s testimonies in Parliament. Mulcaire himself is the target of dozens of civil lawsuits filed by suspected victims of phone hacking.

August 19, 2011:

Glenn Mulcaire has been ordered to release the names of people who ordered him to hack the phones of six public figures. He is due to make the disclosure by the end of next week, as part of actor Steve Coogan’s lawsuit against News Group. The revelations threaten to blow the defense presented by News of the World editors, who claim they knew nothing about phone hacking.

August 22, 2011:

News breaks that the News of the World hacked even more of Milly Dowler’s voicemails than previously assumed.

August 26, 2011:

News International is continuing to pay Glenn Mulcaire’s legal fees, despite the company’s insistence that it would stop. The previous month, the private investigator had released the names of people who ordered him to hack phones, but the names were kept confidential.

September 13, 2011:

News International announces the discovery of thousands of new documents related to phone hacking.

September 19, 2011:

Milly Dowler’s family is slated to receive £3 million in a settlement with News Corp.

September 30, 2011:

Neville Thurlbeck, a former News of the World reporter, insists that he is innocent and was unfairly dismissed. His account contrasts News Corp.’s defense, which places Thurlbeck as the single rogue reporter responsible for phone hacking at the News of the World

October 5, 2011:

News International faces a lawsuit from the parent of a 7/7 London bombing victim, among at least 60 other lawsuits.

October 19, 2011:

Yet another lawyer has accused News International of misleading Parliament over its knowledge of phone hacking. Julian Pike, a partner of the firm that used to represent the company, said that he saw evidence that there were more journalists involved in phone hacking in 2008. His testimony came after the company signed with a new law firm and Pike was no longer bound by client-attorney privilege.

October 21, 2011:

Rupert Murdoch faced angry shareholders at News Corp.’s annual meeting. Shareholder after shareholder vented frustration with the company, and Murdoch struggled to remain calm, losing his temper at one point.

October 24, 2011:

James Murdoch has been called back to testify in front of Parliament for the second time on November 10. His testimony will focus on discrepancies in his account, given witnesses who have said that he signed off on phone hacking payouts to Gordon Taylor.

October 24, 2011:

Les Hinton, the former CEO of Dow Jones, testified about phone hacking in front of Parliament. The former publisher of the Wall Street Journal, who had previously testified on phone hacking in 2007 and 2009, denied that he misled Parliament in his past testimonies. He resigned in the summer, and was the most senior executive claimed by the scandal.

October 25, 2011:

James, Lachlan and Rupert Murdoch were all re-elected to the board of News Corp. despite huge shareholder opposition to their leadership. Their tenure was never in doubt, due to the company’s shareholder structure, but the majority of shareholders voted against James and Lachlan.

November 1, 2011:

A series of internal News International memos could be damning for James Murdoch, who is set to testify in front of Parliament for the second time next week. One of the documents was prepared for a meeting between James Murdoch and Colin Myler, the former editor who challenged his account of events, and specifically discusses the hacked voice mails. The notes of Julian Pike, then-lawyer for the company, also contain incriminating phrases like “paying them off.

November 10, 2011:

James Murdoch testified on phone hacking in Parliament for a second time. The younger Murdoch faced new evidence that he may have been aware of phone hacking at the time of his company’s settlement with footballer Gordon Taylor. He maintained his innocence, claiming that he was aware that Taylor had been hacked, but that he was unaware the News of the World had targeted others.

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit
06/12/11

The Alarming Growth of Global Cyber Menace – Hacking | Asian Tribune

When gmail accounts of some of the US state officials were hacked two weeks ago, the Defence Department categorized any serious cyber attack, as an act of war. Since Google had tracked down the source of the attack to a certain province in China, it was all too clear that the Pentagon was not beating about the bush while taking the cyber threat seriously. The gmail attack came hot on the heels of another high-profile attack – Lockheed Martin Corporation, the high-tech defence firm.Having been annoyed by implicit accusation, China hit back at Google by warning that the company would face the music, if it accused the Chinese government of covert involvement.

The disturbing cyber nuisance did not end there. The servers of

Sony

, the entertainment giant, were subjected to two successive hacking within a matter of days. On the first occasion – the more serious one – the accounts of millions of had been hacked into and then details were stolen; the servers of

Nintendo

suffered the same fate. On June 3, the servers of

Codemasters

, the largest UK game publisher, were hacked. The hackers did not spare even the

National Health Service

of the UK; there has been a breach of security in some servers, according to media reports.

The spate of attacks has pushed millions of online users, not necessarily the folks who play games, into a state of perpetual anxiety. Since the hackers have been able to stay a few rungs above the security experts along the learning curve, it’s high time the threat was treated as something against the whole online community, not just selected strata of it.

The companies, which have been affected, are counting the cost in terms of loss of both revenue and reputation. Although, they assure the customers of better security mechanisms in future – and when the horse had left the barn, of course – restoring customer confidence is going to be an uphill struggle for the companies in question.

According to the details that came out so far, the hacking had been performed by duping the customers into web pages which looked identical to what they normally had been familiar with; once signed in, they had been taken for a ride, to say the least.

So, the companies affected implied that the customers should not have done that; well, how do ordinary folks distinguish between a real one and a fake one, when they look almost similar? The explanations have not gone far enough to address the serious side of the issue; all they can say is warning the public to be on their guard at all times – and they already are.

These high profile hackings are not the works of adventurous individuals, carried out in their bedrooms as a way of fighting boredom. Nor are they the works of teenagers, who could spare hours on computers in typing in endless combinations of characters into login names and passwords, in the hope that one of them would make them lucky by pure chance – one day. The nature of sophistication clearly shows the involvement of highly organized individuals – perhaps, with a substantial technical background – who are prepared to break hell lose, if they can get away with it.

The two groups, which are at the forefront of hacking, are Anonymous and LulzSec. The former claims to be a ‘leaderless structure’ while the latter introduces itself as the ‘world’s leaders in high-quality entertainment at your expense.’ Who can disagree with them?

Anonymous has been in the habit of hacking into government websites in order to teach them a ‘lesson’; it was at its peak of activities, known as ‘hacktivity’, when Wikileaks were coming out in dribs and drabs. LulzSec, meanwhile, claims that since fun is restricted to Fridays, they are going to extend it beyond that – and to the weekend. Whether what is fun for LulzSec, is certainly fun for everyone, remains to be seen in the days ahead!

In addition, there are clumsy hackers too. I keep getting an email from one such stupid hacker, who is in the habit of urging me to collect a parcel from a well-known courier service while clicking on a link provided. However, he could not completely conceal the tentacles of idiocy: the ‘To’ field of the email consists of a chain of email addresses, not just mine. So, I decided to keep getting the emails for academic purposes, without diverting them into a spam folder.

If a user can be duped by such an email, then of course, big companies cannot be blamed for mistakes of that kind. In short, users have to be a bit responsible too while login into similar-looking web sites and opening unsolicited emails.

As the menace of hacking reached fever pitch, some countries in South East Asia have started cracking down on potential hackers – finally. The arrests have been made in Malaysia, Indonesia and Taiwan. However, this is just the tip of the colossal iceberg.

The geography of the places where hackers were found, the time taken before the action being carried out and the abundance of other regional criminal activities, do not paint a serene picture for the online community in particular, and the law-abiding global citizens in general.

If the governments in question keep treating the threat as trivial or non-existent, the trend can easily give a cumulative nasty shock for all of us at an unexpected time – something from which we may not recover without paying a heavy collective price.

via The Alarming Growth of Global Cyber Menace – Hacking | Asian Tribune.

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit
06/12/11

The Alarming Growth of Global Cyber Menace – Hacking | Asian Tribune

When gmail accounts of some of the US state officials were hacked two weeks ago, the Defence Department categorized any serious cyber attack, as an act of war. Since Google had tracked down the source of the attack to a certain province in China, it was all too clear that the Pentagon was not beating about the bush while taking the cyber threat seriously. The gmail attack came hot on the heels of another high-profile attack – Lockheed Martin Corporation, the high-tech defence firm.Having been annoyed by implicit accusation, China hit back at Google by warning that the company would face the music, if it accused the Chinese government of covert involvement.

The disturbing cyber nuisance did not end there. The servers of

Sony

, the entertainment giant, were subjected to two successive hacking within a matter of days. On the first occasion – the more serious one – the accounts of millions of had been hacked into and then details were stolen; the servers of

Nintendo

suffered the same fate. On June 3, the servers of

Codemasters

, the largest UK game publisher, were hacked. The hackers did not spare even the

National Health Service

of the UK; there has been a breach of security in some servers, according to media reports.

The spate of attacks has pushed millions of online users, not necessarily the folks who play games, into a state of perpetual anxiety. Since the hackers have been able to stay a few rungs above the security experts along the learning curve, it’s high time the threat was treated as something against the whole online community, not just selected strata of it.

The companies, which have been affected, are counting the cost in terms of loss of both revenue and reputation. Although, they assure the customers of better security mechanisms in future – and when the horse had left the barn, of course – restoring customer confidence is going to be an uphill struggle for the companies in question.

According to the details that came out so far, the hacking had been performed by duping the customers into web pages which looked identical to what they normally had been familiar with; once signed in, they had been taken for a ride, to say the least.

So, the companies affected implied that the customers should not have done that; well, how do ordinary folks distinguish between a real one and a fake one, when they look almost similar? The explanations have not gone far enough to address the serious side of the issue; all they can say is warning the public to be on their guard at all times – and they already are.

These high profile hackings are not the works of adventurous individuals, carried out in their bedrooms as a way of fighting boredom. Nor are they the works of teenagers, who could spare hours on computers in typing in endless combinations of characters into login names and passwords, in the hope that one of them would make them lucky by pure chance – one day. The nature of sophistication clearly shows the involvement of highly organized individuals – perhaps, with a substantial technical background – who are prepared to break hell lose, if they can get away with it.

The two groups, which are at the forefront of hacking, are Anonymous and LulzSec. The former claims to be a ‘leaderless structure’ while the latter introduces itself as the ‘world’s leaders in high-quality entertainment at your expense.’ Who can disagree with them?

Anonymous has been in the habit of hacking into government websites in order to teach them a ‘lesson’; it was at its peak of activities, known as ‘hacktivity’, when Wikileaks were coming out in dribs and drabs. LulzSec, meanwhile, claims that since fun is restricted to Fridays, they are going to extend it beyond that – and to the weekend. Whether what is fun for LulzSec, is certainly fun for everyone, remains to be seen in the days ahead!

In addition, there are clumsy hackers too. I keep getting an email from one such stupid hacker, who is in the habit of urging me to collect a parcel from a well-known courier service while clicking on a link provided. However, he could not completely conceal the tentacles of idiocy: the ‘To’ field of the email consists of a chain of email addresses, not just mine. So, I decided to keep getting the emails for academic purposes, without diverting them into a spam folder.

If a user can be duped by such an email, then of course, big companies cannot be blamed for mistakes of that kind. In short, users have to be a bit responsible too while login into similar-looking web sites and opening unsolicited emails.

As the menace of hacking reached fever pitch, some countries in South East Asia have started cracking down on potential hackers – finally. The arrests have been made in Malaysia, Indonesia and Taiwan. However, this is just the tip of the colossal iceberg.

The geography of the places where hackers were found, the time taken before the action being carried out and the abundance of other regional criminal activities, do not paint a serene picture for the online community in particular, and the law-abiding global citizens in general.

If the governments in question keep treating the threat as trivial or non-existent, the trend can easily give a cumulative nasty shock for all of us at an unexpected time – something from which we may not recover without paying a heavy collective price.

via The Alarming Growth of Global Cyber Menace – Hacking | Asian Tribune.

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit
05/30/11

Lockheed Martin hacked, cyber crime steps up to major leagues – International Business Times

 

Lockheed Martin just recently admitted that it was hacked on May 21, 2011.  It managed to stop the “tenacious” attack before any critical data was stolen.

Back in October 2008, Lockheed Martin launched its cyber-defense operations.  It bragged that it wanted a piece of the red-hot cyber security industry.

 

Warfare

It’s shocking, therefore, that hackers are now bold enough to target a company that specializes in defending against them.

The cyber security industry is worth $40 billion in 2010, according to Federated Networks, a player in that industry. After several incidents in the last two years, however, it’ll probably get even bigger.

In late 2009, Google and other high profile tech companies like Adobe Systems were hacked fromChina.  The purpose of the attack was reportedly to steal intellectual information and access certain Gmail accounts.

In late 2010, a loose-organized internet vigilante group called Anonymous organized an attack on Visa and MasterCard for their anti-Wikileaks stance.  The attacks brought down the two companies’ websites.

In April 2011, Sony‘s PlayStation Network was hacked, forced to shut down for weeks, and user credit card numbers were likely stolen.  Sony was hacked by either internet vigilantes affiliated with Anonymous or thieves looking to steal credit card numbers.

These instances of hacking teach us two things: hacking can do serious damage to society and it’s surprisingly easy to perpetrate.

Hacking Google, for example, means gaining access to the most private information of individuals.  Hacking tech companies in general means gaining key intellectual information, which is their lifeblood.

Hacking defense contractors like Lockheed Martin is a matter of national military security.

The hacking of MasterCard and Visa demonstrates the utter unpreparedness of major corporations.  It shows that a group of rule-breaking enthusiasts can trump Fortune 500 companies.  In the physical/real world, something like that would be unimaginable.

Corporations, governments, universities, and consumers in general aren’t prepared for cyber attacks.

Many experts had predicted the rising importance of cyber security ever since it became clear that cyberspace would be an integral part of modern society.

Hackers, however, haven’t really done too much damage until the last two years because criminals and other rule-breakers (e.g. unscrupulous government agencies) didn’t seriously incorporate cyber attacks into their repertoire.

Now, they have and are finally giving hacking the organizational backing it needs to do some serious damage.  In other words, hacking has changed from being a crime perpetrated by loose-organized operators for petty gains to an operation backed by major crime syndicates and other powerful organizations for more nefarious and impactful purposes.

Society at large, therefore, needs to beef up its cyber security.  It needs to resemble the robustness of security in the physical world.

The US, for example, has a network of police force at every single municipality and state to deal with local criminal threats.  On the national level, it has the FBI and a standing army.

As cyber crimes have moved to the major leagues, cyber security needs to do the same.

 

Lockheed Martin hacked, cyber crime steps up to major leagues – International Business Times.

Share on TwitterShare on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit