Anonymous Against DoJ

Posted on January 17, 2012 by Tyler

Anonymous is back, and this time they have launched a pair of operations. The first is in response to the takedown of the Megaupload.com site by the FBI and other authorities. The second operation is to continue to support the protest for the Stop Online Piracy Act (SOPA). However, their operation is targeting the members of Congress that support it. So far, the sites of the Justice Department, Universal Music Group, and several congressional sites have been affected.

The attacks began as Anonymous’ Sabu called for people to boycott paid media in all forms and to promote torrent and file sharing sites. “This new, massive operation, will target on SOPA/PIPA in a way that the government was not expecting,” he posted on Twitter. “We are going to starve the beast.” In response to the arrest of Megaupload.com’s founders, he said, “This is the governments way of saying: ‘How nice of you to protest SOPA/PIPA. But we still are in control.’ Fuck this.”

The Department of Justice and Universal Music sites were both made unavailable by denial of service attacks. Anonymous’ Barrett Brown told RT.com that “It was in retaliation for Megaupload, as was the concurrent attack on Justice.org.” Both sites remained down for quite some time and attacks were being mounted for a few days. Anonymous members have also targeted the sites of the Motion Picture Association of America and the White House, as well as other government sites.

In a wave of attacks labelled “OpDonkeyPunch” by Barrett Brown, the frequent spokesperson for Anonymous, the group is targeting Democrats in Congress who support SOPA. OpDonkeyPunch is directly targeting those people’s websites. Brown also published the fax machine phone number for Republic Rep. Lamar Smith, sponsor of SOPA.

In an e-mail, Brown stated that the intention of OpDonkeyPunch “is to show Democrats that they can’t just slide through on this and escape notice, that we can do more damage to their fundraising ability than they realize.” The efforts of Anonymous have extended and expanded to Facebook and Twitter accounts of SOPA supporters. However, they are not hacking these accounts, as they don’t want these sites shut down at all. No, Anonymous is spamming messages to the supporters messages, walls, and feeds.

Source: Ars Technica

Reddit Protesting SOPA

Posted on January 11, 2012 by Tyler

reddit going dark for a day to protest SOPA online censorship bill

On January 18th, the online community known as reddit will go offline for 12 hours in opposition of the Stop Online Piracy Act (SOPA) currently being considered in the House and its companion PROTECT IP Act in the Senate. These two bills would give copyright holders power to have websites blocked, to get their advertising cut off, and to shut down their credit card or PayPal payments.

reddit’s community has been organizing all manner of oppositions to the two bills. Their most successful attempt included targeting GoDaddy, who supported the legislation until reddit’s Move Your Domain Day. This time, site admins decided to get involved in order to get the word out to all of reddit’s users.

“Instead of the normal glorious, user-curated chaos of reddit, we will be displaying a simple message about how the PIPA/SOPA legislation would shut down sites like reddit, link to resources to learn more, and suggest ways to take action,” they announced yesterday.

“We’re not taking this action lightly. We wouldn’t do this if we didn’t believe this legislation and the forces behind it were a serious threat to reddit and the Internet as we know it.”

reddit community members have been using /r/sopa to organize, posting custom signs, various pieces of Internet anti-SOPA artwork, such as the image at the top targeting SOPA backer Representative Lamar Smith, and suggestions for making their collective voice be heard around the world. One of the bigger ideas that I’ve seen included trying to convince Google to join the blackout, which more than likely won’t happen, but it sure would be powerful.

Source: Ars Technica

Published Tool for Hacking WiFi Protected Setup

Posted on January 4, 2012 by Tyler

A flaw has been found in WiFi Protected Setup that indicates that most home and small business routers could be giving away free WiFi.

On December 27th, the Department of Homeland Security’s Computer Emergency Readiness Team (what a mouthful, or handful if you’re typing ) issued a warning about a vulnerability. This vulnerability was in wireless routers that use WPS, or WiFi Protected Setup, to allow new devices to be connected to them. Researchers at a Maryland-based computer security firm developed a tool that exploits that vulnerability just a day after the warning was issued, and went so far as to make a version available as open source.

WPS is designed for home and small business users of wireless networking so that they have the ability to easily configure devices without having to enter a long password. Basically, the process of authorization is done automatically as to save time. A lot of times, WPS-capable routers will use a personal identification number, which is printed on the router, to authenticate the device.

However, Stefan Veihbock, a security researcher, found out that the PIN implementation is susceptible to “brute-force” attacks because of the way routers respond to bad requests and the nature of the PIN itself. Saving you the trouble of exactly how it works, an attacker can get a PIN number within 11,000 guesses, and when done with a tool that does this “guessing” process over and over by itself, it becomes maybe an hour’s work. Veihbock demonstrated the vulnerability with a proof-of-concept tool he wrote in Python, available for download from his site.

Why is that bad? Well, if you have a WPS-enabled router, changing the password or service set identifier (SSID) won’t keep these attackers out, since they are already connected and can connect via your PIN, which cannot be changed. Hell, if you’re using multiple SSIDs with different passwords, the PIN can provide access to all of them.

The routers most vulnerable to these attacks—the ones without PIN features that stop the user after a number of bad requests, a.k.a. PIN Lockout features—include products from Cisco’s Linksys division, Belkin, Buffalo, Netgear, TP-Link, ZyXEL, and Technicolor. None of the vendors has issued a statement on the vulnerability, or replied to inquiries from Veihbock.

Source: Ars Technica

Subway’s $3 Million Hack

Posted on December 26, 2011 by Tyler

A band of Romanian hackers have been stealing credit card data from hundreds of small businesses, as well as more than 150 Subway restaurant franchises and at least 50 other small retailers. Using the point-of-sale (POS) systems, these businesses practically left their drawers open, so to speak, letting the hackers ring up over $3 million in fraudulent charges.

How many victims were there? Well, according to the US District Court of New Hampshire on December 8th, these hackers are alleged to have gathered the credit and debit card data from over 80,000 victims. “This is the crime of the future,” said Dave Marcus, director of security research and communications at McAfee Labs. The days of robbing with a gun are slowing, and criminals are resorting to targeting small businesses digitally.

While it may seem like hacking is very complex, the methods used by these hackers were actually unsophisticated. The systems that were attacked were discovered through a targeted port scan of blocks of IP addresses to detect systems with a specific type of remote desktop access software running on them. By doing this, the hackers could figure out which were POS systems, using the software to gain entry. The PCI Security Standards Council, which governs credit card and debit card payment systems security, requires two-factor authentication for remote access to POS systems, which the hacked retailers obviously didn’t have.

“With PCI compliance, those apps shouldn’t be on those systems,” said Konrad Fellmann, audit and compliance manager for SecureState, an IT security firm with a practice in retail security auditing. But small retailers who don’t store credit card data are not required to have the same level of auditing as larger companies, Fellmann said.

Subway is the main store in question, as the rest were primarily small businesses. Requirements were provided to the Subway franchises, but some of them “directly and blatantly disregarded” Subway’s security and POS configuration standards. “It’s not like they had to install something and they didn’t,” Schuman said. “They did it proactively,” he continued, “downloading low-cost remote desktop software from the Internet and refusing to use point-to-point encryption as Subway dictated.”

The Justice Department alleges that these hackers gained access to the remote desktop software by guessing or “cracking” the passwords. Fellmann isn’t surprised based on his previous experience with retailers. Weak passwords, such as “password” or “1234,” are one of the most common things he discovers during POS penetration testing. “Some people, you tell them what’s required, and they’d rather not do it. They had the tools, and could have easily blocked [the attack]. If they were using a validated POS application, the vendor should provide an implementation plan, which would have included making sure you have a firewall in place.” But, he said, “these people weren’t thinking about point of sale security – they were just thinking about making a sandwich.”

Source: Ars Technica

Pakistan Bans 1,100 “Naughty” Words From Texting

Posted on November 21, 2011 by Tyler

Phrases such as “beat your meat,” “fairy,” and “lovegun” are among the lists of words banned in text messages by the Pakistani Telecommunication Authority. On November 14th, phone companies operating in the Islamic country were handed the list of words with a letter explaining that they have to block those words on their networks within seven days or face legal action. Operators will also have to submit monthly reports on the implementation of the block.

“There are more than 1,600 words in the list including indecent language, expletives, swear words, slang, etc. which have to be filtered. The filtering is not good for the system and may degrade the quality of network services–plus it would be a great inconvenience to our subscribers if their SMS was not delivered due to the wrong choice of words.”

Other highlights from the list, which was issued in English and Urdu and can be seen here, include “roach,” “pocket pool,” “deposit,” “hershey highway,” and “honkers.”

Officials from the Pakistani Telecommunication Authority refuse to comment on the ban, but Twitter has been ablaze with people mocking the move, using #ptabannedlist for a hashtag.

Sports blog Deadspin says the list actually comes from the NFL. It’s unclear if the Pakistanis used the list as a starting point for their English-language censor list, but a Pakistani official did state that the texting blacklist is meant only for “testing.”

Source: Ars Technica

Anonymous Exposes Gmail of Cybercrime Investigator

Posted on November 17, 2011 by Tyler

On Friday, Anonymous’ Operation AntiSec published the private e-mails of a California Department of Justice investigator. The hackers have posted the 38,000 e-mails in a Gmail account that appears to belong to Alfredo “Fred” Baclagan, a California Department of Justice special agent supervisor in charge of computer crime investigations. They published these to a hidden site on Tor, as well as to a torrent listed on The Pirate Bay. They have also included Baclagan’s personal address and phone number.

The effort by Anonymous is part of the attack on law enforcement as part of a response to their activities surrounding the Occupy Wall Street protests. It began as a protest by Anonymous and LulzSec against government monitoring and censorship of the Internet. While LulzSec has went into the dark again, Anonymous has kept going for years.

In a Twitter message, Anonymous said that their attacks on law enforcement also “has to do with FBI’s targeting of anons, re: imprisoned during opPayback and others.” Operation Payback included the DDoS attacks on Visa, Mastercard, and PayPal after they cut off contribution processing to WikiLeaks.

The e-mails posted by Anonymous include archives from the International Association of Computer Investigative Specialists’ private discussions, where they discussed computer forensic methods. There are also the reactions of IACIS members to a post of threads from the list to the Twitter account of Sabu, a well-known Anonymous hacker, and an e-mail from Baclagan’s hacked Google account rickrolling the entire list. The IACIS is down “for maintenance” because of the disclosures.

Anons also claimed to have listened to Baclagan’s personal voicemails and read his SMS logs, as well as his personal Google Voice account. They said they used the Google Voice account to text and call his friends and family.

“We lulzed as we listened to angry voicemails from his estranged wives and ex-girlfriends while also reading his conversations with girls who responded to his ‘man seeking woman’ craigslist ads,” the hackers wrote in their post.

Source: Ars Technica

Romanian Hacker Arrested

Posted on November 14, 2011 by Tyler

A Romanian hacker, aged 26, has now been arrested for hacking computer systems at NASA. This news comes from the release from the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT). Robert Butyka was this Romanian, and he is being charged with breaking into NASA servers starting in December of 2010.

For some reason, Romanians seem to target NASA. I don’t know if they’re looking for something, NASA is easy to hack, or they simply dislike NASA. Whatever the case may be, this is the 3rd time a Romanian has hacked NASA in a few years. There was Butyka,TinKode, Victor Faur. TinKode stole satellite data in May of 2011. Faur hacked NASA and US Navy sites in 2005 and 2006, where he was charged in 2008. Faur avoided going to jail, but ended up paying $238,000 to the United States in damages.

Romania is actually the one pressing charges against Butyka, as there is no extradition treaty between Romania and the United States. However, he did violate Romania’s anti-hacking laws, so that is why they are indeed pressing charges. DIICOT is stating that he has caused over $500,000 in damages to NASA systems through “introduction, modification and damage to computer data, and restricting access to data.”

Source: Ars Technica

Steam Was Hacked: Confirmed by Valve

Posted on November 11, 2011 by Tyler

Valve’s Steam has been hacked, and with it comes the possible compromising of users’ credit card numbers and personal information. The hacks were confirmed by Gabe Newell, head of Valve. These hackers gained access to a database where encrypted information was stored, but Valve isn’t sure if the hackers took the information or if they will even be able to get past the encryption.

Earlier in the week, Steam took down their forums to clean up mass spreading of video game hacks website fknowned. A message noted that the forums were down for maintenance, but Valve has cleared up that they had some unexpected guests to the forums and database.

What was the information that was stored on the hacked database? User names, passwords, game purchases, e-mail addresses, billing addresses and credit card information, according to Newell. He also stated that they do not have evidence that the encrypted credit card numbers or personal information were taken, and the company is undergoing a full investigation. There has been no reports or evidence of credit card misuse, but Steam users are supposed to “watch your credit card activity and statements closely.”

The full text of Newell’s message:

Dear Steam Users and Steam Forum Users,

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

Source: Ars Technica

Hackers Control Prison Cell Doors

Posted on November 7, 2011 by Tyler

There is quite the vulnerability in the computer systems used to control facilities at federal prisons. What seems to be straight from a movie, this exploit could allow an intelligent hacker to remotely take over the prison. The hacker would be able to open and overload cell door mechanisms as well as shut down the internal communications systems. Tiffany Rad, Teague Newman, and John Strauchs presented this exploit on October 26 at the Hacker Halted information security conference in Miami. These three people spent less than $2,500 and had no previous experience in dealing with prison technologies.

The Washington Times reported that the researchers delivered their findings to state and federal prison authorities. The Department of Homeland Security even confirmed their research. “We validated the researchers’ initial assertion… that they could remotely reprogram and manipulate [the ICS software and controllers],” Former National Cybersecurity and Communications Integration Center Director Sean P. McGurk, who left DHS in September, told the Washington Times.

Strauchs was called in by a warden to investigate an incident in which “all the cell doors on one prison’s death row spontaneously opened.” While the computers used to control the doors and systems should not be connected to the Internet, there is an Internet connection that was found associated with every prison system the researchers looked at. Sometimes, they were used to surf the Internet by staff. Other times, companies had installed the software to do remote maintenance on the systems. A flash drive attack could be used for those with no prison Internet connection.

“You could open every cell door, and the system would be telling the control room they are all closed,” Strauchs, a former CIA operations officer, told the Times. He said that he thought the greatest threat was that the system would “be used to create the conditions needed for the assassination of a target prisoner.”

Source: Ars Technica

Anonymous Publishes IP Addresses of Pedophiles

Posted on November 4, 2011 by Tyler

Anon holding up a "Pedobear"

While we knew that Anonymous took down a Tor-based child pornography host and many had mixed feelings on whether it was right or wrong, Anonymous has once again thrived to be “successful.” Police and FBI officials were degrading the actions of Anonymous because it “interfered with possible ongoing investigations.” Well, the Anon “hacktivist” group has published the IP addresses of 190 alleged pedophiles that they found on their own. They teamed up with members of the Mozilla (Firefox) Foundation to create a Tor browser plugin which collected “forensic data about the users.” Members of the “hacktivist” group are also finding out that a member of Tor’s developer team is the operator of the hosting service that serves up “several child pornography sites.”

How does this Tor network work? It’s all about privacy. It allows users to be anonymous while browsing the Internet and have the ability to access hidden “.onion” sites, sites hidden from the wider Internet. These Tor networks can be used for many different things, so they are not bad things, but can be used for such. Attacks can, however, still get through these privacy networks and can “fingerprint” them to gain information about them.

Why couldn’t the law enforcement agencies or even the FBI get this information? Well, Tor recently had a security update that blocked a lot of vulnerabilities. These agencies cannot just get this information without probable cause and all that other legal nonsense. Well, there’s no legal realm surrounding Anonymous. Anonymous used the update, which made it possible for them to identify users by the security certificate they used, to find locations. They used social engineering on pedophiles that it used to install an altered version of the original Tor software so that they could collect “forensic” information. The OpDarkNet team of Anonymous has been conducting DDoS (distributed denial of service) attacks on child pornography sites for over a month.

“One week prior to October 27th, 2011,” the OpDarkNet wrote in a statement, “We […] performed ‘Operations Security’ against the developers of Tor. We quietly listened on irc.oftc.net channels #tor and #tor-dev to find when the next major release of Tor would be.”

After Anonymous learned the date of the scheduled security update, October 27th, they “secretly contacted our friends at The Mozilla Foundation, Developers of Firefox, for them to authorize a developer signer certificate for ‘The Honey Pawt’, a TorButton that we Anon created to funnel all originating traffic to our forensic logger.” Mozilla approved the Firefox plugin on October 26th. “Our TorButton aka “The Honey Pawt” did not contain any malware or virus. It was developed according to the Firefox/Mozilla Foundation guidelines,” the group claimed.

Mozilla denied that very same thing. Mozilla’s Justin Scott said, “I’ve checked in with the add-ons team over here and no one at Mozilla was contacted by Anonymous in an official capacity. We also do not issue certificates for add-ons.” The “Honey Pawt” add-on isn’t in the Mozilla add-ons marketplace, he added, and “all add-ons available in the marketplace have been reviewed by a member of the add-ons team per the review process.”

Either way, the add-on was made available, perhaps via the power of Anonymous. On October 27th, they stopped their DDoS attacks on the two main sites and posted a message on the “Hard Candy” child-porn directory about the Tor security update, linking to their plugin download. After this plugin was downloaded, the hackers collected data for 24 hours. After that time was up, they resumed their DDoS attacks.

The IP addresses that they collected come from all around the world. ISPs include NTT, Sprint, British Telecom, and many others. Really, they help more than people are letting on. Basically, no charges can be pressed, as there is no way to take the word of the biggest hacking group in the world, whether they claim to be good or bad (though I believe them to be good in nature). However, this will give law enforcement agencies, the FBI, and even the CIA a place to look and people to target as they look. Anonymous claims to have 1,500 IP addresses.

Anonymous also claims to have discovered the identity of the operator of Freedom Hosting. The hackers have accused privacy advocate Mike Perry—developer of the TorFlow network monitoring tool and the Torbutton Firefox plugin—of operating the host through a “shell company” called Formless Networking LLC. Perry has denied the claims at length in his blog. “I seem to be the target of a vigilante lynch mob (or a subset of one),” he wrote, “who will not dispose themselves of the notion that I run a service called Freedom Hosting (despite having evidence in their possession to the contrary). I am not sure exactly why they are targeting me, but I strongly suspect it is meant as a distraction campaign at a key time in Tor’s funding and development cycle.”

As I stated before, this cannot be proven or disproven at this time based solely on the word of the biggest hacking group in the world. However, it’s a starting point. Will Anonymous be able to team up with the FBI or CIA? Will all of their previous “illegal” actions be looked over for now to help take down child pedophiles, which could reduce kidnappings, child molestation, and child pornography? It is doubtful, but sure is quite the thought.

Source: Ars Technica

IT Geek Blog

A Place for a Rambling Geek to Vent

Category Archives: Security

Anonymous Against DoJ

Reddit Protesting SOPA

Published Tool for Hacking WiFi Protected Setup

Subway’s $3 Million Hack

Pakistan Bans 1,100 “Naughty” Words From Texting

Anonymous Exposes Gmail of Cybercrime Investigator

Romanian Hacker Arrested

Steam Was Hacked: Confirmed by Valve

Hackers Control Prison Cell Doors

Anonymous Publishes IP Addresses of Pedophiles