Genre: Forum

Posted by timothy on Saturday June 25 2011, @07:01PM from the oh-they-all-say-that dept. MaxBooger writes "LulzSec, the notorious hacker group that's been on a rampage, just announced that it's disbanding . This follows 50 days' chaos during which time it took down several websites (including CIA.gov at one point), exposed passwords, exposed documents of the Arizona penal system, and at one point threatened to hit Too Big To Fail banks. Obviously, it's possible that the group will not abide by its promise to quit. Nobody knows." The point is clearly that no system connected to the internet is secure, and that it can be cracked given enough skills. So the best protection against a very competent attack is to avoid angering people. And even if you don't you shall design your systems with a multi-layered approach in mind to avoid massive breaches. Don't allow the presentation layer direct access to the database with sensitive information. Don't use the same authorization database for the web UI for administrative tasks. And if you run an application server (like tomcat) - run it under a security manager/policy that limits access to other services in case someone is able to install something malicious in the application server. You can apply a security policy to Tomcat, and that will at least slow down an attacker considerably since the attacker then needs to gain knowledge of the system. And if you add tripwires in the system that can block attackers automatically if tripped then you make things even harder. Three to five tries and the IP address is shut off for an hour. The point is clearly that no system connected to the internet is secure, and that it can be cracked given enough skills. That would have been the point if there was any evidence that they had used particularly sophisticated attacks. The actual point seems to be that quite a few systems are secured in a fairly amateurish way and still subject to SQL injection, for example. Their point was never that 'nothing is secure'. They used simple well known attacks and a lot of humor. I see their points as: 1) Validate user input. 2) Don't reuse passwords. 3) The first two rules apply to everyone including government contractors. 4) If we can get your details so can, and so have, other groups. 5) So called whitehats are corrupt by nature. 6) It's still possible to be anonymous on the internet if you know what you are doing. 7) Cloudflare works well. 8) We are laughing at you. 9) j3st3r ( or however you spell it ) is a script kiddie who writes very bad PHP. 10) Send us some cash via bitcoin. 11) PROFIT! No, not the point at all. LulzSec is (was?) a vigilante group fighting organizations they perceive as evil. What they did to Sony was exactly the same thing Sony did to me, and Sony did it with no repercussions at all. The banks have been stealing from all of us for decades, and the government rewarded them with bailouts for it. I'm not sure I agree with the Arizona breaches, but most of what they did were good things. The second is worse. And someone who kills my family in front of me and then burns me alive is worse than that. Your point? I thought my point was obvious. Lulzsec have drawn attention to security issues that can be easily fixed. This might just encourage people with these kinds of security issues to fix them before the really bad guys turn up. Granted that may not have been their intention, we will never be sure. As much as I'm for protests and such, these kids were just out to cause harm because they could. They need to get a legitimate cause, and stop pissing on ( innocent ) people randomly, or be gone. They give the rest of us a bad name. Aside from doxing Arizona law enforcement, what harm did they really cause? They've really just managed to point out a lot of trivial security flaws... I suppose one could argue that they cost Sony billions of dollars, but fighting Sony was a legitimate cause... Are you seeing what the are releasing? I am currently dowloading hte battlefield heroes userdata to see if I am on it. I have to take time out of my life to do shit like this cos they released user data. If they had just withheld the usernames and passwords and threatned the source with releasing them if they didnt up their security I would have been much much happier... and supportive. I am currently dowloading hte battlefield heroes userdata to see if I am on it. I have to take time out of my life to do shit like this cos they released user data. If they had just withheld the usernames and passwords and threatned the source with releasing them if they didnt up their security I would have been much much happier... and supportive. Well if you're smart you use unique passwords for your online services, so log in and change your password. Give Visa/Mastercard/Amex or whomever a quick call, tell them what happened. Problem solved. Imagine for a second hackers more malicious than the LulzBoat stole your data (especially financial data), they probably wouldn't publicly post it, they'd sell it, or use it in other ways that are far more aggravating than spending five minutes changing a password, and/or a telephone call to your credit car They need to get a legitimate cause, and stop pissing on ( innocent ) people randomly, or be gone. I fail to see how anything they did could be justified even if it was for a 'legitimate' cause. Taking away others' ability to participate in the community [network] is universally wrong. You lose the moral high ground and then some doing that. Sorry, but I disagree. I think these kids are doing good work that needs doing. Not sure about the Arizona crhacks, but I certainly am for bringing Sony down. What they did to Sony was karma, payback for thousands of us who Sony crhacked with their XCP trojan. I'd like to see them (or somebody) go after the Delaware cell phone telemarketing spammers at 302-394-6964. Those bastards called my cell phone ten times Friday and 12 timed Thursday. It was just an annoyance to me, as I have a flat fee plan, but it un In the US of A where they were born and raised Corporations pleased customers on most of their days Chilling out, maxing, relaxing all cool While employing people fresh out of the school When a couple of hackers, they were up to no good Started making trouble in their neighborhood They got in one little fight and the prez got scared He said "we're going to war, it's not like anyone cared" Who says the Laughing God has anything to do with the writings of a bunch of drugged out desert people? You are exceedingly narrow minded if you think that only "The Bible" is a legitimate religious text and that all religious and philosophical discussion should be viewed in context to it. After all, it is the oldest religious text known to man, you know, aside from the Baghavad Gita, the pyramid texts, and the Enuma Elish. I don't see where you get that I am justifying anything... They claim to be doing thi Well, something tells me this is in response to legal activity. There are surely going to be new laws, probably not ones specifically in response to hacking activity, but others that allow various governments all sorts of access to records to track down hackers. This will cause 'innovation' in the hacking scene, where people adapt to the new laws and develop new technologies that circumvent them and make them more challenging to implement. Hackers are simply going to go further 'underground' and be harder to track. This, in turn, it going to lead to a number of high profile hacks of large services who have not matured in terms of how they secure their services. This will make the news, government officials will make unfortunate comments that draw the attention of various hacker groups, who will lash out through their newly developed anonymity. In turn, this is going to result in new laws... stop me if you heard this before. But someone needs to remind a bunch of people how to do parsers and isolate data types. As regards DDoS, defense is a whole other strategy. Yes, you can recover. Yes, it's ugly for a few minutes. But it's survivable. And remember: most of these attacks got inside, not just hosed their TCP transports. They phished inside, got some dirty laundry, and hung it out to dry. They enjoyed watching orgs get punked. Yes, and you'd be amazed in how many companies amateurs are at the helm of security. Or rather, how little money and how much burden the average C(I)SO gets on his back that he simply cannot run the required security audits. Bluntly speaking, to get security up to par, the average corporation would at least have to double, more likely triple, its security staff. Security is a lip service business. Much like insurance. You do what law dictates, not a penny more is spent on it. If the law doesn't dictate that you have to be secure against SQL injections and DDoS attacks, it's mostly a matter of luck and whether the programmer writing the piece of software does it automatically, which in turn again is unlikely because it certainly is neither part of the testing nor of the final inspection protocol. Even if, there simply is no time for more than a cursory glance, so in effect the burden of blame is shifted on some scapegoat, most likely one of the CSOs underlings. Or, lacking said underlings, the CSO. Simple code reviews can find SQL injections quite easily. Just search for the method names for executing queries then make sure that there are NEVER string concatenations which include user input. It's all really quite simple. Use parameters for every query and you'll never have a problem with SQL injection unless the DB library itself has a hole (much less likely than the possibility that your home grown validation code has a hole in it). Compliance has nothing to do with security. Compliance has something to do with laws. Creating laws take time, creating auditing checkbox-ticker-tests take more time and filling them out takes some more time. We're talking months here. By the time you start ticking off checkboxes (assuming that you were fully compliant from the start, which in my 10+ years now never happened, not a single time) you're already about 8-12 months behind the reason the law was passed for. And a year is a long, long, long time in IT security. You may rest assured that all companies that got sacked were fully compliant with laws and regulations concerning security. Which essentially means jack when it comes to "real" IT security the way the average geek would think of it. Don't mix compliance with security, they're two very different beasts and sadly, the former is more important to the average CEO than the latter. Because there's very specific laws for the former, but usually just very diffuse ones for the latter. Well, something tells me this is in response to legal activity. There are surely going to be new laws, probably not ones specifically in response to hacking activity, but others that allow various governments all sorts of access to records to track down hackers. The idealist in me wants to believe that we could also get more laws passed holding corporations more accountable for lax security. The realist in me realizes that such laws will first of all not be forthcoming, and second of all, even if they were, wouldn't do a thing. Or, worse, hit the wrong ones. Laws "against" corporations are a matter of money. Nothing more, nothing less. If someone goes to jail for it, some scapegoat will. So that certainly never had any impact on corporations. And the money involved is a cost/risk factor. How much to secure against the risk, how much to pay if it happens, how likely is it to happen? I.e. simple r I don't remember them ever saying anything about limiting their hack-spree to 50 days. Sounds like they've pissed enough people off that they're starting to get ID'ed and arrested, and are hoping they can quit before it gets really bad. They're a bunch of weenies all right, but I don't think it's over for them. I for one will be lulzing my ass off when they all get caught and sent to pound-me-in-the-ass prison. do you - downhole - personally feel that sexual abuse in prisons is appropriate ? including all the innocents getting convicted (think movie witch hunt or other similar cases), all the minor convictions (smoked some weed) and so on ? ersonally, i would not have guts to condemn a person who would in the end find the means to kill off those who got them in the prison wrongfully. and i believe we should not make prisons a place to breed people like that. I see that many people here on /. seem very bitter and angry about those kids. First let me tell you that "laughing you ass off when they get raped in prison" only shows that you're a very mean and despicable individual. But apart from that those kind of hackers are really doing people a favor by exposing clearly to the general public how terrible the security of their personal data is. Rest assured that for every bragging Lulzsec there are ten quiet hackers from different governmental and criminal groups, silently collecting your data and placing back doors in your systems, and not saying a word about it. Without public exposure authorities and corporations will naturally do all they can to swipe the problem under the rug. The kind of very visible but mostly harmless actions from the likes of Lulzsec is what's necessary to have them move their ass and finally do something about the security issue. I for one see them more as the vaccine that will eventually help the Internet grow some real security than the hateful vandals that old grumps of your kind want to portray. Yes, I will laugh as they ger raped in prison, because they are criminals. Ok but consider one thing: imagine that your son would do something stupid one day, like selling 1g of hemp to a friend to help him out or crack into a government website for the lulz, and gets caught. He's a criminal now. Will you still be laughing as he gets raped in prison? If you answer "no", then you're definitely a stinking asshole and a filthy motherfucker, because you want harsh penalties for others but will beg for them not applied to you. And if you answer "yes", then you're definitely a stinking My totally random guess here is that they are a group of people who probably knew each other well before creating this group. More than likely they have just stopped calling themselves LulzSec. They're just getting too much scrutiny most likely. I don't think this is the last we hear from them, just they won't be calling themselves LulzSec necessarily... Tyrell: The light that burns twice as bright burns for half as long - and you have burned so very, very brightly, Roy. Look at you: you're the Prodigal Son; you're quite a prize! Batty: I've done... questionable things. Tyrell: Also extraordinary things; revel in your time. Batty: Nothing the God of biomechanics wouldn't let you into heaven for maybe change their strategy and mix things up to evade capture, the world needs benevolent black/grey hat hackers to dig up dirty laundry on the establishment, let the government & police know that if they do wrong that it will be found out and exposed for all the world to see... maybe change their strategy and mix things up to evade capture, the world needs benevolent black/grey hat hackers to dig up dirty laundry on the establishment, let the government & police know that if they do wrong that it will be found out and exposed for all the world to see... I wouldn't go so far as to say "benevolent" but I prefer to live in a world where the watchers are watched and the tyrants are forced to live in fear. The tactics are to look at the wind-speed meter, consider elevation, and then try an angle and velocity that will strike the opponent with your explodo-banana. Refine your velocity and angle per the rules of "playing the odds" guess too much one way, and too little the other, then extrapolate the correct angle and velocity by interpolation. A quick search turns up this website that has a flash implementation of the game [kongregate.com] (covered with a skippable ad) that you may use to refine your "BASIC Gorilla" skills. The tactics are to look at the wind-speed meter, consider elevation, and then try an angle and velocity that will strike the opponent with your explodo-banana. Refine your velocity and angle per the rules of "playing the odds" guess too much one way, and too little the other, then extrapolate the correct angle and velocity by interpolation. A quick search turns up this website that has a flash implementation of the game [kongregate.com] (covered with a skippable ad) that you may use to refine your "BASIC Gorilla" skills. Pathetic really. The only thing different is that these idiots have big mouths. Which, I bet, will be their downfalls. Nothing they did on the hacking side is impressive at all. Competent black-hats know that one of the most dangerous things you can do is public bragging. Having an information-channel back is beyond stupid. Fortunately, law-enforcement has very long memories and a lot of patience. It is just relatively slow. I predict that we will see them all begging for mercy. Might take months or years, but they were far to careless not to get caught. The objective was to draw attention to causes that interested a loose collection of impassioned individuals with a little knowledge, a little access, and an internet connection. What was accomplished was more then many civil disobedience campaigns that last for years can do, and most of the people involved are going to get away with it. The scary part isn't the script kiddies, it's that they got vaguely organized and directed in a way that would be nearly imposable to direct and stop before they hit. If a The problem here is the "little knowledge". That is what will prevent them from getting away. They left so many possible traces, I am convinced, law enforcement is currently just checking whether they have identified everybody and have enough evidence. As these LulzIdiots will not all be able to let go of their newfound "power", more evidence will become available shortly. And, no, they do not even have a snowballs chance in hell. No, law enforcement is demonstrably incompetent in computer crime. Between the turf wars among agencies, the terrible morass of existing law, the foolish concept that they can defeat computer crime by finding "ringleaders". Ringleaders are very transitory, and easily replaced by bored fools with slight technical knowledge who enjoy a challenge.. A few of these fools will have actually learned some tools, and pass them on, and the rest will be ignored as "small fish". You can see examples of this sort of leg Wreak havoc, fail to achieve any of your stated political goals, declare victory, and run away because it's too risky to stay. It's not only crackers who are this wasteful and destructive to innocent people's property: take a look at the mess in Iraq, Afghanistan, Panama, Vietnam and Korea for examples in the last 60 years. On June 21st a suspected member is arrested in the UK, on June 25th they call it quits. The prospect of life in a British arse pounding prison was certainly a factor. The culture of institutionalised rape and its tacit endorsement as part of the punishment (*) is far more closely associated with the American prison system. I'm not saying it doesn't happen here, but it doesn't seem to be a factor to the same extent. (*) Obviously unless you're the prison rapist, in which case it's more "get to pound some kid locked up for marijuana possession in the ass prison", but let's not think about the logic of it too much. Excellent analogy, wrong conclusion. Know your objective, how what you're willing to invest to achieve it, and exit when you've reached your goal or exceeded your costs. LulzSec made some headlines and embarrassed a few major organizations. Going to jail isn't worth a few more headlines. I highly doubt they're quitting. Regardless of whether or not they call themselves Lulzsec, I'm sure they'll continue trying to leak information and hack/deface websites. Breaking up Lulzsec may or may not be just an attempt to throw the Police off whatever trail they might have. Maybe this has to do with the direction of political hacking they started to adopt, I mean, continuing as Lulzsec while trying to release anything halfway serious just screams contradiction. There's plenty of things going on, but Agreed. Right now everyone who is anywhere in security is most likely hyperaware. I know at my company (a large carrier) we've done security audits across the spectrum to ensure customer data was well protected, along with proprietary info. It makes sense if they let the waters die down a bit, and then hit when people are soft and inevitably get lazy again. I can't help but think that this is exactly what I would do if I were a once hacktivist turned undercover government agent trying to further the polictical agenda of censorship. ... What do you want to bet that LulzSec is taken down as soon as the powers that be wish them down, and that no real damage will come of their attacks? What did LulzSec accomplish? They raised the general public's awareness of the dangers of "hackers" . We're getting offtopic here, but Bush wining the second time does NOT Prove that elections are rigged. What it actually caused Bush to get re-elected was a swift-boat campaign http://en.wikipedia.org/wiki/Swiftboatin\\... [wikipedia.org] on John Kerry right before the election. I'm replying not to just be pedantic and correct you, I just want to raise awareness of the power of lying TV advertisements - if you know what swiftboating is, you will have the mental tools to recognise it when it happens and respond accordingly.