Monday, February 25, 2013

NBC.com back online after getting hacked

 http://www.digitaljournal.com/img/8/7/3/i/1/0/6/o/Denial-of-service_1.jpg

NBC.com is back online after getting hacked during the week. The hack involved malware that was in the form of a trojan.
In recent weeks many websites have been the target of cyberattacks and now NBC can be added to the list. Earlier this week NBC.com was the latest victim in a cyberattack, along with some of its related websites, such as "Jay Leno's Garage." The website had been taken offline for several hours after getting hacked. The NBC sites were infected with the Citadel Trojan, a form of malware that steals sensitive information. Users that visited the site could have potentially downloaded malware without knowing. Google and Facebook had blocked the link once the malicious attack was detected, CNET reported. "The campaign appears to have been launched by the same gang of cybercriminals that's also been recently involved in impersonating Facebook Inc. and Verizon Wireless, in an attempt to trick their users/customers into clicking on links found in hundreds of thousands of spamvertised emails pretending to come from the companies," security researcher Dancho Danchev wrote in a blog post. Danchev's blog post outlined the NBC exploit in detail. According to media reports, NBC's website is back online after the exploit. The Huffington Post reported an NBC spokeswoman said that it was not certain how long the website had "been potentially spreading malware", but that the site was cleaned by 4 p.m. on Thursday and any site visitors were now "safe". NBC says no user information was compromised in this week's cyber-attack. Traditionally the Citadel Trojan has targeted financial institutions, however, earlier in February several security articles noted that other industries were being targeted with this type of malware as well.

US broadcaster's websites hacked, spread malware

Hackers broke into the websites of US broadcasting network National Broadcasting Company (NBC) but apparently did not mean to just deface their targets.
 
The intruders also injected malware into the sites that effectively made them pass on the malware to site visitors, security vendor Emsisoft said.
 
"The websites of the famous US broadcaster NBC as well as various popular NBC shows like 'Late Night with Jimmy Fallon,' 'Jay Leno’s Garage,' and possibly others have been hacked. Attackers managed to inject malicious iframes both inside the homepages as well as some JavaScript files that point to the RedKit exploit kit," Emsisoft said in a blog post.
 
Emsisoft said malicious iframes were inserted into the main pages and into JavaScript files of the targeted sites.
 
It also noted observed the attackers used several drop sites for their attack.
 
According to Emsisoft, the attack started on the main portal NBC.com and was taken down a few hours later, but subsidiary websites latenightwithjimmyfallon.com and jaylenosgarage.com are still spreading malware.
 
It recommended that people "refrain from visiting NBC.com and subsidiary websites until further notice and to ensure that all programs on their computer are up to date."
 
Exploit kits
 
Visitors to the affected sites will be scanned for "exploitable" versions of browser plugins like Adobe Acrobat or Java.
 
The exploit will then try to install the notorious Citadel or ZeroAccess bot malware on the visitor's PC.
 
Citadel is used mainly for banking fraud, espionage, and as a distribution network for other malware. ZeroAccess is mainly used for click fraud by simulating clicks on advertisements or redirecting search requests. — TJD, GMA News

Rising Computer Hack Attacks Prompt Concern




By
@alyssanewcomb
Follow on Twitter

Feb 20, 2013 3:18pm

A string of hacking attacks at high-profile US companies has security experts and officials worried that the hackers are using information gained to plan even more sophisticated attacks.
Facebook announced it “was targeted in a sophisticated” attack last month, beginning a spate of high-profile hackings.  The Twitter accounts of Burger King and Jeep were taken over by hackers earlier this week, just weeks after the site announced 250,000 user passwords had been compromised in an attack.
And on Tuesday, Apple confirmed the same hackers who went after Facebook had accessed a small number of Apple employees’ Macintosh computers.
The Apple, Facebook and Twitter attacks could be related to an Eastern Europe operation, according to reports from Bloomberg and Reuters.
“That part of the world is without a doubt the most prolific and advanced center for criminal hacking on the planet,” said Robert Siciliano, McAfee online security expert.
The social media hacks are separate from the alleged Chinese cyber espionage attacks detailed in a report released by Mandiant, a Virginia-based cyber security firm.
While there is a lot to sort out, here is what we know:
Apple and Facebook 
No data was stolen in the Apple and Facebook hackings, according to both companies.
Security experts told ABC News that the only information likely compromised was on the personal computers of those employees whose machines were infected.
Both attacks used a vulnerability in Java, the software used to show much of the content on Web browsers. Because of that vulnerability, the Department of Homeland Security released a statement last month urging computer users to disable the software in browsers.
Apple said that its operating systems do not ship with Java installed. If a user installs Java, Apple’s software will automatically disable it if it has been unused for 35 days. Apple will also be releasing a new update that will help against Java threats.
On Tuesday, Apple released an updated Java malware removal tool.
“The more data that these criminal hackers have, the more insight they have to the code of these different tech companies and how they do what they do and who the people on the inside are,” Siciliano said.  ”All this intelligence is everything they need to build better hacking tools.”

 Twitter
Twitter announced on Feb. 1 that 250,000 user passwords had been compromised, and said it had taken swift action, requiring a password reset before any hacked handle can be accessed again.
The breach was reportedly Twitter’s largest data compromise to data, though the number of affected Twitter handles accounted for less than 0.125 percent of the service’s 200 million active tweeters.
In a separate incident, the Burger King Twitter account @BurgerKing was hacked on Monday, with the logo, name and background page changed to McDonald’s.
The hacker posted tweets that Burger King had been sold to McDonald’s and the account had been taken over by McDonald’s employees. “We just got sold to McDonalds! Look for McDonalds in a hood near you @DFNCTSC,” the hacker tweeted at 12:01 p.m. ET. @DFNCTSC is likely an account set up by the hacker. Several of the posts used obscenities or racial epithets.
On Tuesday, Jeep became the second brand name to fall victim to a hacker, with a prankster taking over the account and suggesting the car company had been purchased by Cadillac.
Some unconfirmed reports suggested the Burger King hack had been perpetrated by the hacking group known as Anonymous.
Twitter is reportedly considering two factor authentication in order to help prevent hacks like Burger King and Jeep.
 China 
A report released by Mandiant, a Virginia-based cyber security firm, alleges a specific Chinese military unit is likely behind a cyber attack campaign that has stolen “hundreds of terabytes of data from at least 141 organizations” since 2006, including 115 targets in the U.S.
Mandiant’s report was released a week after President Obama said in his State of the Union address that America must “face the rapidly growing threat from cyber attack.”
“We know hackers steal people’s identities and infiltrate private e-mail. We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy,” he said.
Read More: Report Fingers Chinese Military Unit in US Hack Attacks
Protecting Online Privacy 
President Obama pushed cyber security to the forefront last week, signing an executive order that will allow government agencies to work with private companies to tackle cyber threats.
Industries based in the U.S. will be asked to create voluntary standards for protecting information, while the federal government will commit to sharing cyber threat data with companies.
After the spate of hackings, Siciliano says personal users should be concerned and take precautions.
“When you have criminal hackers going after public-facing, consumer-oriented companies, the end game is to hack the public,” he said.
Read More: 10 Tips to Protect Yourself Online 
ABC News’ Joanna Stern and Lee Ferran contributed to this report.

Microsoft Latest To Suffer Java Hack Attack


Microsoft has admitted it was hit by an attack on a Java flaw which was also used to hit Facebook and Apple, indicating the hack may have been carried out by the same attackers.
“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,” said Matt Thomlinson, general manager of Microsoft’s Trustworthy Computing Security, in a blog post on Friday.

Customer data ‘not affected’

Microsoft said it found a “small number of computers”, including some in its Mac business unit, that were infected by malicious software using techniques similar to those disclosed by Facebook and Apple.
“Consistent with our security response practices, we chose not to make a statement during the initial information gathering process,” Thomlinson wrote. “We have no evidence of customer data being affected and our investigation is ongoing.”
microsoft-logo-NewThe attacks on Facebook and Apple both targeted software developers via a website for iOS development, which was compromised and made to serve a Java exploit. Microsoft’s comments suggest its employees may have been hacked via the same website.

Chinese link?

In reporting its hack Facebook said it had tracked the attackers back to systems in China.
Last week, security company Mandiant released a report suggesting a group associated with, or possibly part of, China’s People’s Liberation Army (PLA) was responsible for hitting a large number of English-speaking businesses, many based in the US. China has denied those claims.
Hacks on various media firms, including the New York Times and the Washington Post, have also been attributed to China, which it has also denied. Earlier this month Twitter said it was hit by an attack similar to those which hit the media outlets, resulting in the theft of about 250,000 user passwords.
Other reports suggested that the recent round of attacks on English-language media companies, which hit more than 40 companies, were carried out by an Eastern European hacker group.
Many of the recent attacks, including those on Apple and Facebook, were carried out via a previously unknown security flaw in Java, according to the companies involved. Facebook said it had notified Oracle of the flaw, which Facebook indicated was patched in a 1 February Java update.

Chinese hackers increasingly professional

(Picture: <a href=\\http://www.shutterstock.com\\>Shutterstock</a>) 


Beijing – Beijing hotly denies accusations of official involvement in massive cyber attacks against foreign targets, insinuating such activity is the work of rogues. But at least one element cited by internet experts points to professional cyber spies: China's hackers take the weekend off.

Accusations of state-sanctioned hacking took centre stage this past week following a detailed report by a US-based internet security firm Mandiant that added to growing suspicions that the Chinese military is not only stealing national defence secrets and harassing dissidents but also pilfering information from foreign companies that could be worth millions or even billions of dollars.

Experts say Chinese hacking attacks are characterised not only by their brazenness, but by their persistence.

"China conducts at least an order of magnitude more than the next country," said Martin Libicki, a specialist on cyber warfare at the Rand Corporation, based in Santa Monica, California.

"The fact that hackers take weekends off suggests they are paid, and that would put paid to the notion that the hackers are private."

Hacking pattern

Libicki and other cyber warfare experts have long noted a Monday-through-Friday pattern in the intensity of attacks believed to come from Chinese sources, though there has been little evidence released publicly directly linking the Chinese military to the attacks.

Mandiant went a step further in its report on Tuesday saying that it had traced hacking activities against 141 foreign entities in the US, Canada, Britain and elsewhere to a group of operators known as the "Comment Crew" or "APT1", for "Advanced Persistent Threat 1", which it traced back to the People's Liberation Army Unit 61398. The unit is headquartered in a nondescript 12-story building inside a military compound in a crowded suburb of China's financial hub of Shanghai.

Attackers stole information about pricing, contract negotiations, manufacturing, product testing and corporate acquisitions, the company said.

Hacker teams regularly began work, for the most part, at 8:00 Beijing time. Usually they continued for a standard work day, but sometimes the hacking persisted until midnight. Occasionally, the attacks stopped for two-week periods, Mandiant said, though the reason was not clear.

China denies any official involvement, calling such accusations "groundless" and insisting that Beijing is itself a major victim of hacking attacks, the largest number of which originates in the US. While not denying hacking attacks originated in China, foreign ministry spokesperson Hong Lei said on Thursday that it was flat out wrong to accuse the Chinese government or military of being behind them.

Mandiant and other experts believe Unit 61398 to be a branch of the PLA General Staff's Third Department responsible for collection and analysis of electronic signals such as e-mails and phone calls. It and the Fourth Department, responsible for electronic warfare, are believed to be the PLA units mainly responsible for infiltrating and manipulating computer networks.

China acknowledges pursuing these strategies as a key to delivering an initial blow to an opponent's communications and other infrastructure during wartime – but the techniques are often the same as those used to steal information for commercial use.

China has consistently denied state-sponsored hacking, but experts say the office hours that the cyberspies keep point to a professional army rather than mere hobbyists or so-called "hacktivists" inspired by patriotic passions.

Mandiant noticed that pattern while monitoring attacks on the New York Times last year blamed on another Chinese hacking group it labeled APT12. Hacker activity began at around 8:00 Beijing time and usually lasted through a standard workday.

The Rand Corporation's Libicki said he wasn't aware of any comprehensive studies, but that in such cases, most activity between malware embedded in a compromised system and the malware's controllers takes place during business hours in Beijing's time zone.

Richard Forno, director of the University of Maryland Baltimore County's graduate cybersecurity program, and David Clemente, a cybersecurity expert with independent analysis center Chatham House in London, said that observation has been widely noted among cybersecurity specialists.

"It would reflect the idea that this is becoming a more routine activity and that they are quite methodical," Clemente said.

The PLA's Third Department is brimming with resources, according to studies commissioned by the US government, with 12 operation bureaus, three research institutes, and an estimated 13 000 linguists, technicians and researchers on staff. It's further reinforced by technical teams from China's seven military regions spread across the country, and by the military's vast academic resources, especially the PLA University of Information Engineering and the Academy of Military Sciences.

Cyber warfare

The PLA is believed to have made cyber warfare a key priority in its war-fighting capabilities more than a decade ago. Among the few public announcements of its development came in a news conference held on 25 May 2011 by defense ministry spokesperson Geng Yansheng, in which he spoke of developing China's "online" army.

"Currently, China's network protection is comparatively weak," Geng told reporters, adding that enhancing information technology and "strengthening network security protection are important components of military training for an army."
Unit 61398 is considered just one of many such units under the Third Department responsible for hacking, according to experts.

Greg Walton, a cyber-security researcher who has tracked Chinese hacking campaigns, said he's observed the "Comment Crew" at work, but cites as equally active another Third Department unit operating out of the southwestern city of Chengdu. It is tasked with stealing secrets from Indian government security agencies and think tanks, together with the India-based Tibetan Government in Exile, Walton said.

Another hacking outfit believed by some to have PLA links, the "Elderwood Group," has targeted defense contractors, human rights groups, non-governmental organisations, and service providers, according to computer security company Symantec.

It's believed to have compromised Amnesty International's Hong Kong website in May 2012, although other attacks have gone after targets as diverse as the Council on Foreign Relations and Capstone Turbine Corporation, which makes gas microturbines for power plants.

Civilian departments believed to be involved in hacking include those under the ministry of public security, which commands the police, and the ministry of state security, one of the leading clandestine intelligence agencies. The MSS is especially suspected in attacks on foreign academics studying Chinese social issues and unrest in the western regions of Tibet and Xinjiang.

Below them on the hacking hierarchy are private actors, including civilian universities and research institutes, state industries in key sectors such as information technology and resources, and college students and other individuals acting alone or in groups, according to analysts, University of Maryland's Forno said.

China's government isn't alone in being accused of cyber espionage, but observers say it has outpaced its rivals in using military assets to steal commercial secrets.

"Stealing secrets is stealing secrets regardless of the medium," Forno said. "The key difference is that you can't easily arrest such electronic thieves since they're most likely not even in the country, which differs from how the game was played during the Cold War."

Sunday, February 24, 2013

U.S. security firm alleges massive Chinese hacking



The building housing “Unit 61398” of the People’s Liberation Army is seen in the outskirts of Shanghai, Tuesday Feb. 19, 2013.


Cyberattacks that stole massive amounts of information from military contractors, energy companies and other key industries in the U.S. and elsewhere have been traced to the doorstep of a Chinese military unit, a U.S. security firm alleged today. China dismissed the report as "groundless."
China has frequently been accused of hacking, but the report by Virginia-based Mandiant Corp. contains some of the most extensive and detailed accusations to date linking its military to a wave of cyberspying against U.S. and other foreign companies and government agencies.
Mandiant said it traced the hacking back to a neighborhood in the outskirts of Shanghai that includes a drab, white 12-story office building run by "Unit 61398" of the People's Liberation Army.
The unit "has systematically stolen hundreds of terabytes of data from at least 141 organizations," Mandiant wrote. By comparison, the U.S. Library of Congress 2006-2010 Twitter archive of about 170 billion tweets totals 133.2 terabytes.
"From our observations, it is one of the most prolific cyberespionage groups in terms of the sheer quantity of information stolen," the company said. It added that the unit has been in operation since at least 2006.
Mandiant said it decided that revealing the results of its investigation was worth the risk of the hackers changing their tactics and becoming even more difficult to trace.
"It is time to acknowledge the threat is originating in China, and we wanted to do our part to arm and prepare security professionals to combat that threat effectively," it said.
Chinese Foreign Ministry spokesman Hong Lei did not directly address the claims, but when questioned on the report Tuesday, he said he doubted the evidence would withstand scrutiny.
"To make groundless accusations based on some rough material is neither responsible nor professional," Hong told reporters at a regularly scheduled news conference.
In a reiteration of China's standard response to such accusations, Hong said China strictly outlaws hacking and said the country itself was a major victim of such crimes, including attacks originating in the United States.
"As of now, the cyberattacks and cybercrimes China has suffered are rising rapidly every year," Hong said.
Mandiant said its findings led it to alter the conclusion of a 2010 report it wrote on Chinese hacking, in which it said it was not possible to determine the extent of government knowledge of such activities.
"The details we have analyzed during hundreds of investigations convince us that the groups conducting these activities are based primarily in China and that the Chinese government is aware of them," the company said in a summary of its latest report.
It said the hacking was traced to the 2nd Bureau of the People's Liberation Army General Staff's 3rd Department, most commonly known as unit 61398, in the Shanghai suburbs.
China's Defense Ministry did not immediately respond to faxed questions about the report, although it has in the past labeled such allegations as groundless and irresponsible, and has demanded that evidence be presented.
News of the report spread Tuesday on the Chinese Internet, with many commentators calling it an excuse for the U.S. to impose greater restrictions to contain China's growing technological prowess.

Cross Site Scripting(XSS) Complete Tutorial for Beginners~ Web Application Vulnerability


 
What is XSS?
Cross Site Scripting also known as XSS , is one of the most common web appliction vulnerability that allows an attacker to run his own client side scripts(especially Javascript) into web pages viewed by other users.

In a typical XSS attack, a hacker inject his malicious javascript code in the legitimate website . When a user visit the specially-crafted link , it will execute the malicious javascript. A successfully exploited XSS vulnerability will allow attackers to do phishing attacks, steal accounts and even worms.

Example :Let us imagine, a hacker has discovered XSS vulnerability in Gmail and inject malicious script. When a user visit the site, it will execute the malicious script. The malicious code can be used to redirect users to fake gmail page or capture cookies. Using this stolen cookies, he can login into your account and change password.
It will be easy to understand XSS , if you have the following prerequisite:
  • Strong Knowledge in HTML,javascript(Reference).
  • Basic Knowledge in HTTP client-Server Architecure(Reference)
  • [optional]Basic Knowledge about server side programming(php,asp,jsp)

XSS Attack:
Step 1: Finding Vulnerable Website
Hackers use google dork for finding the vulnerable sites for instance  "?search=" or ".php?q=" .  1337 target specific sites instead of using google search.  If you are going to test your own site, you have to check every page in your site for the vulnerability.

Step 2: Testing the Vulnerability:
First of all, we have to find a input field so that we can inject our own script, for example: search box, username,password or any other input fields.


Test 1 :
Once we found the input field, let us try to put some string inside the field, for instance let me input "BTS". It will display the  result .

Now right click on the page and select view source.   search for the string "BTS" which we entered in the input field.  Note the location where the input is placed.

Test 2:
Now we are going to check whether the server sanitize our input or not.  In order to do this , let us input the <script> tag inside the input field.
View the source of the page . Find the location where input displayed place in previous test.

Thank god, our code is not being sanitized by the server and the code is just same as what we entered in the field. If the server sanitize our input, the code may look like this &lt;script&gt;. This indicates that the website vulnerable to XSS attack and we can execute our own scripts .

Step 3: Exploiting the vulnerability
Now we know the site is somewhat vulnerable to XSS attack.  But let us make sure whether the site is completely vulnerable to this attack by injecting a full javascript code.  For instance, let us input <script>alert('BTS')</script> .

Now it will display pop-up box with 'BTS' string. Finally, we successfully exploit the XSS .  By extending the code with malicious script, a hacker can do steal cookies or deface the site and more.

Types of XSS Based on persisting capability:
Based one Persistence capability, we can categorize the XSS attack into two types namely Persistent and Non-Persistent.

Persistent XSS:

The Persistent or Stored XSS attack occurs when the malicious code submitted by attacker is saved by the server in the database, and then permanently it will be run in the normal page.

For Example:   
Many websites host a support forum where registered users can ask their doubts by posting message  , which are stored in the database.  Let us imagine , An attacker post a message containing malicious javascript code instead.  If the server fail to sanitize the input provided, it results in execution of injected script.  The code will be executed whenever a user try to read the post. If suppose the injected code is cookie stealing code, then it will steal cookie of users who read the post. Using the cookie, attacker can take control of your account.


Non-Persistent XSS:

Non-Persistent XSS, also referred as Reflected XSS , is the most common type of XSS found now a days. In this type of attack, the injected code will be send to the server via HTTPrequest.  The server embedd the input with the html file and return the file(HTTPResponse) to browser.  When the browser executes the HTML file, it also execute the embedded script.  This kind of XSS vulnerability frequently occur in search fields.

Example:
Let us consider a project hosting website.  To find our favorite project, we will just input the related-word in the search box .  When searching is finished, it will display a message like this "search results for yourword " .  If the server fail to sanitize the input properly, it will results in execution of injected script.

In case of reflected XSS attacks, attacker will send the specially-crafted link to victims and trick them into click the link. When user click the link, the browser will send the injected code to server, the server reflects the attack back to the users' browser.  The browser then executes the code .

In addition to these types, there is also third  type of attack called DOM Based XSS attack, i will explain about this attack in later posts.

What can an attacker do with this Vulnerability?
  • Stealing the Identity and Confidential Data(credit card details).
  • Bypassing restriction in websites.
  • Session Hijacking(Stealing session)
  • Malware Attack
  • Website Defacement
  • Denial of Service attacks(Dos)

Anonymous thrown into China-US cyberwar scandal


AFP Photo / Aris Messinis
AFP Photo / Aries Messinis
Members of the Anonymous movement including alleged ringleader-turned-informant Hector “Sabu” Monsegur may have played a crucial role in helping cybersecurity experts narrow in on the Chinese hackers profiled in a highly touted report released this week.
In a report published Tuesday by Northern Virginia information security company Mandiant, an elusive cybersquadron of hackers hired by China’s People’s Liberation Army are linked to compromising as many as 141 companies across 20 major industries in recent years, including a corporation with access to Canada’s oil pipelines and entities of the United States government.
At around 70 pages, the report offers an introduction into the group, Unit 61398, and explains how computer experts at Mandiant were about to come close to pin-pointing three agents within the “Advanced Persistent Threat” group, or ATP1, that they believe have participated in a covert cyberwar against the US on behalf of the Chinese military.
Buried deep in the report, however, is evidence that Mandiant didn’t do all the work alone: the authors of “Exposing One of China’s Cyber Espionage Units” say that a 2011 hack perpetrated by the loose-knit Anonymous collective has been instrumental in making ground regarding the identity of the Far East hackers.
In the report, Mandiant offers a brief profile of three hackers believed to be involved with ATP1: “uglygorilla,” “DOTA” and “SuperHard.” But while the company admits that their investigation into the unit has been underway for several years already, Mandiant says information released by Anonymous in 2011 has only helped them come closer to catching accused cybercriminals.
In 2011, Anonymous retaliated against so-called security firm HBGary after hacktivists became aware that the company’s CEO, Aaron Barr, had infiltrated the movement and planned to rat out the identities of Anons to federal investigators. In response, Anonymous waged an all-out war on HBGary and its associates, hacking the company’s websites, stealing tens of thousands of emails and compromising the online accounts registered to most of the group’s staff. Among the sites targeted was rootkit.com, a coding website founded by HBGary associate Greg Hoglund. After Anons compromised accounts belonging to Barr, they used new-fangled access to get into Hoglund’s corporate email and from there they socially engineered a colleague of his in order to obtain access to rootkit.com
In her 2012 book We Are Anonymous, author Parmy Olson says Anon hackers “had complete control of rootkit.com” and quickly attempted to ravage the site in conjunction with other attacks waged at HBGary and Mr. Barr.
“First they took the usernames and passwords of anyone who had ever registered on the site, then deleted its entire contents. Now it was just a blank page reading ‘Greg Hoglund = Owned,’” Olsen writes.
Next, Anonymous publically released a file that contained the usernames, passwords and other log-in credentials for every registered account on rootkit.com. Among those, says Mandiant, were log-ins for both “uglygorilla” and “SuperHard,” two identities security experts believe to be registered to Chinese hackers working in Unit 61398.
“[T]he disclosure of all registered ‘rootkit.com’ accounts published by Anonymous included the user “uglygorilla” with the registered email address uglygorilla@163.com. This is the same email used to register for the 2004 PLA forum and the zone hugesoft.org,” claims Mandiant, referring to the Chinese military branch and another hacker-friendly website believed to be founded by the person using the “uglygorilla” name, respectively.
Mandiant says the trove of information didn’t run dry with just that one link, though. Also included in the rootkit.com leaked account information was the IP address uglygorilla used to sign up for the website, which matched a Shanghai-area address all but certainly tied to Unit 61398, as well as information about another alleged Chinese hacker.
“Once again, in tracking [SuperHard] we are fortunate to have access to the accounts disclosed from rootkit.com. The rootkit.com account ‘SuperHard_M’ was originally registered from the IP address 58.247.237.4, within one of the known APT1 egress ranges,” Mandiant reports.
Olson says the hack against HBGary was spearheaded by Hector Xavier Monsegur, or “Sabu,” the alleged ring-leader of the Anon sect LulzSec who was arrested by the FBI several months later and has since become a federal informant for the agency. Monsegur is expected to be sentenced in a New York City courtroom on Friday for a laundry list of criminal activity linked to Anonymous, including hacking HBGary and gaining unauthorized access to Hoglund’s site. Meanwhile, Mandiant says that the infamous hugesoft.org zone website registered to uglygorilla has remained continuously active, at least up until the release of their report this week.
After his 2011 arrest, Monsegur allegedly aided authorities in swooping up other hackers internationally. He is believed to have been provided with a server by the FBI that was allegedly used by activist Jeremy Hammond to upload files confiscated in late 2011 from private intelligence firm Stratfor. Hammond himself will be in court this week for a hearing regarding that case.

White House petition to legalize mobile unlocking reaches 100K goal. Anonymous, EFF and Congressmen have expressed support.

Mobile lock
I almost thought we’d never make it. After almost 30 days, the White House petition to lift the ban on mobile unlocking has reached — and surpassed — its 100,000 signature goal. This means government will be compelled to at least make an official response to consumers’ requests to make mobile unlocking legal. Now whether the White House does agree with us, we would have to wait. But at least we have made our voices heard through this “We the People” initiative.
In fact the petition is now at 101,106 and the number of signatures seems to be growing at a faster rate now that it has breached the minimum.
As a brief backgrounder, recall that mobile phone unlocking has been rendered illegal by the Librarian of Congress as a violation agains the Digital Millenium Copyright Act. This particular issue is set for review once every three years, and until January 2013, unlocking your phone’s network-lock was actually allowed by law. But after January 26th, unlocking is already a violation of the DMCA. While I have argued before that networks are not likely to prosecute everyone who unlocks their phone, this might make software unlocking tools a bit more difficult to access given that they are now illegal.




Sina Khanifar, who initiated the petition last January, got in touch with us earlier today to share that a few big names (and no-names) have signified their support for the petition. These include hacking collective Anonymous, the Electronic Frontier Foundation and a few members of the U.S. House of Representatives, among others.

As to Sina’s motivation behind this petition, we earlier shared that he had once been laid a lawsuit for developing unlocking tools, but he still feels that consumers should have the right to switch networks. He stresses how the principles of unlocking are aligned with the open nature of Android.
As a tinkerer myself, I think its pretty unreasonable that the legality of unlocking, rooting, or jailbreaking your phone gets decided every three years by the Librarian of Congress. I think the fair use doctrine should apply — once you’ve bought something, you should be free to do as you want with it. To fix that, the DMCA’s anti-circumvention provisions need to be fixed, but the film and music industries will likely lobby heavily against any changes. Thats why I started the petition: to show the White House and politicians that people really do care about this kind of thing.
What’s next? The White House will now have to make an official response to the matter. Now we’re hoping it’s positive, and not a boilerplate “no” answer, since this is a consumer-rights related matter after all, and not an expensive $852 quadrillion Death Star project that could easily be shot down by a one-man starship.

Anonymous Hacked By Bizarre Trolling Collective Rustle League

A Twitter account belonging to the anarchic hacktivist collective Anonymous appears to have been hacked by a little-known rival group known as the Rustle League. The account @Anon_Central, which normally posts news related to Anonymous’ pet causes, was vandalized in an effort to “troll” the group.

Join NASA for Google Plus hangout from International Space Station

NASA will host the agency's first Google Plus hangout live from the International Space Station for an hour starting at 10:30 a.m. EST.


"This unique opportunity will connect you, our fans, with astronauts living and working on the orbiting laboratory 240 miles above the Earth," reads a post by NASA about the event. 

Several video questions will be selected and answered by astronauts both in space and on the ground, NASA reports. 

"Additionally, NASA will ask real-time questions submitted by our followers on Google Plus, Twitter, and Facebook," reads the post. 

I Can Haz Internet Freedom?










 


Anonymous supporters wearing Guy Fawkes masks hold a banner as they take part in a protest outside Britain's Houses of Parliament in London, Monday, November 5, 2012. The protest was held on November 5 to coincide with the failed 1605 gunpowder plot to blow up the House of Lords. 
Two weeks ago today, a line was crossed. Two weeks ago today, Aaron Swartz was killed. Killed because he faced an impossible choice. Killed because he was forced into playing a game he could not win—a twisted and distorted perversion of justice—a game where the only winning move was not to play.
That message greeted visitors to the United States Sentencing Commission website the evening of January 25. The words were part of a ten-minute video manifesto embedded on the homepage of the commission, responsible for writing the sentencing policies and guidelines for federal courts. The death of the Internet savant and information activist Aaron Swartz, who took his own life due at least in part to the outsize charges he was facing at the hands of the U.S. justice system, was still an open wound for most tech-literate net dwellers. No group took the news of Swartz’s passing more personally than Anonymous. The hactivist collective swore vengeance, citing the "highly disproportionate sentencing" of Swartz and others like him, and commenced the darkly named Operation Last Resort, hijacking numerous Department of Justice websites and sending “nuclear warheads” packed with stolen DOJ records hurtling across the Internet.
By Saturday night, the government reclaimed the USSC.gov domain, only to have another website come under siege hours later. This time, it was the U.S. Probation Office for the State of Michigan, and if you tapped out a certain combination on your keyboard, you got the vintage arcade game Asteroids, ready to play. Twice in one day, Anonymous had hacked government websites of the most technologically sophisticated nation on earth. Its first strike was a passionate, political call to arms—its second, shenanigans. This seeming contradiction, between crusading morality and adolescent hijinks, is at the heart of Anonymous. 
What exactly is Anonymous?
The group’s name can be traced back to a website, 4chan. If you’re not familiar, 4chan was and is the Mos Eisley of the Internet, a lawless message board operating on the fringes of Internet society with a dedicated and passionate following. Officially billed as an “image-based bulletin board where anyone can post comments and share images,” nearly every enduring meme of the post-millennial web found its roots in 4chan, from LOLCats to RickRolling. Anonymous emerged from deep within the site, inside a particular subheading known as “/b/.”
Notorious even among 4chan’s milieu, /b/ truly is the id of the Internet, a wild west of pornography, cat pictures, and staggering amounts of scatological humor. There, like all 4chan message boards, posting without an identity gets you labeled “Anonymous.” Those early nameless users were the primordial ooze the movement crawled out of, anonymity serving to embolden and unite. During this formative period, the citizens of /b/ set about to collectively prank the Internet. Their capers, from organizing online flash mobs, to persecuting bullies, to being bullies themselves, broke ground for the sort of hive-mind hyper-democracy that followed.
It went like this: A user would suggest a worthy or amusing target on the message board, and it would either be echoed by the ever-growing voices of the site’s chorus, like a game of cyber-telephone, or otherwise ignored into irrelevance. Early members picked their targets purely for “the lulz”—something like “laughs,” but closer to schadenfreude. Calling Anonymous a group was to miss the point; it was defined by its participation at any given moment, and like any crowd, the range of interests varied wildly. An early refrain from those days was “none of us are as cruel as all of us,” and one member likened the whole enterprise to being part of an epic inside joke. They hijacked the forum of the Epilepsy Foundation and replaced its content with brightly flashing gifs. All for the lulz.
All that DoJ stuff doesn’t sound very funny. Are you sure we’re talking about the same Anonymous?
In 2008, something changed. An unauthorized “orientation” video for the Church of Scientology featuring Tom Cruise was publicly leaked to Youtube. The video was bizarre enough to be Kubrickian parody—with the theme to Mission: Impossible looping endlessly in the background, Cruise, fresh from jumping on Oprah’s couch, made his case: “Being a Scientologist, you look at someone and you know absolutely that you can help them.” The video was first met with disbelief, then bemusement, then derision. Scientology was accused of brainwashing its followers, and millions of views later, the Church’s army of litigants marched off to harass and pressure websites into removing the content—an effort that was largely successful. Gawker became embroiled in a public struggle to keep the video alive, and amidst the chaos, Anonymous struck.
The campaign kicked off with a threatening video titled “Message to Scientology,” and quickly escalated to prank phone calls, faxing black pages to Scientology offices en masse, and the infamous Distributed Denial of Service attack (DDoS). DDoS harnesses the might of thousands of would-be activists by pointing them all at a website at the exact same moment, overloading servers and rendering the site temporarily inoperable. Because DDoS attacks can be carried out by anyone—all that’s required is a click of the mouse—and because the flood of users creates its own anonymity, the method has become an Anonymous calling card. The fight eventually jumped offline, with thousands picketing Scientology centers in Guy Fawkes masks, keeping their anonymity intact à la V for Vendetta. “For the good of your followers, for the good of mankind—and for our own enjoyment,” droned the computerized voice from the Anonymous video, “we shall proceed to expel you from the Internet and systematically dismantle the Church of Scientology in its present form.”
It’s impossible to say for certain why Anonymous crossed the threshold from merry pranksters to activists, but the movement could not have found a better target for its first political lambasting than Scientology. The organization’s zealous litigating had made critical investigation difficult for a news media uneager to risk a court battle with the church’s stacked coffers. Scientology represented what Anonymous despised: a group hiding behind the First Amendment to protect its questionable religious status, simultaneously trampling it to protect its reputation. The hypocrisy was too ripe—the lulz too great—to ignore.
So how do these crazy operations get planned? Sounds hard.
Advertisement
4chan will always play host to some part of Anonymous, but the gathering has long-since left its humble first home, and now operates across various websites and services. The meat of Anonymous activity—targeting and planning—happens over Internet Relay Chat. The details of IRC aren’t important except that it’s simple, lacks unique names, and allows for huge numbers of simultaneous users in the same conversation. While it’s opaque to the majority of the Internet public, it provides a relatively open platform for discussion.
Anonymous is collaborative, with dozens or even hundreds or thousands of users on IRC, and while individual ‘ops’ might have prominent organizers, the gathering itself is leaderless. Issues are proposed, voted on, and developed into targets by the crowd. Those who seek a leadership mantle are quickly shamed, banned from IRC, and called things we wouldn’t print. Users drop in and out, spectating, debating, organizing, and volunteering, from penning PR stunts to hacking the most secure servers of the U.S. government.
Hold up. There are thousand and thousands of people who know how to hack super-secure websites? Wait just a sec while I go cancel all my credit cards…
Not all ‘anons’ are capable of that sort of operation—only a handful of élites can muster the serious hacking, which brings us to the difference between the hackers and the geeks. Hackers are the heavy-lifters, the big guns, The Girl(s) with the Dragon Tattoo. Geeks are the rank-and-file—savvy, but far from experts. When the hackers write a tool to DDoS or deface a website, the geeks are the ones who put it to use.
So … what are they? Hackers? Criminals? Activists? Terrorists?
The U.S. government and the government of the U.K., along with almost every corporation and governing body ever targeted by Anonymous, have unsurprisingly treated the banner and its users as a criminal, terrorist group. Our government, as well as law enforcement across the pond, has charged dozens of anons, threatening decade-long prison terms—or worse.
Anonymous is neither a terrorist organization nor a criminal gang. Yes, its users have transgressed the law, but mostly in the interest of a political or cultural message, and rarely for personal gain. If the collective has any overarching goals, they are to safeguard the freedom of information, to bring low the haughty, and to amuse itself.
From Operation Titstorm’s defense of uncensored porn in Australia, to the Hal Turner Raids’ takedown of a proud white nationalist, virtually everything Anonymous has done to date can be traced to those three guiding lights. Anonymous’s support for Wikileaks wasn’t lent for the sheer joy of spreading state secrets—as the authorities have intimated—but in the interest of spreading all information, all the time, and especially when exposing perceived injustice. The gathering’s biggest operations have been in support of the Arab Spring—users were "on the ground" early, getting the word out about Tunisia and arming residents there and in Egypt with the tools to circumvent government restrictions on communication and the Internet. Anonymous helped ferry stories and videos out of the region, and even mass-faxed relevant Wikileaks documents to machines all over Egypt, all the while hacking, defacing, and disabling government websites. And of course there is the movement’s enduring role in the Occupy protests—Anonymous has been pivotal less in organizing than in getting the word out to its sympathetic and technologically savvy participants.
Anonymous tactics like DDoS have been met with harsh responses and harsher prison sentences by those governments tasked with policing our cyber frontiers, but anons—and an ever-increasing proportion of Internet users—see these acts more as 21st century sit-ins. Anonymous may shut down a business with a mass influx of "customers," but without any permanent damage done, how is that any different from the Greensboro lunch counter?
Where are they going with this? Is it still just for the lulz?
There will always be potential for opportunists to co-opt and exploit an amorphous idea. All that’s required is someone to fly the flag, as was the case in the recent proclamation of war against Facebook, which was quickly disavowed by “official” Anonymous channels, if that makes any sense. Last year, when it was discovered that a former high-ranking member had turned FBI-informant, fingering many other top hackers, it was generally assumed the operation had been gutted, the party over. Then came the recent hacking of the DOJ, and it’s clear that Anonymous is still alive and well.
The reality is that we live in a world of ever-increasing cyber threats. Stuxnet and Flame, the astonishingly complex computer viruses that wreaked havoc on Iranian nuclear centrifuges, were the work of U.S. and Israeli intelligence agencies. It is estimated that China’s industrial espionage costs U.S. businesses a trillion dollars a year, and it doesn’t stop there: The New York Times reported that over a four-month period, its newsroom computers were infiltrated dozens of times by hackers, while reporters worked on an investigation into the business dealings of China’s prime minister. Russian mobs steal thousands of credit card numbers a day. Anonymous supported Wikileaks, which may have put U.S. agents and service members at risk, but in doing so it exposed the injustices of wars that the mainstream media was remiss in covering, and arguably had a hand in bringing those wars to an end.
Anonymous’ threat to detonate the “nuclear warheads” stolen from DOJ servers is a serious one, both for the government and for its own future legitimacy. The warheads would purportedly expose sensitive information about those unconnected with the prosecution of Aaron Swartz. As Anonymous stated on the DOJ’s hacked website, “We have not taken this action lightly, nor without consideration of the possible consequences. Should we be forced to reveal the trigger-key to this warhead, we understand that there will be collateral damage. We appreciate that many who work within the justice system believe in those principles that it has lost, corrupted, or abandoned, that they do not bear the full responsibility for the damages caused by their occupation. It is our hope that this warhead need never be detonated.”
Such an extreme act risks alienating those sympathetic to the cause, never mind the guarantee of government retaliation. But our legal system is broken when it comes to cases like Swartz’s, and action must be taken to distinguish—both morally and legally—the types of cybercrime that are only bound to increase as we become ever more dependent on an economy of information. The morality of Anonymous may be ambiguous, its structure may lend itself to manipulation and abuse, and its members may not always agree to do the right thing, but hacktivism has been an effective tool in battling the Internet’s injustices. Anonymous represents the future of activism—online and off.

Friday, February 22, 2013

Ditch Your Desktop! Turn Your Smartphone Into A Desktop Replacement


smartphone as desktop replacementIf Christian’s tablet experiment piqued your interest in ditching your PC, then you should know that a smartphone will perform the same function. You only need a handful of additional software and accessories.

This article gives a run-down of the hardware, accessories, and software that users can use to replace their desktop with a smartphone. Not all the parts and software in this list are required. You can get away with just one or two of them. It also includes some information on hardware compatibility. Most, but not all phones can replace your desktop.
smartphone as desktop replacement

The Hardware

Without the following hardware, it may be difficult using your smartphone as a desktop:
  • A smartphone with Android, or iOS, preferably capable of outputting video. Most modern Samsung phones, the Nexus 4 and any phone with a micro-HDMI video output can mirror its video onto an HDMI-capable monitor. Pictured below is a micro-HDMI port.
smartphone as desktop
  • Correct cable for connecting your phone to your monitor. Virtually all of these only work with HDMI. For Samsung that’s an MHL connector, for SlimPort phones, that’s a SlimPort connector. The iPhone requires a proprietary device to work with HDMI. Pictured below is a MHL adapter.
smartphone as desktop
  • For connecting to video, four basic technologies exist: (1) The iPhone 4S uses a proprietary video adapter; (2) The Nexus 4 uses a Slim Port adapter; (3) Many phones have a micro-HDMI; and (4) Samsung phones frequently have MHL connectors.
  • If you have Android 1.5 to 2.3, you may require a special Bluetooth keyboard. The only manufacturer that I’m aware of, currently producing Android keyboards with legacy compatibility, is Freedom Input. iPhones, fortunately, work with pretty much any Bluetooth keyboard around.
smartphone as desktop
  • Bluetooth, for Android devices without USB host mode. The host mode allows your handset to use USB devices. However, it wasn’t implemented until Android 4 and even then, it’s a crapshoot whether or not your phone will have the required drivers.
  • Host mode also requires an On-The-Go cable (OTG). OTG cables sell for cheap at Amazon. If you don’t know what an OTG cable is, let Erez enlighten you.
  • HDMI-equipped monitor.

The Accessories

The most important desktop accessory is the keyboard. In fact, a keyboard singularly distinguishes between the mobile and desktop experience. It also dramatically increases productivity. After all, who in their right mind composes an essay on a smartphone touchscreen?
There exist two kinds of keyboards: Bluetooth and USB. Out of the two, Bluetooth equipped wireless keyboards pair far easier with Android and iOS devices. USB devices couldn’t work on Android until Ice Cream Sandwich (4.0) and, unfortunately, even many ICS phones omitted USB support.
Therefore, if you want a keyboard, check if your ICS phone supports “USB host mode“. If it doesn’t, a Bluetooth keyboard is your best bet. As mentioned above, older implementations of Android should use a Freedom Input keyboard.
smartphone desktop replacement
A phone stand: Phone stands keep your mobile in an upright, readable position. They can be purchased cheaply on Amazon and Ebay. They’re also ridiculously easy to build yourself. Take for example the template phone stand below, via Instructables:
smartphone desktop replacement
Cardboard phone stands possess the advantage of being inexpensive and eco-friendly. They’re also easy to put together. It took me about ten minutes to cut my own from the template above.
smartphone desktop replacement
Problems with multiple USB devices: For those seeking to use a wired keyboard while charging, you might have problems. Using multiple USB devices simultaneously may require USB host mode and a powered USB hub.

The Software

I highly recommend browsing through MakeUseOf’s directory of some of the best software available on Android and iOS.
Word processing: There’s a variety of office productivity apps that can approximate offerings on the desktop. Opinions on which software reigns supreme varies, although I personally recommend King Office for Android, because of its feature set and light system requirements. For those with iPhones, QuickOffice Pro offers one of the best experiences. If you perpetually have online access, you may want to consider Google Drive, which features both an all-in-one cloud backup and office suite.
Music: Spotify is probably the best music player on iOS, although opinions vary. For Android, I suggest Pandora or GrooveShark.
Photo editing: I prefer Aviary for its hipster filters and ability to add ironic fashion accessories to animals and grandparents. It’s available on both iOS and Android. Other photo editors worth mentioning are PicShop and the baked-in photo editor available in Android 4.0+.
smartphone as desktop replacement
Social: Aside from the Facebook app, there’s a lot of good social apps, such as Google+ and Twitter. If you haven’t tried it already, give Falcon Pro a go for Twitter on Android. For iOS, try the official client.
Pin Websites to Your Launcher: We all know what an embarrassment the Facebook app is on Android. Fortunately, you can bypass this by going directly to their site from your home screen.
Watch Movies: MX Player offers one of the best video experiences on Android. iOS has It’s Playing, as well as many others.
Play Games: Adam Dachis explained how to turn your Android or iPhone into a tiny emulator. Android, however, remains the king of emulated gaming.

Conclusion

Turning your smartphone into a desktop doesn’t take much hardware, software or money for that matter. The cables themselves cost very little, except on the iPhone, and the software is mostly free. To turn my phone into a functional desktop (and I screwed it up by buying an MHL adapter instead of a SlimPort adapter), I only had to get a Bluetooth keyboard and a SlimPort adapter.
For anyone who wants to save space in their apartment, or simplify their life, ditching the desktop and the laptop just got much easier.

Wednesday, February 20, 2013

Hack attack: The U.S. and China must deal with cyber snooping

The news report that China's military has a cyber warfare unit in Shanghai dedicated to hacking into the computer systems of American institutions is chilling, but not surprising.
The Chinese Foreign Ministry denied the information in Tuesday's New York Times, which reported that a 60-page study by Mandiant, an American security firm, tracked the hacking activity to the area of a 12-story office building controlled by the military on Shanghai's outskirts.
By hacking into untold numbers of U.S. information systems involved in everything from Coca-Cola to electrical grids, water systems, railroads and governmental agencies, the People's Liberation Army has demonstrated the capacity not only to steal secrets but also to disrupt operations. The PLA has been doing it for years -- Mandiant says since 2006 -- and the suspicion is that a large number of America's commercial secrets have been pilfered and passed along to Chinese companies.
Even Americans who can't imagine a war between the United States and China must be alarmed by this development. The fact that Chinese military hackers could disable, in a wartime situation, critical pieces of U.S. infrastructure or even military readiness has to be disturbing.
On the other hand, just as with nuclear weapons and the notion of mutually assured destruction, it is likely that America's cyber warriors have drawn an equally lethal bead on Chinese capacities and infrastructure.
It is tempting for Americans to react with anger and consider retaliating with a cyber attack on Chinese systems -- or at least on the PLA hackers' Unit 61398, made infamous by the Times report -- comparable to what the United States and Israel did to Iran's nuclear facilities with the computer virus Stuxnet.
A more mature response would be to see China's hacking activities as part of the reality of 2013. Nonetheless, there should be earnest, quiet talks on the subject between President Barack Obama and incoming Chinese President Xi Jinping as soon as possible. This is not an area in U.S.-Chinese relations where ambiguity can be allowed to reign.

Read more: http://www.post-gazette.com/stories/opinion/editorials/hack-attack-the-us-and-china-must-deal-with-cyber-snooping-676088/#ixzz2LSmMEcxO

Tuesday, February 19, 2013

Exploit kits, the biggest threat on the web, are being fed by whitehat security researchers


Black hole. Image from ShutterstockThe newly-published Sophos Security Threat Report 2013 reveals that web exploit kits like the notorious Blackhole exploit kit are responsible for the majority of web attacks today.
The development of such attack kits, which exploit vulnerabilities to silently infect web-browsing computers, has been interesting for computer security professionals to follow.
During the past year, my colleagues at SophosLabs and I have been following the development of the Blackhole exploit kit very closely:
One thing I have noticed is a certain lack of originality in the exploit usage of the Blackhole exploit kit.
The author of the Blackhole exploit kit seems to be more comfortable as a system integrator and web application developer than anything else, and is far from being a hardcore vulnerability researcher.
This is perhaps not a surprise. After all, segregation in the malware field leads to specialization, and it has become apparent that the exploit kits are not the place to look for originality.
This impression of mine is perfectly supported by research conducted by iSec Partners, as you can see in the following video:






The video provides a good insight into exploit kits, and is well worth a watch by anyone interested in the topic.
It turns out that the number of exploits which first appeared in the malicious exploit kits is zero.
Further than that, only publicly-disclosed exploits which are well documented end up being used in the exploit kits.
So where do these exploits come from?
iSec Partners took the vulnerabilities used by the top 15 exploit kits, and investigated the original source of the disclosure:
Developed in APT 3
Developed by whitehats 10
Developed by malware authors 0
In a few cases the exploit was taken from samples of earlier field attacks, but more often, the source was the result of research by whitehat security experts.
Phoenix. Image from ShutterstockSome might argue that this is last year's story, as nowadays the Blackhole exploit kit dominates.
Would using the Blackhole exploit kit as a point of reference change the above picture? I don't believe so.
The same old exploits are used by the Blackhole exploit kit, with only a couple of new zero-day exploits added like CVE-2012-4681 or CVE-2012-1889.
However, although the vulnerabilities were classed as zero-day at the time of addition to the exploit kit, the exploit code itself was not developed by the kit's author.
Instead, the code was taken from publicly available samples – most visibly in the case of CVE-2012-1889, where the code was blindly copy-pasted into the exploit kit code.
To be clear: I am not against vulnerability disclosure.
Responsible disclosure helps the overall state of security. But that does not have to mean that we have to make the life of malware authors - such as those who deploy the Blackhole exploit kit - this easy.
Lets make the bad guys work hard for their money.
I can only agree with the conclusion of the iSec's presentation: force cybercriminals to take the more expensive route.
How much money would buying a vulnerability cost? A typical Java exploit found recently is expected to be worth a five-digit sum.
The Blackhole exploit kit's author himself claimed that to use a vulnerability would cost him about $100.000 if he were to buy it.
How much money would the exploit kits' manufacturers make? Clearly, not even close to this figure.
The last info I have was from a year ago, when Blackhole protection was restricted to be used on 28 servers. This was discussed in my technical paper, "Inside a Black Hole".
Blackhole protection was restricted to be used on 28 servers
The well-coordinated update scheme observed in the Blackhole-related malware flow suggests that only one code branch was used. I would estimate the number of Blackhole licenses sold to be the same amount.
Assuming the best, that they are all one-year-licenses, a yearly income amounting to a five figure sum could be estimated. Therefore even buying a single exploit would mean spending a significant amount of the venture's yearly income.
Providing it for free, in the form of easy-to-implement proof of concept code, really means supporting the exploit kit authors.
I'd much prefer a world where people chose to support the International Red Cross or the WWF instead.