I just hope someday the general public realize what a poor job Microsoft has done regarding security on Windows operating systems and embrace other (and more promising) alternatives
broadly speaking, how would you design things? All I can think of doing is putting explicit permission grants on everything, requiring everyone to click a million times as was done with the first version of Vista's UAC, IIRC, which is no solution IMO.
Mac and Unix do this right. Yes, there is a lot more permission granting, but it seems to work just fine without people raging at it.
Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…
I wish HN had a `save` feature so I don't lose gems like these.
Use bookmarks feature. At least Chrome and FF allows you to sync it between different instances.
(Personally I use pinboard.in and would happily recommend it but I don't think everyone need it.)
I wish HN had a `save` feature so I don't lose gems like these.
Use bookmarks feature. At least Chrome and FF allows you to sync it between different instances. (Personally I use pinboard.in and would happily recommend it but I don't think everyone need it.)
There's no need. If you upvote the story you can find it again under 'upvoted stories' in your HN profile.
That said, pinboard.in is a decent service, and it's useful to have all your bookmarks in a central location.
What they did at the time would still have definitely been illegal. Probably not any more illegal than it is now. I doubt they'd be prosecuted, but breaking into any system is illegal.
Hitting people in the face is illegal; hitting people in the face in self-defense is legal. So... It would be interesting court case :)
Following them back to their house, picking the lock on their door, walking into their bedroom and hitting them in their face is not legal.
I've done this a few times for fun, simply search YouTube for a "game code generator" or something like that, take your pick, download their magic "tool" from the link in the video description and get disassembling with ILSpy [1]. A ton of these "account stealers" are written in VB.NET and seem to be generated from a template. Remember to stay safe and use a sandbox or virtual machine when dealing with malicious code…
Anyone knows a better decompiler for .net other than ilspy? It's a hit or miss for me with ilspy, would like to try something better even if it's paid.
I agree, it's amazing how stupid criminals can be, even online. It's scary to think what someone as smart as these security researchers could do if they went black hat...
I'm thinking that's who's working on stuff like Stuxnet, Flame, etc. I wonder what color hat we would consider Government-sponsored malware to be?
These days I'd be worried about CFAA or otherwise getting V& for this. In the "good old days", it was possible to get away with and laugh about this type of vigilante justice. These days though, you're more likely to wind up in prison. No longer worth it for lulz. Sad times now, but good memories.
Honestly, my bigger concern would be motivating a retaliatory attack. A lot of the people who run botnets have big egos and respond poorly to this kind of challenge, especially when it can mean serious lost money for them. I've caused a retaliatory attack against a system I was responsible for once (thankfully not an important one) and I know at least one other security professional with a similar story - and in his…
I have had the opposite experience. What the author did here is something I've been doing for years (I've got quite a collection of crapware and have published a couple of articles about operating honeypots and honeynets). I occasionally drop in on the people running botnets and surprise them in their C&C channels. More often than not, the person is surprised and quiet and suspicious, and then curious. I get the sense there is some respect coming back the other way for whatever reason. I do spend time cataloging the botnet and its inventory and features, though I don't always present that information to the person running it. The worst reaction I've ever had was just having people hang up on me immediately after I reveal myself to them. They must think I'm law enforcement. Perhaps it's because I don't confront these guys in public, or that I don't antagonize them. I'm not sure. But I have never had anyone retaliate against me, and I have done this quite a lot over the years.