> SQL-injection > NASDAQ
Sanitizing your inputs is apparently even harder than salting and hashing your passwords, something even the big-name companies tend to mess up.
Sigh.
“NASDAQ is owned.” Five men charged in largest financial hack ever
21–30 of 143 posts
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#22I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
In Israel, military service is compulsory for all men when they are 18 years old. The best hackers in the country are detected and lured into cyberwarfare positions where they need to be the best cyber attackers in the world for 3 years.
You bet that these guys are among the best in the world.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#23I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
They can't easily get jobs that pay them well, the way most programmers in the West can. People really good at security in the US just get a job making a great salary.
This is a very believable explanation.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#24Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#25I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
I've always figured (at least for former soviet states) that it's a combination of: + a rigorous STEM curriculum + limited conventional job prospects + a social/business environment in which exploit-selling is a respectable profession
Can you tell why you know that? Is that knowledge from personal experience?
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#26 Sites are susceptible when user input is ... incorrectly filtered for characters used in database commands ...
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#27> According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10.
This is truly dumbfounding to me. They had normalized, searchable access to millions of credit cards. They presumably had systematic ways of siphoning off money on high balance cards in a way that no one would've ever noticed. And yet, their grand scheme was to hock the numbers piecemeal for 50 a pop?
How are such smart people so bad at business.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#28> According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10. This is truly dumbfounding to me. They had normalized, searchable access to millions of credit cards. They presumably had systematic ways of siphoning off money on high balance cards in a way that no one would've ever noticed. And yet, their grand scheme was to hock the numbers piecemeal for 50 a pop?…
They had millions of credit cards. It's far easier and safer to sell the cards than try to come up with a scheme that will make an equivalent amount of money using them. Plus with that many they had far more than they could ever use.
That's like saying anyone who runs a SaaS that helps other businesses make money for $50/m is bad at business.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#29> According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10. This is truly dumbfounding to me. They had normalized, searchable access to millions of credit cards. They presumably had systematic ways of siphoning off money on high balance cards in a way that no one would've ever noticed. And yet, their grand scheme was to hock the numbers piecemeal for 50 a pop?…
Because low risk, little effort, high volume. Easy (if you're smart).
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#30"According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10."
Where are they getting their numbers from? Last I heard (a year or two ago), carders charged about 10 cent for foreign cards and a dollar per US card. Any actual carding researchers care to weigh in?