“NASDAQ is owned.” Five men charged in largest financial hack ever • Hacker News Board

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#51

Post by readysetgo » Thu, Jul 25, 2013, 9:19 PM UTC

samstave wrote: post #38

gknoy wrote: post #35

Earlier quoted context omitted.

I do not think that we would want the result of that.

HA the jokes on you! We already HAVE the result of that. In all serious though, just be thankful you're still alive you unappreciative uppity citizen; at least you haven't been killed by a terrorist yet .

People don't often die from terrorism. He is much more likley to die from diabities, heart disease, cars or a gun shot.

More toddlers with guns have killed Americans this year than terrorist have.

If we are trying to save lives, worrying about terrorism is a waste of money.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#52

Post by acv » Thu, Jul 25, 2013, 9:21 PM UTC

ripter wrote: post #8

sarreph wrote: post #4

Was most of this done by SQL injection?

Looks like they used SQL injection to get passwords and then used those passwords to access the servers.

The article says that they used the injection to get hashed login credentials. Did they then use a rainbow table to reverse the hashing?

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#53

Post by waterlesscloud » Thu, Jul 25, 2013, 9:23 PM UTC

austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

It feels like it's been that way for at least a couple of decades. In the early years of PC viruses it seemed like all the innovation was coming out of eastern Europe.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#54

Post by skolor » Thu, Jul 25, 2013, 9:23 PM UTC

screwt wrote: post #26

Sites are susceptible when user input is ... incorrectly filtered for characters used in database commands ... If you're trying to protect yourself from SQLi by filtering & then running user input, you're doing it wrong. If a supposedly tech-literate site like Ars can't get that right, what hope do we have? (Let alone the banks themselves...)

That's exactly what defines SQLi. Incorrect filtering of user data is precisely the reason why SQLi is a vulnerability.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#55

Post by thesis » Thu, Jul 25, 2013, 9:30 PM UTC

alexjeffrey wrote: post #44

the idea that NASDAQ might've been hacked using an SQL injection is pretty scary, as it's a pretty trivial attack to protect against in most cases (mysql_real_escape_string?) - is security in stock exchanges really so lax?

mysql_real_escape_string isn't secure. AT ALL.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#56

Post by devcpp » Thu, Jul 25, 2013, 9:34 PM UTC

2pasc wrote: post #22

austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

In Israel, military service is compulsory for all men when they are 18 years old. The best hackers in the country are detected and lured into cyberwarfare positions where they need to be the best cyber attackers in the world for 3 years. You bet that these guys are among the best in the world.

The IDF's ICT unit also has a very large budget (it's actually the only unit with an increasing budget despite a 2 billion overall budget drop), and with access to all kinds of technologies that only a government can afford. When the engineers get out of there, they know things that few people know about.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#57

Post by 0x0 » Thu, Jul 25, 2013, 9:37 PM UTC

skolor wrote: post #54

screwt wrote: post #26

Sites are susceptible when user input is ... incorrectly filtered for characters used in database commands ... If you're trying to protect yourself from SQLi by filtering & then running user input, you're doing it wrong. If a supposedly tech-literate site like Ars can't get that right, what hope do we have? (Let alone the banks themselves...)

That's exactly what defines SQLi. Incorrect filtering of user data is precisely the reason why SQLi is a vulnerability.

The better way to defend against SQLi would be to use proper quoting/prepared statements, instead of trying to play whack-a-mole by filtering and limiting the content of the input strings.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#58

Post by malkia » Thu, Jul 25, 2013, 9:39 PM UTC

austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

Speaking as bulgarian, my guess is that the eastern block countries were limited to the amount of software/hardware that could be sold in the countries due to Cocom ( http://en.wikipedia.org/wiki/CoCom ) and this possibly brought a whole generation of people that became good at reverse engineering, but most likely also at whole culture that thinks it's okay to reverse engineer almost everything...

One of my friend's mother worked at bulgarian shop that all they did was to translate Norton Commander into russian (basically hex editing here and there), and then it was sold on the russian market.

We had up to 1988-1989 a bulgarian company that was selling bootlegged games under their own name (yes I bought Karateka from them, and it worked on the bootlegged Pravetz-8C - a.k.a Apple ][/c).

But it doesn't stop there - you can (or at least back in the days) find people living in the same apartment building that were able to fix your TV, car, radio, etc. without calling technician.

My father regularly fixed TV sets of neighbors for no money (he's an ex military engineer - worked in radio-location)

But then it was something about russian, or eastern block made hardware - you take any plane, car, tank, radio, etc. - you can open it yourself and start hacking, replace parts, etc. - e.g. even the own-made products were meant to be hackable.

Now this is according to my father, who told me that it was much easier to fix russian produced military vehicles than anything else.

The I-fix-it culture was really thriving, and some thanks to the "communism" (there was never such thing), but lots of kids got free education since 1st grade in computer science, hardware, rocketry, train modeling. The magazines were so cheap (and printed out on cheap paper) - that you can buy dozen of them full with models, etc.

This is no longer the case (I've been living in USA since 1999, but visit my own Bulgaria almost every year).

I wish some of the days are back, but I knew that it was utopia we lived....

Well take it with a grain of salt, typing this while on vacation from my lovely Bulgaria :)

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#59

Post by NegativeK » Thu, Jul 25, 2013, 9:39 PM UTC

thesis wrote: post #55

alexjeffrey wrote: post #44

the idea that NASDAQ might've been hacked using an SQL injection is pretty scary, as it's a pretty trivial attack to protect against in most cases (mysql_real_escape_string?) - is security in stock exchanges really so lax?

mysql_real_escape_string isn't secure. AT ALL.

This would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#60

Post by mcphilip » Thu, Jul 25, 2013, 9:42 PM UTC

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

Some services that scan the assets on a network for a wide range of vulnerabilities: QualysGuard, Nexpose, McAfee EPO.

There is a market there among Fortune 500 companies, for sure. The difficulties (as I've experienced it) are:

1. Companies want some omni tool that scans vulnerabilities, manages tickets, enforces policies, tests controls, etc and feeds all the data into a single database that they can run reports on.

2. Large companies (especially financial ones) don't want their data in the cloud so you have to provide some sort of support onsite.