“NASDAQ is owned.” Five men charged in largest financial hack ever • Hacker News Board

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#61

Post by antiterra » Thu, Jul 25, 2013, 9:42 PM UTC

driverdan wrote: post #33

> Court documents allege that as a result of the scheme, financial institutions, credit card companies and consumers suffered hundreds of millions in losses, including more than $300 million in losses ... BULLSHIT. I want to see hard evidence that there were real losses totaling more than $300 million. The justice dept loves inflating loss figures based on sentencing guidelines which mandates minimum losses for stole…

Why does this call for an all-caps "bullshit?"

It's really not that much money per card for just the Heartland breach alone, even if you assume only a fraction of cards were actually being used.

The Heartland breach was discovered after card companies found a pattern of chargebacks over a number of months. If the cards hadn't been used, the breach likely would have been undiscovered, for years, if at all. It took Heartland months of investigation to find internal evidence they had been breached. The attackers had long since left and attempted to erase their tracks.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#62

Post by adamlj » Thu, Jul 25, 2013, 9:42 PM UTC

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

The real problem here is that this is extremely asymmetric. All the bad guys need to do is to find a single mistake from an employee, subcontractor, vendor etc.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#63

Post by phoboslab » Thu, Jul 25, 2013, 9:42 PM UTC

thesis wrote: post #55

alexjeffrey wrote: post #44

the idea that NASDAQ might've been hacked using an SQL injection is pretty scary, as it's a pretty trivial attack to protect against in most cases (mysql_real_escape_string?) - is security in stock exchanges really so lax?

mysql_real_escape_string isn't secure. AT ALL.

How so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all params in quotes (or much better: use prepared statements to begin with).

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#64

Post by oogali » Thu, Jul 25, 2013, 9:44 PM UTC

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

Sure, you can identify them -- but will they listen and actually take corrective action?

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#65

Post by NegativeK » Thu, Jul 25, 2013, 9:44 PM UTC

driverdan wrote: post #37

AsymetricCom wrote: post #31

Doesn't NASDAQ have some responsibility for this hack? Doesn't NASDAQ have serious security reputation issues now?

Blaming the victim? Nice.

The victim isn't NASDAQ. The victims are the people who trusted NASDAQ. Parent is asking whether NASDAQ was negligent.

That path has dangers all around (though, financial regulations try somewhat, don't they?) but it's a different discussion than victim blaming.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#66

Post by rogerbinns » Thu, Jul 25, 2013, 9:45 PM UTC

kevinalexbrown wrote: post #41

Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart m…

A good blog to follow is Krebs on Security: https://krebsonsecurity.com/

He often has screenshots and other details on the working of various markets.

Here is a market for ecommerce credentials: https://krebsonsecurity.com/2012/12/exploring-the-market-for...

What use a hacked PC has: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hack...

And even a thriving software industry for the bad guys http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/

Counterpane is a company (now owned by BT) that sells managed network security services as an example of how you sell to the firms.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#67

Post by jordanthoms » Thu, Jul 25, 2013, 9:48 PM UTC

NegativeK wrote: post #59

thesis wrote: post #55

Earlier quoted context omitted.

mysql_real_escape_string isn't secure. AT ALL.

This would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.

Anyone not using prepared statements in 2013 is just being stupid - there is no reason to ever be vulnerable to a SQL injection, barring a bug in the database or driver you are using. It's totally unacceptable.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#68

Post by apalmer » Thu, Jul 25, 2013, 9:49 PM UTC

driverdan wrote: post #37

AsymetricCom wrote: post #31

Doesn't NASDAQ have some responsibility for this hack? Doesn't NASDAQ have serious security reputation issues now?

Blaming the victim? Nice.

This isnt a mugging or an assault.

This is a company charged with processing financial information that apparently didnt sufficiently protect the data.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#69

Post by gnufied » Thu, Jul 25, 2013, 9:49 PM UTC

An interesting trivia is - one of the guys being charged is "Dmitry Smilianets", CEO of Moscow 5. A rather very prestigious esports organization that has/had good teams in League, Dota2 and Counter strike.

The arrest itself happened an year ago and was widely reported on gaming websites (http://www.joindota.com/en/news/3537-moscow-5-ceo-arrested-i...).

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#70

Post by duncans » Thu, Jul 25, 2013, 9:53 PM UTC

skolor wrote: post #54

screwt wrote: post #26

Sites are susceptible when user input is ... incorrectly filtered for characters used in database commands ... If you're trying to protect yourself from SQLi by filtering & then running user input, you're doing it wrong. If a supposedly tech-literate site like Ars can't get that right, what hope do we have? (Let alone the banks themselves...)

That's exactly what defines SQLi. Incorrect filtering of user data is precisely the reason why SQLi is a vulnerability.

Incorrect handling I'd say. If you're filtering apostrophes from your user input you're doing it wrong.