Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“NASDAQ is owned.” Five men charged in largest financial hack ever

arstechnica.com

Post reply on HN
Print view View original

81–90 of 143 posts

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#81

Post by paganel »

austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

I'm from Eastern Europe myself, and while I know it's anecdotal only, from living for one year in the same dorm-room with a guy like the ones described in the article all I can say it's that it was not about the money (at least not 14 years ago, when I was still a freshman) but more about "hey, I want to see what this piece of closed-source software is actually all about! How can I crack it?". It also "helped" that we were generally quite poor (we still are, comparetavily) and so it made "economic sense" to spend days and days tweaking with assembly code and what-have-you in order not to pay $4.99 for a crappy music player or something similar, and in the process acquiring quite a bit of knowledge (much more valuable) about how such things work.

And the guy I started talking about now works for a pretty important anti-virus company , he's one of the most gifted hackers I've ever met.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#82

Post by wiml »

kevin818 wrote: post #40

How would one even go about doing this? Do you just keep trying difference ssh key values? I never understood how people can just magically "gain access" to servers.

It can be pretty enlightening to read the few postmortems of big hacks that do get published.

Another seemingly common scenario (aside from a direct attack on the server) is to spear-phish someone else inside the company, not necessarily an admin or anyone technical, into clicking on some flash applet or trojan'd excel doc or something that owns their machine, then install keyloggers, proxies, etc., and work from there until you snag a credential that lets you into the server you actually want.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#83

Post by txutxu »

Upvoted, did make me enjoy the read.

6 months since the first SQLi to the "Nasqad is owned".

6 months...

Sometimes I've play Neo from a pub connection with recycled hardware (not buy with my card number) but at most one week to the same target.

I wish I could have the skills of those people. Not that I want to make money stoled from unknown people... I just would like to have their skills.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#84

Post by dgroves »

acv wrote: post #52
ripter wrote: post #8

Earlier quoted context omitted.

Looks like they used SQL injection to get passwords and then used those passwords to access the servers.

The article says that they used the injection to get hashed login credentials. Did they then use a rainbow table to reverse the hashing?

Precisely why hash(salt+password) is no longer sufficient. An HSM is require with keys known to nobody (backup HSM's locked in a safe) but the password hashing machine. In a nutshell it should be more like this: Hash(hsm_keys+salt+password)

Of course all the usual things about entropy still apply, that string should be at least 256 bytes (256 bits of entropy is 32 bytes, so I am advocating much, much more), and that will likely only keep you safe until the next generation of ASIC computers are released.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#85

Post by antimora »

malkia wrote: post #58
austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

Speaking as bulgarian, my guess is that the eastern block countries were limited to the amount of software/hardware that could be sold in the countries due to Cocom ( http://en.wikipedia.org/wiki/CoCom ) and this possibly brought a whole generation of people that became good at reverse engineering, but most likely also at whole culture that thinks it's okay to reverse engineer almost everything... One of my friend's…

+1 for Karateka and Pravetz-8C which was my first computer =)

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#87

Post by 2pasc »

crag wrote: post #79
2pasc wrote: post #22

Earlier quoted context omitted.

In Israel, military service is compulsory for all men when they are 18 years old. The best hackers in the country are detected and lured into cyberwarfare positions where they need to be the best cyber attackers in the world for 3 years. You bet that these guys are among the best in the world.

"military service is compulsory for all men when they are 18 years old." Not correct. All men (and women) except those in a Yeshiva (religious school). As I understated it, they can post-pone their enlistment indefinitely. I also understand this is a touchy subject in Israel right now.

Sure. But a vast majority of men do that, and are proud to do it. In Israel, you meet your best friends in the army.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#88

Post by luminiferous »

readysetgo wrote: post #51
samstave wrote: post #38

Earlier quoted context omitted.

HA the jokes on you! We already HAVE the result of that. In all serious though, just be thankful you're still alive you unappreciative uppity citizen; at least you haven't been killed by a terrorist yet .

People don't often die from terrorism. He is much more likley to die from diabities, heart disease, cars or a gun shot. More toddlers with guns have killed Americans this year than terrorist have. If we are trying to save lives, worrying about terrorism is a waste of money.

I'm fairly certain he was being facetious.

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#89

Post by z-factor »

austenallred wrote: post #10

I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.

Speaking from personal experience (Ukraine).

There are plenty of job opportunities and the coders are relatively even more overpaid than in the West, so that's not the reason.

The real reason I believe is that people mostly can do this with impunity. There's very little being done for prevent or prosecute credit card fraud. In Ukraine and Russia CCs are still used very little, so this fraud hurts "the West" which is mostly seen as a good thing by the general population. Rampant piracy is practically encouraged for the same reason.

Of course this creates a barrier for doing legitimate business online. For example PayPal simply does not allow merchant accounts from Ukraine and Russia to reduce fraud. These countries are the safe haven for hosting illegal content etc. It would benefit local programmers to clean up the reputation of the country and to my great annoyance people just do not realize this. Crooks are accepted as keynote speakers at business conferences etc (they do make money, so what's the problem?)

Re: “NASDAQ is owned.” Five men charged in largest financial hack ever

#90

Post by tptacek »

larrys wrote: post #72
tptacek wrote: post #43

Earlier quoted context omitted.

There is a market here.

Someone who does security work for me on the side (for about 12 years works now) manages a team that does this at a large consulting company. I can't remember exactly, but he told me what they bill him out for and it sounded like NY senior attorney level rates. He travels overseas regularly on longer term assignments. I told him he should go out on his own but he's not entrepreneurial. He also said that a few of the…

I think starting a security consultancy is a business idea that just might work.
Post reply on HN