Amazing people are still ignorant of how to properly code a web application. Not to mention all the companies that likely still store passwords using a reversible algorithm and fail to separate and encrypt credit card information. What is this, 1994?
“NASDAQ is owned.” Five men charged in largest financial hack ever
101–110 of 143 posts
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#102I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
> I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
Or maybe it's just USA that's good at breeding anger and revenge-driven people all over the world. ;)
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#103I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
I've heard theories that it's as simple as they had older and slower machines, so they thought more carefully about not just the code they were writing but about the machine it was running on as well. In the end, they end up gaining a better understanding than 'spoiled' programmers in the west who could afford to compile, run, edit, compile, run...
There's also the theory that they don't have as much to do, at least not as many distractions.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#104I'll get downvoted for this, but I think SQL admins should in some way be held accountable for successful injection attacks. Falling victim to this type of exploit which is as old as the hills should be inexcusable. How difficult is it to learn how a UNIX shell works, inside and out? For what these guys get paid and what they are tasked with securing, they should be experts on escaping and quoting and every possible thing one can do with the shell. All the boring stuff. Because that's probably the knowledge these "hackers" leveraged.
If I'm wrong here, if there's more to it, feel free to correct me. I want to be empathetic with the people who set up these SQL databases, but I really cannot understand why anyone can still in 20xx get a shell via SQL statements, at a financial institution no less, after so many years of seeing others fall victim.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#105I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
> I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers. Or maybe it's just USA that's good at breeding anger and revenge-driven people all over the world. ;)
Well, Eastern European cybercriminals typically go after companies worldwide; there usually isn't a particular focus on America. That's in contrast to China.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#106I'll get downvoted for this, but I think SQL admins should in some way be held accountable for successful injection attacks. Falling victim to this type of exploit which is as old as the hills should be inexcusable. How difficult is it to learn how a UNIX shell works, inside and out? For what these guys get paid and what they are tasked with securing, they should be experts on escaping and quoting and every possible…
Generally, the DBAs have very little role in knowing whether any part of their application is vulnerable to SQL injection, and on top of that they can't mitigate very well against it.
They can do the basic things: don't use the root MySQL user, restrict privileges on each MySQL user, use AppArmor or SELinux to isolate the mysqld process, etc. This does prevent an attacker, in most cases, from instantly uploading a shell as soon as they find any sort of injection vector.
But it does not stop an attacker from reading arbitrary values from any table in any of the databases the MySQL user has read-permissions to (which in many cases is every database on the server).
And if an attacker can effectively dump your database, generally it's a matter of cracking admin password hashes and using those to login and escalate their access. DBAs really play no part in any of that; it is the developers of the application who must be blamed here. It's their job to use good hashing mechanisms, and to prevent admin accounts from being able to escalate privileges and upload a shell to the server. And above all, to code securely and prevent SQL injection in the first place.
Also, this isn't reddit, please don't say "I know I'll get downvoted for this."
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#107Earlier quoted context omitted.
Looks like they used SQL injection to get passwords and then used those passwords to access the servers.
The article says that they used the injection to get hashed login credentials. Did they then use a rainbow table to reverse the hashing?
There are a wide myriad of ways that plaintext can be derived from password hashes. Rainbow tables are an option if they're not salted; otherwise the attackers likely had access to fairly significant computing power (considering the amount of money they were raking in) to perform typical dictionary + bruteforce attacks on them.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#108Earlier quoted context omitted.
Blaming the victim? Nice.
If indeed it was a basic SQLi attack and NASDAQ failed to prevent it, then to some degree, yes, they're responsible. As a high-value target it's incumbent on them to secure their systems. Here on HN we often say "security through obscurity is no security." Relying on the fact that it is "illegal" for someone to hack your system to prevent them from doing so is similarly flawed logic.
Yep. And depending on where the attackers are from, it might only be illegal in US jurisdiction anyway. So it's just plain negligence not to do your best. That said, it is a huge attack surface and it sounds like they had a lot of time and resources; they can afford to just wait to get lucky. NASDAQ had to be lucky ALL the time. /devils advocate - obviously someone f'd-up.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#109I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
Speaking as bulgarian, my guess is that the eastern block countries were limited to the amount of software/hardware that could be sold in the countries due to Cocom ( http://en.wikipedia.org/wiki/CoCom ) and this possibly brought a whole generation of people that became good at reverse engineering, but most likely also at whole culture that thinks it's okay to reverse engineer almost everything... One of my friend's…
Same reason as why demo coders from amiga, c64 and other limited systems are premier coders today. Limited financial and hardware resources make you shine in all kind of situations.
Re: “NASDAQ is owned.” Five men charged in largest financial hack ever
#110I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
Speaking as bulgarian, my guess is that the eastern block countries were limited to the amount of software/hardware that could be sold in the countries due to Cocom ( http://en.wikipedia.org/wiki/CoCom ) and this possibly brought a whole generation of people that became good at reverse engineering, but most likely also at whole culture that thinks it's okay to reverse engineer almost everything... One of my friend's…
> "communism" (there was never such thing)
In college I wrote a major research paper on market-style exchanges on the factory floors of Eastern Europe, with the underlying point that you can never really purge all market forces, that "capitalism" is more descriptive than normative.
When I think back on it, well, I'm mostly ashamed for talking out of my ass about what other people actually experienced. It'd be great to hear more of your thoughts on it.