As someone interested in getting into penetration testing, this is a fascinating look into how techniques that have been around forever can be used to get into anything. Disregarding the scale and target, this isn't anything groundbreaking. It's just the fact that a company like Gamma was vulnerable to simple things like this that is surprising.
Hack Back – A DIY guide to those without the patience to wait for whistleblowers
11–20 of 62 posts
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#12Every time I find or see an SQL injection issue I get angry. It's 2014, why are web developers still making the same basic mistakes? SQL injection is a fixed issue. There is no excuse. Same with XSS, although not as serious it's staggeringly common.
I believe it is essentially a function of the skill distribution and price of developers. There will always be a spectrum of skill level; there will always be very inexperienced, low-skilled developers just about able to knock together something that works, but is susceptible to SQL injection. These inexperienced developers will charge less, and will get work, so there will always be an endless supply of new develope…
No, it will stop. I think the tools and general lack of awareness are a big factor - those will both undoubtedly change.
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#13We still looking for the infamous password that would allow to reverse engineer the software and found the C&C!
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#14This article was quite fascinating. It's impressive that a series of small security holes culminate with the release of sensitive software. It's equally interesting that all those security tips we roll our eyes at, as we've heard them one too many times, they really matter! Don't write crappy code: Don't trust user input. Don't do client-side only checks on any information being processed by the server. Etc. Etc. The…
How would you know for sure that it didn't dump the database to somewhere in Asia once "they" have your server under control? Serious question, because how can you trust the logs? (Mind you, I'm not that technical)
Once the servers been comped, you can't tell what's been accessed on that machine. You could possibly find out if it accesses other machines within your network (logging depending) - however if someone were to root a public facing server that had a bunch of files on it, you have to assume they've been seen/duplicated.
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#15"I recommend using servers you've hacked or a VPS
paid with bitcoin to hack from."
Not a good idea considering Bitcoin isn't anonymous and a sufficiently motivated state can back track to an electronic purchase of bitcoin tied to your identity.
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#16Earlier quoted context omitted.
I believe it is essentially a function of the skill distribution and price of developers. There will always be a spectrum of skill level; there will always be very inexperienced, low-skilled developers just about able to knock together something that works, but is susceptible to SQL injection. These inexperienced developers will charge less, and will get work, so there will always be an endless supply of new develope…
No, it will stop. I think the tools and general lack of awareness are a big factor - those will both undoubtedly change.
I have my doubts. Think about lock design - it's been known for a long time how to design decent locks, and yet in the US we still use these crappy cylinder locks.
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#17"I recommend using servers you've hacked or a VPS paid with bitcoin to hack from." Not a good idea considering Bitcoin isn't anonymous and a sufficiently motivated state can back track to an electronic purchase of bitcoin tied to your identity.
haha, you're not thinking like a hacker :)
purchase it using stolen bitcoin. :P
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#18How was this article found? You go up to the directory and there is a whole host of cruft. Not discounting the likelihood that this is how the attacker was successful -- none of it's bullshit anyways -- but seems odd that someone would just stumble upon this. Can't find out much about that site either other than the Datalove reference that makes it seem like some Telecomix thing. Anyways, interesting submission. Shows how quickly an attack can escalate and what easy tools are available for you to test your own sites for vulnerabilities.
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#19Wow, if a damn IT sec company can't get secuiity right, how am I supposed to?
Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers
#20This article has already been submitted 3 days ago under the pastebin link: http://pastebin.com/raw.php?i=cRYvK4jb (https://news.ycombinator.com/item?id=8155177)