Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack Back – A DIY guide to those without the patience to wait for whistleblowers

data.langly.fr

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#41

Post by onewaystreet »

enraged_camel wrote: post #21
kevin_thibedeau wrote: post #15

"I recommend using servers you've hacked or a VPS paid with bitcoin to hack from." Not a good idea considering Bitcoin isn't anonymous and a sufficiently motivated state can back track to an electronic purchase of bitcoin tied to your identity.

My understanding is that a sufficiently motivated state can find any computer criminal. It's just a matter of following them long enough until they slip and make an opsec mistake.

Usually the mistake is talking too much. Jeremy Hammond (Stratfor hack) had really good technical opsec but made the mistake of talking about his IRL exploits to Sabu which led the FBI to connect his online identity to his IRL political activism. Had he kept his mouth shut he probably would have never been caught.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#42

Post by cellover »

Very interesting read. Amazing to see where information gathering and simple hacking techniques can lead you...

Pilots have checklists, web developers have Application Security Verification Standard (2014)! https://www.owasp.org/images/5/58/OWASP_ASVS_Version_2.pdf

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#43

Post by twistedpair »

StavrosK wrote: post #32
Kalium wrote: post #16

Earlier quoted context omitted.

I have my doubts. Think about lock design - it's been known for a long time how to design decent locks, and yet in the US we still use these crappy cylinder locks.

As someone who doesn't know, how do we design decent locks? Which locks use the decent design?

Read up on Medeco. An expert lock smith might be able to pick it in his career, once. That's an $80 lock. Now look at Kwikset from HomeDepot for $11. An amateur can pick that lock in 2 seconds flat.

In short, the Medeco lock basically has every deterrent you can put into a lock that the industry knows about. Medeco to Kwikset is like a major payment processor's portal to a Wordpress site with a shopping cart plugin for seeing specialty cat themed oven mitts. You get what you pay for if you high someone that knows what they're doing.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#44

Post by atleta »

EliRivers wrote: post #9
orf wrote: post #7

Every time I find or see an SQL injection issue I get angry. It's 2014, why are web developers still making the same basic mistakes? SQL injection is a fixed issue. There is no excuse. Same with XSS, although not as serious it's staggeringly common.

I believe it is essentially a function of the skill distribution and price of developers. There will always be a spectrum of skill level; there will always be very inexperienced, low-skilled developers just about able to knock together something that works, but is susceptible to SQL injection. These inexperienced developers will charge less, and will get work, so there will always be an endless supply of new develope…

4) Security testing becomes a norm and there will be easy to use tools/services. Regulation doesn't help here. Everyone makes mistakes, the better developers just make less.

There is no reason not to have these tools if you have so many easy to use ones available for intrusion.

I happen to have known a local startup that was working on such a service: intrusion/security testing SaaS. Their model was something like giving a simple dashboard/report that the management could easily understand and act on if needed. They also thought about having a badge that the verified sites could display, as a proof towards their users that they are secure. Unfortunately they, and their VC, screwed it up big time.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#45

Post by zerohp »

Eiriksmal wrote: post #34
KJasper wrote: post #8

Earlier quoted context omitted.

How would you know for sure that it didn't dump the database to somewhere in Asia once "they" have your server under control? Serious question, because how can you trust the logs? (Mind you, I'm not that technical)

Because they never gained root access. I trust the logs in this case because their actions were immediately made known: Access logs show failed login attempts from that ip for a range of usernames, a successful login on the compromised account, then nothing but reams of mail being churned out. If it had been done for more nefarious purposes, wouldn't "they" have been more discreet, carefully wiping traces of their ac…

> I can erase or alter logs, but then there are logs logged of me vi'ing logs, so I erase the shell history, but then that gets logged when I log out. It's a weird loop I don't know how to defeat, but some people do.

This is trivial, but you need to be familiar with the environment variables used by bash. unset HISTFILE

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#46

Post by javajosh »

kevin_thibedeau wrote: post #15

"I recommend using servers you've hacked or a VPS paid with bitcoin to hack from." Not a good idea considering Bitcoin isn't anonymous and a sufficiently motivated state can back track to an electronic purchase of bitcoin tied to your identity.

I believe the correct approach is to share your tools and services freely in such a way as they can be configured and used from public computers (e.g. Apple Store, or a recently purchased craigslist laptop from an open wifi access point). The general idea is that you prepare your tools at your leisure, and then invoke and target in anonymity.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#47

Post by lifeisstillgood »

FLUX-YOU wrote: post #30
jacobsenscott wrote: post #25

Earlier quoted context omitted.

Web developers are making these errors because of the high demand for cheap web devs churned out of "learn to code!" bootcamps coupled with the fact that the people writing the checks don't understand security. Also, while basic SQL injection issues are "fixed" if you are an experienced dev, CVEs about SQI in libraries meant to protect you from SQI are common. No doubt there are lots of zero day SQI exploits for ever…

>Web developers are making these errors because of the high demand for cheap web devs churned out of "learn to code!" bootcamps coupled with the fact that the people writing the checks don't understand security. Cheap developers with no senior oversight and code review? No [automated] security testing to catch the basics? You're getting what you deserve if this is the only level of talent and organization you want to…

Thank you - dunno why I just needed that said out loud - I shall stop worrying about how to compete for or educate such people - thank you.

That just was the right words at the right time :-)

Cheers

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#48

Post by Pxtl »

orf wrote: post #7

Every time I find or see an SQL injection issue I get angry. It's 2014, why are web developers still making the same basic mistakes? SQL injection is a fixed issue. There is no excuse. Same with XSS, although not as serious it's staggeringly common.

Honestly, I find it's bad tools. Every database lib I've worked with tried to bully you into using prepared/compiled queries or full ORM queries, but occasionally you still have to break out and smash strings together to build queries.

And when that happens? You can't help but notice that nobody provides you with a simple "EscapeSql" function you can use, so I always have to roll my own (or do horrible things with dynamically constructing the parametrized query and the parameter array in parralel).

I wouldn't be surprised if many developers just throw up their hands and skip sanitizing.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#49

Post by pvnick »

Fyi the torrent can be found at https://netzpolitik.org/wp-upload/finfisher.torrent, and the encrypted archive which possibly contains the server software (which the author has asked volunteers to help crack. See section 7.) is at finfisher/www/FinFisher/Engineers7117/FinSpy/Images/FinSpy-PC+Mobile-2012-07-12-Final.zip. That file alone makes up 31.4gb of the 38.7gb total size.

Re: Hack Back – A DIY guide to those without the patience to wait for whistleblowers

#50

Post by thaumasiotes »

twistedpair wrote: post #43
StavrosK wrote: post #32

Earlier quoted context omitted.

As someone who doesn't know, how do we design decent locks? Which locks use the decent design?

Read up on Medeco. An expert lock smith might be able to pick it in his career, once. That's an $80 lock. Now look at Kwikset from HomeDepot for $11. An amateur can pick that lock in 2 seconds flat. In short, the Medeco lock basically has every deterrent you can put into a lock that the industry knows about. Medeco to Kwikset is like a major payment processor's portal to a Wordpress site with a shopping cart plugin f…

You sound like a true believer in DRM. Just like with DRM, a lock doesn't provide all that much security because all of the information necessary to break it is encoded in the lock.

From http://en.wikipedia.org/wiki/Medeco :

> As of 2008, several new methods of cracking Medeco locks has been developed by Mark Tobais and Tobias Bluzmanis and were presented at the DEF CON 2008 and HOPE 2008. A simultaneous public release of a book detailing many of the exploits, called "Open in Thirty Seconds" detailed many of the attacks discovered.

> They further detailed the ability to bump current generation Medeco M3 locks.

> Many Medeco dealers continue to make claims about the Bump and Pick proof nature of their locks, however Medeco has retracted virtually all of its own press indicating such claims.

Furthermore, this particular piece of rhetoric:

> An expert lock smith might be able to pick it in his career, once.

makes no sense. Picking a style of lock once makes the next time easier, not harder.

Post reply on HN