Donate Bitcoin

Donate Paypal


PeakOil is You

PeakOil is You

Hackers: Public enemy #1

What's on your mind?
General interest discussions, not necessarily related to depletion.

Hackers: Public enemy #1

Unread postby Novus » Tue 10 May 2011, 05:41:07

If you aren't afraid of hackers yet then you should be. The largest most powerful corporations and governments are being laid low by hackers. They are powerless to stop this plague of hacking as they steal financial information and infect millions of computers. Chances are you have already been hacked and don't know it. Chances are some criminal element has already stolen your identity even if you don't use a computer because the businesses and government databases that contain your financials have already compromised.
Goblogin
Sony Hack Speaks To Proliferating Threat: Written by Administrator | 09 May 2011
Sony is run by a bunch of greedy morons who stupidly left their systems vulnerable to an attack by hackers: This is the conventional explanation of how the company finds itself bent into a familiar pose of contrition, following news that cyber-pirates breached its defenses, potentially gaining access to troves of valuable information -- credit card numbers, email addresses -- for more than 100 million customers.

If only life were so soothingly simple. The Sony data hack and the predictable pursuit of villains carries a dose of false comfort, implicitly affirming the assumption that someone must have fouled up to create such a menace to privacy and commerce; someone must have failed in a readily identifiable way, because this surely can't be the ordinary state of events. But the blame narrative masks an unsettling question: What if Sony did the best it could to protect itself, and the pirates still won? What if the company employed the best defenses available, yet they proved inadequate in the face of a decentralized and proliferating threat?

Sony has captured headlines because it is one of the world's most conspicuous consumer brands, and the recent attacks on its network have been both brazen and successful. But the list of companies that have been targeted by similar plots is lengthy and growing. Last month, the online marketing giant Epsilon confirmed that hackers made off with personal files relating to customers of Best Buy and J.P. Morgan Chase, among other firms. In February, officials at Nasdaq, the giant stock exchange, confirmed that hackers penetrated servers used to handle communications for some 300 major corporations. The breach did not affect stock trading, and resulted in no stealing of customer data, Nasdaq said.

Congress and assorted government offices collectively absorb 1.8 billion cyber attacks each month, according to Senate Sergeant-At-Arms Terrance Gainer, as cited by Politico. Over the last five months of 2009 alone, some 87 Senate offices and 13 Senate committees were on the receiving end of emails that contained malicious files, the Politico story detailed.

Russian hackers have been implicated in penetrating Citibank ATM systems to make off with cash.
Last week, as the House Subcommittee on Commerce, Manufacturing and Trade convened to probe the public's vulnerability to cybersecurity breaches, Rep. Mary Bono Mack (R-Calif.) kicked off the proceedings with some eye-catching numbers: In April alone, some 100 million records were put at risk through 30 data breaches at hospitals, insurance companies, universities, banks, airlines and government offices.

The hearing she oversaw was part of a public flaying faced by Sony in the wake of disclosures about the penetration of its popular PlayStation gaming network -- an episode Bono Mack referred to as "the great Brinks robbery of cyber-attacks." Far be it from anyone to dismiss the curative powers of an old-fashioned Washington flaying, but the search for simple villains seems misguided, as if more about sowing feelings of greater security than actual delivering it.

more to read here: Sony Hack Speaks To Proliferating Threat | RSS World Latest News
See how unsafe WE all are? Its not only Sony.


I think a lot of the blame has to come from the total collapse of US IT and computer job markets. There were more people officially working in IT in 1970 then there was in 2010. Where did all those computer egg heads and professionals go? Of course they turned to hacking and the underground cyber criminal market. There are more hackers than there are people fighting against them. The people who actually built the internet are ripping it down piece by piece. They are winning because they out number corporate and government IT departments. This is a war we cannot win unless things change.
User avatar
Novus
Intermediate Crude
Intermediate Crude
 
Posts: 2450
Joined: Tue 21 Jun 2005, 03:00:00

Re: Hackers: Public enemy #1

Unread postby Keith_McClary » Wed 11 May 2011, 22:59:01

The auto companies became more safety conscious when they were held liable for accidents. I don't think companies are made responsible for customers' losses due to identity theft. I don't understand the legalities - it is similar to the situation with software bugs, they are treated differently from other product defects.

Also, system administration has been automated so you don't have to hire an IT guru, anyone can do it. They can set security to "low", "medium" or "high". Of course, on "high" you get lots of complaints from users about things not working, set it to "medium" or "low" so everything works.
Facebook knows you're a dog.
User avatar
Keith_McClary
Light Sweet Crude
Light Sweet Crude
 
Posts: 7344
Joined: Wed 21 Jul 2004, 03:00:00
Location: Suburban tar sands

Re: Hackers: Public enemy #1

Unread postby Novus » Wed 11 May 2011, 23:31:08

It is not as simple as that. Even the IT gurus are getting their asses handed to them by the hackers. The website Lastpass which sells bulletproof password protection itself got hacked last week. If they can't protect their own bread and butter then there is a real problem going on.


The hackers are also getting more organized. They are organizing into hacker gangs and online hacker syndicates. It is no longer that lone wolf kid acting independently. When websites and companies are targeted they get hit with hundreds of different attacks at once from different sources. It is like the difference between dealing with a punk teen vandal and fighting Al-Quada or the Mexican drug cartel. One is simply a nuisance and the other is a public menace.
User avatar
Novus
Intermediate Crude
Intermediate Crude
 
Posts: 2450
Joined: Tue 21 Jun 2005, 03:00:00

Re: Hackers: Public enemy #1

Unread postby rangerone314 » Wed 11 May 2011, 23:55:12

Maybe treat the hackers like terrorists and render them to some East European prison, and waterboard them for the next 40 years, might de-motivate them.

That or stick the nerds in a prison cell with lonely 300-lb Bubba for life.
An ideology is by definition not a search for TRUTH-but a search for PROOF that its point of view is right

Equals barter and negotiate-people with power just take

You cant defend freedom by eliminating it-unknown

Our elected reps should wear sponsor patches on their suits so we know who they represent-like Nascar-Roy
User avatar
rangerone314
Light Sweet Crude
Light Sweet Crude
 
Posts: 4105
Joined: Wed 03 Dec 2008, 04:00:00
Location: Maryland

Re: Hackers: Public enemy #1

Unread postby Keith_McClary » Thu 12 May 2011, 00:50:48

rangerone314 wrote:Maybe treat the hackers like terrorists and render them to some East European prison, and waterboard them for the next 40 years, might de-motivate them.

That or stick the nerds in a prison cell with lonely 300-lb Bubba for life.
Image
Facebook knows you're a dog.
User avatar
Keith_McClary
Light Sweet Crude
Light Sweet Crude
 
Posts: 7344
Joined: Wed 21 Jul 2004, 03:00:00
Location: Suburban tar sands

Re: Hackers: Public enemy #1

Unread postby evilgenius » Thu 12 May 2011, 12:09:42

Are you up in arms about a perceived fundamental shift or some outlying circumstances? Don't forget that hacking on the level you are describing is very expensive. Usually only foreign governments can afford to hack on that level. Now, perhaps there are some out of work techies that are using proprietary information to do certain things, until the networks respond and that information is of no use anymore, but even if that is the case doing something rash like changing the legal structure in response might be bad for the rest of us.
When it comes down to it, the people will always shout, "Free Barabbas." They love Barabbas. He's one of them. He has the same dreams. He does what they wish they could do. That other guy is more removed, more inscrutable. He makes them think. "Crucify him."
User avatar
evilgenius
Intermediate Crude
Intermediate Crude
 
Posts: 3731
Joined: Tue 06 Dec 2005, 04:00:00
Location: Stopped at the Border.

Re: Hackers: Public enemy #1

Unread postby Novus » Thu 12 May 2011, 14:37:55

With over a 100 million credit cards compromised by hackers if they take just $1 from each of them then they stole $100 million. In aggregate we not talking small change here. This is money the courts or the banks will never be able to track down because they are woefully behind the times. The thing is it doesn't stop with just taking a few dollars. That is simply the seed money that is financing the rise of the hacker syndicates. The personal information such as full name, address, birth date, Social Security numbers are very valuable on the black market and can be used for a variety of malicious acts from ID theft, credit fraud, and human smuggling.
User avatar
Novus
Intermediate Crude
Intermediate Crude
 
Posts: 2450
Joined: Tue 21 Jun 2005, 03:00:00

Re: Hackers: Public enemy #1

Unread postby ColossalContrarian » Thu 12 May 2011, 14:44:45

Novus wrote:It is not as simple as that. Even the IT gurus are getting their asses handed to them by the hackers. The website Lastpass which sells bulletproof password protection itself got hacked last week. If they can't protect their own bread and butter then there is a real problem going on.


The hackers are also getting more organized. They are organizing into hacker gangs and online hacker syndicates. It is no longer that lone wolf kid acting independently. When websites and companies are targeted they get hit with hundreds of different attacks at once from different sources. It is like the difference between dealing with a punk teen vandal and fighting Al-Quada or the Mexican drug cartel. One is simply a nuisance and the other is a public menace.


Too true, IT is my job and a lot of companies have been outsourcing to me lately. One thing I've noticed is the huge uptick in virus and malware activity over the past 18months. They're getting nastier and nastier. The worst part is that most end users don't realize the damage viruses can do and the fact that many hackers use infected machines to get private information. The virus is really just a tool used to open the door for the hacker, a Trojan horse if you will.

Bot Nets are getting bigger and more organized. Do I even need to bring up STUXNET?
ColossalContrarian
Heavy Crude
Heavy Crude
 
Posts: 1374
Joined: Tue 20 Jun 2006, 03:00:00

Re: Hackers: Public enemy #1

Unread postby FairMaiden » Thu 12 May 2011, 22:23:05

Why is best buy even keeping customer data and information? Are you talking about buying stuff online? Otherwise, there is no good reason why they would have my personal visa # and name on there system?

So what if they steal $1...did you know Visa and Mastercard steal a lot more than that? Yeah, they round down every time...so they collect .005 or whatever from all their customers. Plus, they will charge you FULL interest if you do not pay your balance in full. Sounds reasonable? Well, let's just say I hit the wrong button while paying my bill at an ATM machine and missed the correct amount by one penny. I was charged $50 interest on ONE PENNY.

Yet let's call ppl who are attacking Sony terrorists...did they even steal anything? I always here these stories and never hear of the fallout. Maybe if I wrapped my mind around that, I'd be a little more concerned. But for now, I don't really care at all. Why would anyone want to hack my computer? So they can read my latest post here or hijack my nic? Go ahead...read my latest poem while you're at it...I dont' have my address, name or any relevant info on my computer...
User avatar
FairMaiden
Lignite
Lignite
 
Posts: 368
Joined: Thu 11 Aug 2005, 03:00:00
Location: Vancouver, BC

Re: Hackers: Public enemy #1

Unread postby ColossalContrarian » Thu 12 May 2011, 23:04:56

FairMaiden wrote:Why is best buy even keeping customer data and information? Are you talking about buying stuff online? Otherwise, there is no good reason why they would have my personal visa # and name on there system?

So what if they steal $1...did you know Visa and Mastercard steal a lot more than that? Yeah, they round down every time...so they collect .005 or whatever from all their customers. Plus, they will charge you FULL interest if you do not pay your balance in full. Sounds reasonable? Well, let's just say I hit the wrong button while paying my bill at an ATM machine and missed the correct amount by one penny. I was charged $50 interest on ONE PENNY.

Yet let's call ppl who are attacking Sony terrorists...did they even steal anything? I always here these stories and never hear of the fallout. Maybe if I wrapped my mind around that, I'd be a little more concerned. But for now, I don't really care at all. Why would anyone want to hack my computer? So they can read my latest post here or hijack my nic? Go ahead...read my latest poem while you're at it...I dont' have my address, name or any relevant info on my computer...


I think you're missing the point dear. "Hackers" aren't all organized and on the same side.

Governments hack, teens hack, wifes and husbands hack, employees hack, corporations hack, a lot of hacking goes on by people who aren't always after the same thing.
ColossalContrarian
Heavy Crude
Heavy Crude
 
Posts: 1374
Joined: Tue 20 Jun 2006, 03:00:00

Re: Hackers: Public enemy #1

Unread postby Novus » Thu 12 May 2011, 23:36:53

FairMaiden wrote:Why is best buy even keeping customer data and information? Are you talking about buying stuff online? Otherwise, there is no good reason why they would have my personal visa # and name on there system?


They use a unified database. There is no difference as far as Best Buy is concerned whether you buy online or in store. There cash registers aren't even cash registers but computers with credit card readers attached. One time I was in a Best Buy and insisted on paying with real cash. The clerk looked at me like I had two heads because he didn't have a cash drawer to handle cash purchases. Had to have a supervisor come out and pay with the cash. I also declined to fill out personal info for their rewards card. This was before the hack so I am glad my paranoia paid off.

So what if they steal $1...did you know Visa and Mastercard steal a lot more than that? Yeah, they round down every time...so they collect .005 or whatever from all their customers. Plus, they will charge you FULL interest if you do not pay your balance in full. Sounds reasonable? Well, let's just say I hit the wrong button while paying my bill at an ATM machine and missed the correct amount by one penny. I was charged $50 interest on ONE PENNY.

Yet let's call ppl who are attacking Sony terrorists...did they even steal anything? I always here these stories and never hear of the fallout. Maybe if I wrapped my mind around that, I'd be a little more concerned. But for now, I don't really care at all. Why would anyone want to hack my computer? So they can read my latest post here or hijack my nic? Go ahead...read my latest poem while you're at it...I dont' have my address, name or any relevant info on my computer...


Hackers crack into individual computers for two reasons. First with key loggers to capture pass words to gain access to your bank and credit. If you ever typed your name or SS on your keyboard the key loggers will capture all of that even if you don't save it. The hackers will steal anything you ever typed. Secondly they will take over your PC as a zombie machine which will later be used in large scale attacks such as the one against Sony. Once the hackers have access to millions of PCs it was easy for them to turn those PCs into attack platforms to launch massive attack on a single network.
User avatar
Novus
Intermediate Crude
Intermediate Crude
 
Posts: 2450
Joined: Tue 21 Jun 2005, 03:00:00

Re: Hackers: Public enemy #1

Unread postby FairMaiden » Fri 13 May 2011, 16:02:33

See, there is my point. I don't have my bank information on my computer nor do I log into my bank account via the internet. Period. Plus, I don't EVER type my SS into my computer for any reason - why would I ever need to do that??

As to the Best Buy thing, they only get my credit card # if I pay for my purchase that way. They don't have my name attached to it. I did have my CC# stolen once by hackers. The CC company called me to tell me it was compromised and it was cancelled. I was mailed a new card with new # within 3 days. No big inconvienence.

I didn't miss the point. Hackers can only get the information we type into computers. If it such a big war or deal than stop doing that. Companies should NOT be keeping my personal info in any database. Privacy laws make it illegal here in Canada...
User avatar
FairMaiden
Lignite
Lignite
 
Posts: 368
Joined: Thu 11 Aug 2005, 03:00:00
Location: Vancouver, BC

Re: Hackers: Public enemy #1

Unread postby Expatriot » Fri 13 May 2011, 16:42:43

BTW - just want to throw out that the word "hacker" conjures images of guys running covert code from furtive locations.

A hacker is just some guy who got a password he's not supposed to have. With modern encryption, it's never about "hacking in;" it's always about a stolen password.
User avatar
Expatriot
Lignite
Lignite
 
Posts: 370
Joined: Wed 21 Jul 2010, 11:57:52

Re: Hackers: Public enemy #1

Unread postby Ferretlover » Fri 13 May 2011, 16:46:08

Novus wrote: The personal information such as full name, address, birth date, Social Security numbers are very valuable on the black market and can be used for a variety of malicious acts ...

Isn't that the same info that the TSA wants? Oops, sorry! Off-topic!
"Open the gates of hell!" ~Morgan Freeman's character in the movie, Olympus Has Fallen.
Ferretlover
Elite
Elite
 
Posts: 5852
Joined: Wed 13 Jun 2007, 03:00:00
Location: Hundreds of miles further inland

Re: TSA Follies Thread (merged)

Unread postby Keith_McClary » Mon 20 Apr 2015, 03:17:23

Not TSA, but this is an ongoing computer security issue. Computer and software makers rush to market with shoddy vulnerable products. "White hat" security experts find flaws in them and notify the manufacturers, but nothing is done to fix them. If the experts go public, they are denounced as criminals or terrorists. Of course, it is only a matter of time until the "black hat" hackers find the flaws.

Now that networked systems are being used in cars, planes and medical applications this becomes a life or death issue.
Researcher denied flight after tweet poking United security
United Airlines stopped a prominent security researcher from boarding a California-bound flight late Saturday, following a social media post by the researcher days earlier suggesting the airline's onboard systems could be hacked.
The researcher, Chris Roberts, attempted to board a United flight from Colorado to San Francisco to speak at a major security conference there this week, but was stopped by the airline's corporate security at the gate. Roberts founded One World Labs, which tries to discover security risks before they are exploited.
Roberts had been removed from a United flight on Wednesday by the FBI after landing in Syracuse, New York, and was questioned for four hours after jokingly suggesting on Twitter he could get the oxygen masks on the plane to deploy. Authorities also seized Roberts' laptop and other electronics, although his lawyer says he hasn't seen a search warrant.
A lawyer for Roberts said United gave him no detailed explanation Saturday why he wasn't allowed on the plane, saying instead the airline would be sending Roberts a letter within two weeks stating why they wouldn't let him fly on their aircraft.
"Given Mr. Roberts' claims regarding manipulating aircraft systems, we've decided it's in the best interest of our customers and crew members that he not be allowed to fly United," airline spokesman Rahsaan Johnson told The Associated Press. "However, we are confident our flight control systems could not be accessed through techniques he described."
When asked what threat Roberts posed if United's systems couldn't be compromised, Johnson said Sunday: "We made this decision because Mr. Roberts has made comments about having tampered with aircraft equipment, which is a violation of United policy and something customers and crews shouldn't have to deal with."
Johnson said the airline reached Roberts several hours before his flight to tell him he couldn't fly. But a lawyer for Roberts said Sunday that when his client received that call, the caller would only say he or she was from United, and wouldn't give Roberts a name or callback number. When Roberts then tried calling the number back from his phone's caller ID, it rang instead to a resort hotel, and Roberts assumed it was a prank call, Roberts' lawyer said.
In recent weeks, Roberts gave media interviews in which he discussed airline system vulnerabilities. "Quite simply put, we can theorize on how to turn the engines off at 35,000 feet and not have any of those damn flashing lights go off in the cockpit," he told Fox News.
Roberts also told CNN he was able to connect to a box under his seat at least a dozen times to view data from the aircraft's engines, fuel and flight-management systems.
"It is disappointing that United refused to allow him to board, and we hope that United learns that computer security researchers are a vital ally, not a threat," said Nate Cardozo, a staff attorney with the San Francisco-based Electronic Frontier Foundation, which represents Roberts.
Cardozo said Sunday he hasn't seen a copy of a search warrant that would have been used to seize Roberts' electronics, and that he's working to get the devices returned.
The FBI declined to comment on the matter Sunday.
The Government Accountability Office said last week that some commercial aircraft may be vulnerable to hacking over their onboard wireless networks. "Modern aircraft are increasingly connected to the Internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems," its report found.
Roberts took an alternate flight on Southwest Airlines and arrived in San Francisco Saturday evening. He speaks this week at the RSA Conference about computer security vulnerabilities.
Facebook knows you're a dog.
User avatar
Keith_McClary
Light Sweet Crude
Light Sweet Crude
 
Posts: 7344
Joined: Wed 21 Jul 2004, 03:00:00
Location: Suburban tar sands

Re: Hackers: Public enemy #1

Unread postby davep » Mon 20 Apr 2015, 08:33:11

Hackers come in all shapes and sizes. Ethical hackers are there using the same tools as the bad guys (apart from nation states).

The problem isn't the hackers, it's the vulnerabilities in applications software, operating systems and firmware. And if ethical hackers didn't flag up these vulnerabilities they would continue to be used by the unethical ones to compromise systems.

The risk is that ethical hackers get put in the same basket as those less well intentioned (as above, where he demonstrated that there was no air-gap between in-flight systems available to passengers and control data), and that software vendors try to criminalise vulnerability investigations. That just leaves the software vulnerable and the ethical hacker facing a lawsuit. The only practical way forward is for software companies to embrace ethical hacking and allow payments for discovered vulnerabilities via the likes of HackerOne https://hackerone.com/.

We also need to address the complexity of low-level firmware such as UEFI bios, which is a nightmare and can sustain malware over multiple OS installations, delivering new payloads each time.

Basically, the whole industry needs to mature and architects need to see their whole infrastructure from a threat perspective as well as an administration perspective, using threat modelling.

What we don't need are hyperbolic headlines about "HACKERS!!!!" and subsequent bad law that helps corporations abdicate their responsibility to patch vulnerabilities as soon as possible.
What we think, we become.
User avatar
davep
Senior Moderator
Senior Moderator
 
Posts: 4578
Joined: Wed 21 Jun 2006, 03:00:00
Location: Europe

Re: TSA Follies Thread (merged)

Unread postby AgentR11 » Mon 20 Apr 2015, 08:56:08

Keith_McClary wrote:Not TSA, but this is an ongoing computer security issue. Computer and software makers rush to market with shoddy vulnerable products. "White hat" security experts find flaws in them and notify the manufacturers, but nothing is done to fix them. If the experts go public, they are denounced as criminals or terrorists. Of course, it is only a matter of time until the "black hat" hackers find the flaws.


There does not exist a piece of operational software that can be proven to lack vulnerabilities.

You can only test, find, and patch as the errors are found. Sometimes error conditions come into existence that didn't exist when the software was written. There is also a real cost / benefit analysis that has to be done. I have, safely locked away in my VM Ware workstation, running copies of NT 4.0 and Windows 2k. NT4 has a flat out, unpatchable, network service exploit. Fixing it would have required Microsoft to spend many man-months of time on an OS that was already deprecated. So, instead, you get a "to bad, so sad"; and "put it behind a hardware firewall if you must use it." type of response; and that response is not negligent in any way; it is correct.

As far as being "denounced". pish posh. If someone is going to touch the computer/network software security issue; they need skin thick enough to have millions of people angry at them at any particular time. Can't handle it? Don't go there.
Yes we are, as we are,
And so shall we remain,
Until the end.
AgentR11
Light Sweet Crude
Light Sweet Crude
 
Posts: 6374
Joined: Tue 22 Mar 2011, 09:15:51
Location: East Texas

Re: TSA Follies Thread (merged)

Unread postby davep » Mon 20 Apr 2015, 09:03:56

AgentR11 wrote:
There does not exist a piece of operational software that can be proven to lack vulnerabilities.

You can only test, find, and patch as the errors are found. Sometimes error conditions come into existence that didn't exist when the software was written. There is also a real cost / benefit analysis that has to be done. I have, safely locked away in my VM Ware workstation, running copies of NT 4.0 and Windows 2k. NT4 has a flat out, unpatchable, network service exploit. Fixing it would have required Microsoft to spend many man-months of time on an OS that was already deprecated. So, instead, you get a "to bad, so sad"; and "put it behind a hardware firewall if you must use it." type of response; and that response is not negligent in any way; it is correct.


Quite. The only way of ensuring there is no threat for a given piece of functionality is to remove that functionality. Apart from that, all we can do is mitigate threats and monitor on a constant basis.
What we think, we become.
User avatar
davep
Senior Moderator
Senior Moderator
 
Posts: 4578
Joined: Wed 21 Jun 2006, 03:00:00
Location: Europe

Re: Hackers: Public enemy #1

Unread postby davep » Wed 22 Apr 2015, 06:48:26

An outbreak of sanity! 'Aaron's Law' Introduced To Curb Overzealous Prosecutions For Computer Crimes

http://news.slashdot.org/story/15/04/21/2154218/aarons-law-introduced-to-curb-overzealous-prosecutions-for-computer-crimes

"Aaron’s Law would change the definition of 'access without authorization' in the CFAA so it more directly applies to malicious hacks such as sending fraudulent emails, injecting malware, installing viruses or overwhelming a website with traffic."
What we think, we become.
User avatar
davep
Senior Moderator
Senior Moderator
 
Posts: 4578
Joined: Wed 21 Jun 2006, 03:00:00
Location: Europe


Return to Open Topic Discussion

Who is online

Users browsing this forum: No registered users and 4 guests