Anonymous rapes "security" firm investigating them for WikiLeaks related DDoSing

[Phokus]

All hackers/malicious fucks should burn in a raging fire in hell.

Pretty stupid of the guy from HBGary Federal to go public, against anonymous though, when they CLEARLY were not prepared for it.

Why? Anonymous has been a thorn at the side of the Church of Scientology and now they're supporting wikileaks. Yeah, they do 'black hat' hacking, but they do it for a good cause.

 

[nageov3t]

All hackers/malicious fucks should burn in a raging fire in hell.

Pretty stupid of the guy from HBGary Federal to go public, against anonymous though, when they CLEARLY were not prepared for it.

can any amount of security and preparation really guard against simple human error, though, like giving out an unencrypted password over email (and especially without making sure the person on the other end is who they say they are)

 

[Homerboy]

can any amount of security and preparation really guard against simple human error, though, like giving out an unencrypted password over email (and especially without making sure the person on the other end is who they say they are)

Step #1 is firing the admin that opened the port in the exchanged emails. He should be gone and never find security employment again.

 

[lxskllr]

Step #1 is firing the admin that opened the port in the exchanged emails. He should be gone and never find security employment again.

Can you imagine what anon was thinking? "WTF!? I can't believe that worked!" :^D

 

[Homerboy]

Can you imagine what anon was thinking? "WTF!? I can't believe that worked!" :^D

Exactly. It probably started off as a joke "Just email and ask them to change the password"... "That's not going to work, who'd be dumb enough!??"... "Just try!"...."DERP!!!!!!!!!!!!!!!!!"

Though, any security training, instruction etc that you get, they ALWAYS point out that the weakest link is the operator. That through even a little "social networking" or whatever you want to call it, any security can be breeched.

 

[nageov3t]

Step #1 is firing the admin that opened the port in the exchanged emails. He should be gone and never find security employment again.

I work for a hosting company... I'm trying to think of what we'd do if a client submitted a ticket asking us to reset his server's password and open a port on his firewall, and I can't say that we wouldn't not do it. (of course, I don't work in either department that would handle that, so they may/probably have security measures that I'm unaware of)

obviously they'd need the password for their account portal to generate the ticket and we'd send the server password to them in an encrypted form, but if they hacked into the account's primary email address, they could go through the old "I forgot my password" password reset thing that every single website everywhere has.

 

[ViviTheMage]

can any amount of security and preparation really guard against simple human error, though, like giving out an unencrypted password over email (and especially without making sure the person on the other end is who they say they are)

We could go on and on all day about security, but if all anonymous needed was the root password ... they were definitely not prepared.

Hackers like this had to start somewhere, and I can guarantee you they don't, just do hacking for a 'good' cause.

 

[bignateyk]

I work for a hosting company... I'm trying to think of what we'd do if a client submitted a ticket asking us to reset his server's password and open a port on his firewall, and I can't say that we wouldn't not do it. (of course, I don't work in either department that would handle that, so they may/probably have security measures that I'm unaware of)

obviously they'd need the password for their account portal to generate the ticket and we'd send the server password to them in an encrypted form, but if they hacked into the account's primary email address, they could go through the old "I forgot my password" password reset thing that every single website everywhere has.

 

[Phokus]

I work for a hosting company... I'm trying to think of what we'd do if a client submitted a ticket asking us to reset his server's password and open a port on his firewall, and I can't say that we wouldn't not do it.

obviously they'd need the password for their account portal to generate the ticket and we'd send the server password to them in an encrypted form, but if they hacked into the account's primary email address, they could go through the old "I forgot my password" password reset thing that every single website everywhere has.

Why wouldn't you do something like have secret questions to recover the PW, like most websites do?

"What was the make of your first car?"

"Ford"

I mean, ok you probably want a more secure question as it might be possible to find something out like that through public records, but still...

 

[Phokus]

We could go on and on all day about security, but if all anonymous needed was the root password ... they were definitely not prepared.

Hackers like this had to start somewhere, and I can guarantee you they don't, just do hacking for a 'good' cause.

There are hackers that hack just for the sake of hacking, but Anonymous seems to be more about social activism. And yes, i think their causes are generally good.

 

[Homerboy]

what? It's your standard use of a triple negative. Very common

 

[ViviTheMage]

I work for a hosting company... I'm trying to think of what we'd do if a client submitted a ticket asking us to reset his server's password and open a port on his firewall, and I can't say that we wouldn't not do it. (of course, I don't work in either department that would handle that, so they may/probably have security measures that I'm unaware of)

obviously they'd need the password for their account portal to generate the ticket and we'd send the server password to them in an encrypted form, but if they hacked into the account's primary email address, they could go through the old "I forgot my password" password reset thing that every single website everywhere has.

What about a system that pipes in emails, as long as they look like they come FROM the client? Every system i've worked with does this...another loophole .

There are hackers that hack just for the sake of hacking, but Anonymous seems to be more about social activism. And yes, i think their causes are generally good.

I am all for ethical hacking, but we got burned a few months ago, so I am still bitter against them all.

 

[nageov3t]

Why wouldn't you do something like have secret questions to recover the PW, like most websites do?

"What was the make of your first car?"

"Ford"

I mean, ok you probably want a more secure question as it might be possible to find something out like that through public records, but still...

we may. I don't have a client login and my personal password can only be reset by an admin, so I've never actually seen what happens if a client has to go through the forgotten password bit.

 

[Phokus]

What about a system that pipes in emails, as long as they look like they come FROM the client? Every system i've worked with does this...another loophole .



I am all for ethical hacking, but we got burned a few months ago, so I am still bitter against them all.

How did you get burned? Anyway, ethical hacking means you hack based on the consent of the person/organization you're hacking. Anonymous does black hat hacking, but usually for good causes.

 

[SpatiallyAware]

They way they got that root pw is insane. That admin needs fired on the spot.


Even a small company should never reset a pw based simply on an email.

 

[AnonymouseUser]

All this will lead to is another round of FBI investigations and arrests, even bigger criminal charges, then more retaliation by Anonymous, and the cycle then repeats yet again. Is this really accomplishing anything useful?

Fixed, and no, it's not accomplishing anything. Anonymous is Legion.

 

[Dr. Zaus]

Best Fing tweet ever:

Does HBGary know that they got socially engineered by a 16-year-old girl and we got root access a second time just by pretending to be Ted?

 

[preslove]

I am all for ethical hacking, but we got burned a few months ago, so I am still bitter against them all.

Give us details, mang!

 

[FDF12389]

Love it

 

[ViviTheMage]

Give us details, mang!

We had to block all of South America for a few days ... we had some open holes apparently.

The hacker was demanding we give him free servers (he was emailing us), or he'd continue his malicious activities ... we eventually blocked him entirely...but he was very persistent.

My cisco guy actually traced down his home IP, and got him kicked off his local ISP in brazil, I was fucking surprised that they did that for us. :thumbsup:

tidbits from it :

- He was using @london.com - informed me he took over their mail server and was using it for his maliciousness
- He was also using MIT, Yale, Harvard, high end school servers for his maliciousness (ip sources he was coming from trailed through all of these school servers...all *nix servers)...also had some local brazil government servers.
- He was using our cisco switches to get in, and actually got in through our VPN router at one point


I could go into a lot more detail, but that's the run down.

 

[Phokus]

Holy pwnage this is what anonymous claimed to have done... how the hell did they wipe his ipad?

"entire control of all emails for the company of hbgary.com. we have full admin control of

"hbgaryfederal.com. we have wordpress control of hbgary.com

"all emails will be put up in a torrent.

"full access to all their finincials

"their ssns [social security numbers]

"their w2s [US tax reporting statement]

"their 1099s [US tax identification certificate]

"their software products

"their malware data (although Anonymous rm'd [deleted] their entire terabyte of data sorry)

"their backup server was wiped.

"access to their pbx system via 8x8.com

"control of their support server and their clients logins

"root access to rootkit.com, personal website of greg hoglund

"aaron barr's ipad is now wiped"

http://www.guardian.co.uk/technology/2011/feb/07/anonymous-attacks-us-security-company-hbgary

http://www.guardian.co.uk/technology/2011/feb/07/anonymous-attacks-us-security-company-hbgary

 

[lxskllr]

Nooooo!!! Not the iPad! :'^(

 

[thepd7]

damn I hope I never get on those guys bad side.

 

[tk149]

So let me get this straight.

1. Douchebag claims he has inside info on hacking group. Possibly threatens to give/sell info to FBI.
2. Hacking group hacks his company email, twitter account, etc.
3. Hacking group finds that douchebag's company has NOTHING that can threaten said group.
4. Hacking group "retaliates" against "NOTHING" by posting personal private information, and company emails.

IMO, they should have just left it at hacking into the website and posting a message. Everything else was juvenile and criminal. They could easily have proven their claim to hacking the company emails by posting a just a select few.

This activity was not even debatably for the public good. It was just plain malicious and is a smack in the face to the "ethical" hackers.

 

[apac]

So let me get this straight.

1. Douchebag claims he has inside info on hacking group. Possibly threatens to give/sell info to FBI.
2. Hacking group hacks his company email, twitter account, etc.
3. Hacking group finds that douchebag's company has NOTHING that can threaten said group.
4. Hacking group "retaliates" against "NOTHING" by posting personal private information, and company emails.

IMO, they should have just left it at hacking into the website and posting a message. Everything else was juvenile and criminal. They could easily have proven their claim to hacking the company emails by posting a just a select few.

This activity was not even debatably for the public good. It was just plain malicious and is a smack in the face to the "ethical" hackers.

The way I see it, Anonymous is trying to defame and ruin the reputation of a "security" company. It's a much higher profile compromise if personal data is stolen and released than if the website was 'hacked'.

HBGary is very, very stupid for having ANY security holes and then antagonizing a hacker group. That's like stealing honeycomb and then just standing next to the hive. The bees are going to sting you.