Anonymous rapes "security" firm investigating them for WikiLeaks related DDoSing

[MarkXIX]

Mr. Barr was a moron, pure and simple. His so called "security" company was anything but a bunch of bumbling morons who were overpaid, save for the coder he had on hand. Someone send that guy a coupon for all you can eat tacos!

 

[Mark R]

They way they got that root pw is insane. That admin needs fired on the spot.

Even a small company should never reset a pw based simply on an email.

I've rang up a hospital before from outside, asked for IT. Spoken to tech support - Hi. I need a login and password for the Electronic Patient Record. I hadn't actually started work there, but was due to start on the 3rd day of a 3 day weekend. Given that there would be no way to do my job without access to the electronic record, and that IT support don't work weekends and holidays, I planned ahead about a week before I started.

- What's your username?
= Err. I don't have one. I need a new account
- What's your name?
- Mark R
- OK. What department do you work in?
- blah. blah
- I don't have a record of any account in your name. That's because I haven't started. I start on holiday Monday.
- Oh. OK then. I'll send a new password to your internal e-mail
- Oh. I don't think it's working, the account hasn't been set up. Can you send it to my hotmail?
- What's the address?
- asdfasdfasdf@hotmail.com

5 minutes later, login and password details arrive in my hotmail account.

 

[Gooberlx2]

I've rang up a hospital before from outside, asked for IT. Spoken to tech support - Hi. I need a login and password for the Electronic Patient Record. I hadn't actually started work there, but was due to start on the 3rd day of a 3 day weekend. Given that there would be no way to do my job without access to the electronic record, and that IT support don't work weekends and holidays, I planned ahead about a week before I started.

- What's your username?
= Err. I don't have one. I need a new account
- What's your name?
- Mark R
- OK. What department do you work in?
- blah. blah
- I don't have a record of any account in your name. That's because I haven't started. I start on holiday Monday.
- Oh. OK then. I'll send a new password to your internal e-mail
- Oh. I don't think it's working, the account hasn't been set up. Can you send it to my hotmail?
- What's the address?
- asdfasdfasdf@hotmail.com

5 minutes later, login and password details arrive in my hotmail account.

Insane. That would get a helpdesk person fired at my hospital. User account requests must be made by the departmental admin. No exceptions.

 

[bfdd]

I've rang up a hospital before from outside, asked for IT. Spoken to tech support - Hi. I need a login and password for the Electronic Patient Record. I hadn't actually started work there, but was due to start on the 3rd day of a 3 day weekend. Given that there would be no way to do my job without access to the electronic record, and that IT support don't work weekends and holidays, I planned ahead about a week before I started.

- What's your username?
= Err. I don't have one. I need a new account
- What's your name?
- Mark R
- OK. What department do you work in?
- blah. blah
- I don't have a record of any account in your name. That's because I haven't started. I start on holiday Monday.
- Oh. OK then. I'll send a new password to your internal e-mail
- Oh. I don't think it's working, the account hasn't been set up. Can you send it to my hotmail?
- What's the address?
- asdfasdfasdf@hotmail.com

5 minutes later, login and password details arrive in my hotmail account.

Social engineering is a powerful tool.

 

[AlienCraft]

it's true, unadulterated, information freedom. sure 90% of what they do is absolutely senseless and juvenile, but we really could be witnessing the start of another phase of democratic revolution here

:thumbsup:
We'll all be digging for Pringles cans to make the OLD school 801.11* antennas of yore if The Powers That Be decide to put a kill switch in. Granted, we'll only be networking locally unless anyone still has a dial up modem and cable to connect a cell phone. Welcome to Devolution... 14.4 kbs hiding in the fax signals. Wardriving on a Corporate wireless field like we used to do for fun.

Workers of The World, Unite!

 

[AlienCraft]

Home Depot used to leave default usernames/PWs on their Wireless Routers. Making the password "orange" wasn't that big of a stretch of the imagination.

 

[AnitaPeterson]

I would be more than happy to suggest - and document - a good target for Anonymous, for the sake of a good cause, and for social justice.

And I'm 100% serious.

 

[Phokus]

I would be more than happy to suggest - and document - a good target for Anonymous, for the sake of a good cause, and for social justice.

And I'm 100% serious.

Who?

 

[tk149]

I would be more than happy to suggest - and document - a good target for Anonymous, for the sake of a good cause, and for social justice.

And I'm 100% serious.

Anandtech Forums?

 

[Lithium381]

Are there any large scale attacks such as this one documented anywhere? I've never seen one happen and would be interested to see the production and how it's orchestrated. I have read short articles about "they laucnhed a ddos attack to bring the servers to their knees" but that's about as in depth as it goes..... i'm interested in a full write up, play by play action.

 

[Zargon]

dude got what he deserved for sure.

should serve as a warning to others

 

[yh125d]

Are there any large scale attacks such as this one documented anywhere? I've never seen one happen and would be interested to see the production and how it's orchestrated. I have read short articles about "they laucnhed a ddos attack to bring the servers to their knees" but that's about as in depth as it goes..... i'm interested in a full write up, play by play action.

someone else summed it up pretty well

Anonymous: "I can haz password?"
Sys Admin: "sure lol"
Anonymous: "and i can haz firewall downs?"
Sys Admin: "yup lol"

 

[AMDZen]

poned

 

[Gooberlx2]

Are there any large scale attacks such as this one documented anywhere? I've never seen one happen and would be interested to see the production and how it's orchestrated. I have read short articles about "they laucnhed a ddos attack to bring the servers to their knees" but that's about as in depth as it goes..... i'm interested in a full write up, play by play action.

I remember reading this a long time ago. I'm sure much of it is out of date now, but it's still interesting.

 

[cronos]

Are there any large scale attacks such as this one documented anywhere? I've never seen one happen and would be interested to see the production and how it's orchestrated. I have read short articles about "they laucnhed a ddos attack to bring the servers to their knees" but that's about as in depth as it goes..... i'm interested in a full write up, play by play action.

There were some 'white hat' hackers who got attacked and taken down by the 'black hats' sometime last year. They did release a pretty elaborate 'play by play' on the whole process and it was a really good read. I can't remember where I found this though.

 

[wheresmybacon]

Barr is a fool. Naive much? What did he think was going to happen?

 

[shortylickens]

I love their new home page. They are so utterly full of shit its funny.
http://www.hbgary.com/

 

[jacc1234]

I love their new home page. They are so utterly full of shit its funny.
http://www.hbgary.com/

I really enjoy their testimonials from "Big Consulting Company" and "Top 10 Financial Institution". LOL

 

[lxskllr]

I love their new home page. They are so utterly full of shit its funny.
http://www.hbgary.com/

I wonder why they didn't mention the site attack in "Recent News". That's certainly newsworthy, right? I know it's been all over the sites I read :^D

 

[bignateyk]

I really enjoy their testimonials from "Big Consulting Company" and "Top 10 Financial Institution". LOL

Don't forget about "Research Organization"

 

[Patterner]

Are there any large scale attacks such as this one documented anywhere? I've never seen one happen and would be interested to see the production and how it's orchestrated. I have read short articles about "they laucnhed a ddos attack to bring the servers to their knees" but that's about as in depth as it goes..... i'm interested in a full write up, play by play action.

Not as large scale, but The Cuckoo's Egg by Cliff Stoll is a good read in this subject area.

 

[AnonymouseUser]

I love their new home page. They are so utterly full of shit its funny.
http://www.hbgary.com/

We know that understanding the attacker and his methods is the only way to defeat him. This is the core strength of HBGary and why our technology and services outperform the competition. To us, it's personal.

This is what got them fucked the first time. I guess they haven't learned their lesson...

 

[bignateyk]

This is what got them fucked the first time. I guess they haven't learned their lesson...

Hopefully anonymous owns them again.

 

[Zargon]

do they not realize the company name sounds like a stupid bb/aim handle?

I better go change my consulting company name to XGZargon

 

[jacc1234]

The plot thickens. Seems that HBGarry was meeting with Bank of America to create a campaign to discredit wikileaks and their supports. They were trying to go on the offensive to help discredit them before the release of sensitive info about BOA.

You can read more here:
http://www.thetechherald.com/articl...roposed-a-systematic-attack-against-WikiLeaks

And here:
http://www.salon.com/news/wikileaks/index.html?story=/opinion/greenwald/2011/02/11/campaigns