Forgot your password?
typodupeerror
Security

ImageShack Hacked, Security Groups Threatened 288

Posted by Soulskill
from the a-picture's-worth-a-couple-hundred-words-or-so dept.
revjtanton writes "Last night a group calling themselves 'Anti-Sec' hacked ImageShack, one of the largest image hosting sites on the web, and replaced many of the site's hosted pictures with one of their own, which detailed their manifesto. The group's grievance is against full-disclosure of exploits, an issue that was debated recently after a presentation on an ATM exploit was canceled. Anti-Sec simply wants the practice within security circles to end, and they've promised to cause 'mayhem and destruction' if it doesn't. These people are taking direct aim against a sector of the IT industry that is already armed to fight the ... but they also already know that. It should be interesting to see how this plays out."
This discussion has been archived. No new comments can be posted.

ImageShack Hacked, Security Groups Threatened

Comments Filter:
  • by Anonymous Coward on Saturday July 11, 2009 @11:27AM (#28660325)
    in a "shoot the innocent bystander while sounding all righteous about risk" sort of way.
    • I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.

      Is this just another way of the internet evolving itself? If you're an asshole or are part of a company which fucks someones shit up for profit, then in that potential future you'd be vulnerable to backlash. This isn't the chaos ensuing from giving automatic weapons

      • by Artifakt (700173)

        Eradicating the script kiddies really sounds like a worthwhile goal in itself, but you're right, it doesn't really make the net any more secure or functional to trim off the low hanging fruit. This looks to be a lone black hat who wants it to appear he falls somewhere in the legitimately gray areas, but really is well over any ethical lines. I suspect the whole presentation of there being a group that stands behind the defacement is itself also false.

        • Possibly - anonymous itself could just be three guys in a basement. Then again, it could have started off in a single basement but grew because of the insinuation that it was a large distributed, anonymous organisation.

          Both/and?

          If the internet automatically detects censorship as damage and routes around it, we're going to be seeing larger and more intricate self-defence mechanisms as it moves from a simple chaotic knowledge-base towards sentience.

          Doesn't matter if you don't believe it, the internet will jus

      • by Nursie (632944)

        Why would eradicate the script kids?
        They wouldn't have as ready a source of info to make their scripts with, but I don't get the feeling they'd be the ones making the scripts anyway. Their scripts come from black hats that have skills.

        Frankly all this would do is mean that companies *cough* MS *cough* could get away with not patching stuff for longer, leaving things even more vulnerable. It's lunacy what they're asking for.

        • If these black-hats win, they'll not be giving shit to the script-kiddies. Period.

          Lunacy is what we have already[1]. Reality is a bit more relative.

          1 - Doing the same thing again and again, expecting different results. Buying the latest firewall or virus software has never, and will never be a guarantee of security.

      • by _Sprocket_ (42527)

        I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.

        It goes back to an amplified version of the old BBS philez [textfiles.com] days. Except now they're not historical curiosities but relevant instructions as the exploits they describe remain current. At least, for a short while.

        Since we're not falling back to the old analog MODEM days, but remaining here in the current Internet era, these tutorials will be just as distributed as they are now. They'll be fed in to the underground community instead of the general public. But in the Internet era, that underground community

        • Re: (Score:3, Interesting)

          by fictionpuss (1136565)

          If you discover another zero-day root exploit in the Linux kernel on your own, and you have the means to sell it to the highest bidder for a nice pile of cash, then neither you nor the winner have a motivation to pass on that secret to the underground.

          If there are fewer active vulnerabilities floating in the underground - accounting for accidental or the occasional intentional leak - then how is that more chaotic than what we have now?

          I'm curious - I'm not an expert in this stuff by any means.

          Oh wait, this

      • Re: (Score:3, Interesting)

        by Bert64 (520050)

        What would happen, is that the prevalence of unskilled script kiddies would massively decrease, and the background scans taking place constantly would decrease... Because the perceived threats would have abated, people wouldn't bother installing updates or taking any measures to protect themselves. Also without public disclosure and/or active exploitation, software vendors would downplay the seriousness of their vulnerabilities and delay providing patches for them.

        The end result of this, is that the smaller

  • by neilobremski (1344051) on Saturday July 11, 2009 @11:28AM (#28660331) Homepage
    ... of their movement?
    • Re: (Score:2, Funny)

      by ILuvRamen (1026668)
      well not exactly but wouldn't it be funny is someone did publish the exploit they used to hack imageshack? :-P
  • by Anonymous Coward

    These are the same people who say they've found an exploit in some versions of openssh. Any connection?

    http://seclists.org/fulldisclosure/2009/Jul/0028.html

    http://news.ycombinator.com/item?id=692036

    http://lwn.net/Articles/340483/

  • Astalavista (Score:5, Informative)

    by Spyware23 (1260322) on Saturday July 11, 2009 @11:30AM (#28660357) Homepage

    For interested readers; these were the same people who killed astalavista. (Logs of that attack can be found all over the internet if you google).

    • Re: (Score:2, Troll)

      by liquidpele (663430)
      Then they should put their money where there mouth is, and disclose the privilege escalation method they used in that case.
      • Re: (Score:3, Interesting)

        by Threni (635302)

        Hardly, given that they're anti-disclosure.

        • Re:Astalavista (Score:5, Insightful)

          by tomhudson (43916) <barbara...hudson@@@barbara-hudson...com> on Saturday July 11, 2009 @12:24PM (#28660887) Journal

          Hardly, given that they're anti-disclosure.

          ... but they ARE in favour of people p0wning sites - which requires disclosure of vulnerabilities - something they're against. Kind of contradictory ...

          They're just a bunch of assholes, same as the punks who key cars.

          • by alexhard (778254)

            No, one of the reasons they cite for their anti-full disclosure sentiments is that it allows hordes of script kiddies to "p0wn" sites.

          • ... but they ARE in favour of people p0wning sites - which requires disclosure of vulnerabilities - something they're against. Kind of contradictory ...

            Well, not if you look at it this way: They're not against finding and exploiting vulnerabilities. They're against sharing those vulnerabilities so that others can exploit them. Think of it like an anti-nuke treaty. The US has nukes and will not give them up, but we're dead against letting anyone else have them.

            They're just a bunch of assholes, same as th

  • by abies (607076) on Saturday July 11, 2009 @11:33AM (#28660377)

    From what I can understand from their manifest, they don't want full disclosure of exploits so
    1) Other script kiddies cannot use them too easily
    2) General public is not aware of the risks
    3) Security companies cannot prepare protection against them

    This is like... let's thing about proper, slashdot analogy... bunch of car thieves telling that they are against installing immobilizers in cars and warning they will steal cars of immobilizer producers and supporters till they stop distributing immobilizers. When they stop, thieves will come back to stealing random cars, with less effort.

    • by binkzz (779594) on Saturday July 11, 2009 @12:17PM (#28660827) Journal
      1) I think that's a good thing
      2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits
      3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

      I'm not sure how you came to your conclusions, I don't believe they are correct.
      • by whoever57 (658626) on Saturday July 11, 2009 @12:29PM (#28660931) Journal

        3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

        Except that history has shown that many software companies won't actually fix problems until forced to do so by full disclosure.

      • by Vellmont (569020) on Saturday July 11, 2009 @02:41PM (#28661983)


        2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits

        There's at least a couple large-scale problems with this viewpoint.

        The most direct one is that knowing about the exploit, and knowing how to use the exploit aren't really as different as you try to make them out. How long do you think for "bad guys" to figure out the full picture if you released enough information for people to protect themselves? i.e. "disable function X of server product Y". Well shit, you just gave a HUGE clue to the "bad guys", but probably didn't really give ENOUGH information to enough of the "good guys". What about the guys relying on "function x of server y" who simply can't disable it?

        Exploits are often esoteric sounding enough that companies can just claim (and often have) "that vulnerability is entirely theoretical". It's often the case that the exploit is VERY exploitable, but the developers or companies are just being arrogant, don't understand, or don't care. In a perfect world where companies and developers had perfect knowledge of exactly how exploitable and dangerous a vulnerability was (and addressed the ones that needed to be addressed) your idea would work. The real world has proven otherwise.

        The third problem is simply that the companies/developers responsible for fixing the problem often don't suffer the costs (or a much lower cost) or people actually exploiting the vulnerability. i.e. Microsoft doesn't suffer enormous losses when the latest worm ravages the internet. Since they suffer a lot less pain, they'll devote a lot less resources to fixing it. If the exploit eventually will get out then company X will be a lot more likely to fix it rather than just ignoring it and hoping nobody else ever finds out.


        3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

        Heh. Where does this view that there's always the mysterious people who are just going to fix everything come from? If you think "Security Companies" are going to save you, blah blah blah Bridge to sell.. blah blah blah swamp land in Florida.

        No, what needs to happen is if security is important it needs to be built into the product to begin with. Security isn't a product you "buy", it's something you are. This is nothing different than what people have been saying for 20 years.

    • Re: (Score:3, Funny)

      by Svartalf (2997)

      Good analogy- so it's not in keeping with the "proper, slashdot analogy" thinking.

      You have to do a **BAD** car analogy for it to be that.

      • by sqldr (838964)
        slashdot is like a ford focus. they're both, er, um, you can get green ford focuses.
      • Re: (Score:3, Informative)

        by Tycho (11893)

        OT: your sig "I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas"

        I assume you aren't going to try to deny that you are also a citizen of the United States of America at this point. Other people, now in jail, have tried not to pay income taxes and other federal taxes by claiming that they had renounced their US citizenship and were now just a citizen of the State of X, but not a US citizen any longer. None of these individuals actually successfully argued in court that th

        • Just to suck it up and pay your income taxes like everyone else.

          Yeah, just continue to be a slave. It's cool everyone's doing it!

          There are many stupid people in jail for many stupid things. Taking a stand, ANY stand, against people OWNING YOUR LABOR is not stupid.

    • Exactly. It sounds like straight out of the mouth of Zensursula [wikipedia.org], who enforced censorship and filtering of the net in Germany, to "fight against child porn", while is reality, it just results in a protective cover above the real child porn criminals.

    • by not_anne (203907)

      Respectfully, you're missing the point. Their point is that full disclosure helps the exploiters exploit more. Anti-sec is pointing out that there are two main ways that full disclosure is a bad thing:

      1. Full disclosure allows cut and paste script kiddies to wreak continual havoc with detailed and fully documented exploits from the whitehat security industry.

      2. The whitehat security industry (antivirus, firewalls, auditing services) profit hugely from full disclosure by scare tactics.

      They are pushing for ch

      • by Bigjeff5 (1143585)

        The ends don't justify the means. These are people willing to destroy other people's work to make their point, and it is not ethical. These guys have lost all right to take the moral high ground, and their arguments will now and forever be tainted with "Aren't these the guys who hacked Imageshack? Why the hell are we listening to them?"

        I'll take script kiddies over assholes like these any day. They may have valid points, but they sure as hell don't have my support, not now anyway. These jackasses are no

    • It'll be quite amusing to watch their dumb asses get drug off to prison if they actually carry out their threat of "destruction and mayhem." Cyber criminal types seem to forget that when it comes to criminal investigations, the bigger a target you make yourself the more likely you are to get caught. When you are just causing trouble, there just isn't enough care to really devote any resources to going after you. However if you do real damage, all of a sudden there's more interest. The more damage, the more

  • by carn1fex (613593) on Saturday July 11, 2009 @11:40AM (#28660447)
    These punks dont know who theyre messin with!! Me and my posse are put on our roller blades, spike our hair and take them out with our camouflage thirty three point six bee pee ess moh demz.
  • by trybywrench (584843) on Saturday July 11, 2009 @11:41AM (#28660469)
    What an effective way to distribute a message, hack one of the worlds most popular image hosting sites and replace all the images with your manifesto! Every site with an image linked back to imageshack would be displaying your message. Instant.global.audience. I'm not justifying what they did and I'm all for the feds handing out a beat down, afterall, the law is the law but man, what a good idea.
  • by AmiMoJo (196126) <mojo @ w orld3.net> on Saturday July 11, 2009 @11:48AM (#28660541) Homepage

    This hack demonstrates exactly why we need full disclosure. If I used ImageShack to host important images for (e.g. a lot of people use it for blog images or forums) and someone figured out a way to hack in, I'd want to know about it so I can take steps to protect myself. What if someone uploaded child porn and it appeared on my forum?

    It's always better to know than to stay ignorant. It might harm the companies behind affected products, but if it was a safety issue (e.g. your car can occasionally explode while filling it with petrol, which actually happened) there would be no question that full disclosure would be a good thing.

    • by EdZ (755139)

      If I used ImageShack to host important images

      Then you're a bit of a prat?

      • by AmiMoJo (196126)

        Do you think everyone has their own server which can withstand the traffic generated by images used on popular forums?

        I guess maybe you are the kind of prat who laughs at people for not investing vast amounts of time and money in 5-nines services, but I tend to just try and get on with my life and spend the money on more important things like food.

        • by EdZ (755139)
          Let's put it this way: If you have images that are actually important, then it's almost certain the site you're running has hosting where you should be placing these images. A forum avatar or a 'witty' animated signature image are not important images. Even assuming that image hosting alone is required, regardless of the site that links to them, then a paid service (e.g S3, where the hosting costs would be pennies per month) makes a lot more sense than a free ad-supported service if the images are actually
  • Easy to identify ? (Score:3, Insightful)

    by sugarmotor (621907) on Saturday July 11, 2009 @11:55AM (#28660615) Homepage

    Their language and style sounds rather distinct. If other writings of them are available on the web, they should be easy to identify.
    There's also quite a lot of text.

    Stephan

  • Yes, full disclosure can make things worse but some companies take an "out of sight, out of mind" approach to fixing exploits and if no one knows about it they don't fix it.

    But I'm not sure it's much better only having a few experts able to steal money and run bot nets over a longer period of time or a lot of clueless script kiddies doing it within a shorter period.
    • by Svartalf (2997)

      The biggest problem with this thinking is that the experts eventually sell the tech to the script kiddies to gain maximal value from the exploit. So, in this case, you have the worst of both worlds- they use it over a longer period of time AND then you have a lot of clueless script kiddies doing it over a medium period of time before the companies get pressured into fixing the damn thing in the first place.

      Security through obscurity is NOT an answer- as you pointed out, they typically don't fix it if they

  • Apparently they are against full disclosure of exploits, because this would lead to the cracks in the first place.

    Sounds to me like they are Microsoft PR workers in disguise. ^^

  • So rash (Score:2, Funny)

    by UnixUnix (1149659)
    They didn't even bother to Ask Slashdot :(
  • by sjames (1099) on Saturday July 11, 2009 @12:15PM (#28660787) Homepage

    In order to put an end to security consultants and companies spreading fear of being hacked in order to sell security oriented products and services, they will go on a reign of terror hacking everything that isn't secured to the nines? Uhmmmmmm. I'm not sure how that works.

    • by maxume (22995) on Saturday July 11, 2009 @12:27PM (#28660917)

      It probably makes more sense if you are 15.

      • by Bigjeff5 (1143585) on Saturday July 11, 2009 @02:31PM (#28661899)

        You may need to go younger, ever seen a toddler when mommy or daddy tells them "no"? They tend to pitch a fit, and try to break stuff.

        These guys may be smart as hell, but they are little more than toddlers who can hack. They are definitely NOT worth paying attention to beyond what is necessary to track them down and put them in jail.

        BTW, do you know what happens to guys like these when they get caught? After jail time, they are generally banned from computers. I.e. more jail time if they are caught using one. That's got to be a virtual death sentance for a hacker.

        I'm not sure these guys thought this thing through, they are definitely public enough to be traceable. I hope they don't like where they live very much!

  • I'm hoping.. (Score:3, Insightful)

    by slashkitty (21637) on Saturday July 11, 2009 @12:15PM (#28660801) Homepage
    that this is just some sort of reverse logic... because now, anyone wanting to hide details of sec exploits are thrown into the group of these "nasty hackers"..

    I mean, it's mostly only big corps that are for "non-disclosure".. the rest of the free world wants to know!

  • Guess the OpenSSH bug is real...

  • I'm confused.

    So they're a group of black-hat hackers? I assume this since, well, what they did qualifies as black hat hacking.

    So that would mean they WANT a less secure world, right? They don't want vulnerabilities fixed. They don't want people to know about them. They want less competition from script kiddies.

    But they're arguing against full disclosure in a way that makes it sound like they want a more secure world.

    Actually, that's Brilliant!

    It's almost like saying "I want more republicans in office, s

  • Some observations (Score:3, Informative)

    by rs79 (71822) <hostmaster@open-rsc.org> on Saturday July 11, 2009 @12:18PM (#28660843) Homepage

    1) The text was syntactically and grammatically near perfect. You don't often see that in these sorts of things.

    2) The cadence and style was sort of familiar. I was always able on usenet to identify forgeries not by the path, but by the way they were written. Any idiot can put words where they're not supposed to be, but very few people can wrote like somebody else.

    3) I posit that if they weren't good intentioned they'd have hacked DHS.

    It would not surprise me if this turned out to be a bunch of CS/security professors or the like, or their minions doing their work.

    From the message, I'm absolutey certain they're in America, and had either a very rigorous or British schooling.

  • So the average age of this group is apparently what, 15 or thereabouts?

  • The fact that they hacked ImageShack shows that there is a vulnerability, probably one that was exposed before. In terms of natural selection this is a good thing to make the severity of the vulnerability clear. I think it would be a good thing if this kind of attacks would happen more often to get a better relation to security situation overall, because many companies and individuals tend to ignore otherwise.

    Their message is complete bullocks tough. Full disclosure in combination with destructive exploitin
  • by bXTr (123510) on Saturday July 11, 2009 @02:31PM (#28661903) Homepage
    • This is a legitimate threat, and they're truly against full disclosure.
    • Or they're using reverse psychology and are for full disclosure.
    • Unless they're using reverse-reverse psychology and are really against full disclosure.
    • But maybe they're using reverse-reverse-reverse psychology and are really for full disclosure.
    • ...
    • Or they're just a bunch of script kiddies trying demonstrating their "l33t 5k1lz".
  • Is anyone else tremendously amused at the method these guys have chosen to get their message out? I don't necessarily disagree with them - specifically, I usually only believe in full disclosure being necessary when an exploit is already in use in the wild - but it seems to me that they're just going to polarize the debate against their own position. IT security geeks are notably stubborn, defiant, etc., and being attacked over this will only entrench them further in their position. And to add to this, the
  • by gr8dude (832945) on Saturday July 11, 2009 @06:05PM (#28663671) Homepage

    I think they are pro full-disclosure, and this action is just a pun.

    The message they are trying to get across is: "If you close your eyes, the world doesn't disappear. Here's an example of a hack, just to show you that vulnerabilities will continue to exist even if you don't make them public. Not only that, but there will also be people who will find them and use them, regardless of your will to make them public or not".

    The message is worded well, others noticed it too; I think the author is too intelligent to be so ignorant of the truth.

Prediction is very difficult, especially of the future. - Niels Bohr

Working...