ImageShack Hacked, Security Groups Threatened 288
Posted
by
Soulskill
from the a-picture's-worth-a-couple-hundred-words-or-so dept.
from the a-picture's-worth-a-couple-hundred-words-or-so dept.
revjtanton writes "Last night a group calling themselves 'Anti-Sec' hacked ImageShack, one of the largest image hosting sites on the web, and replaced many of the site's hosted pictures with one of their own, which detailed their manifesto. The group's grievance is against full-disclosure of exploits, an issue that was debated recently after a presentation on an ATM exploit was canceled. Anti-Sec simply wants the practice within security circles to end, and they've promised to cause 'mayhem and destruction' if it doesn't. These people are taking direct aim against a sector of the IT industry that is already armed to fight the ... but they also already know that. It should be interesting to see how this plays out."
Their message is certainly ironic, (Score:3, Insightful)
Leave door open or we will rob you ? (Score:4, Insightful)
From what I can understand from their manifest, they don't want full disclosure of exploits so
1) Other script kiddies cannot use them too easily
2) General public is not aware of the risks
3) Security companies cannot prepare protection against them
This is like... let's thing about proper, slashdot analogy... bunch of car thieves telling that they are against installing immobilizers in cars and warning they will steal cars of immobilizer producers and supporters till they stop distributing immobilizers. When they stop, thieves will come back to stealing random cars, with less effort.
Re:Wow (Score:5, Insightful)
Re:Wow (Score:4, Insightful)
...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?
Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.
Best pro full-disclosure advert ever (Score:4, Insightful)
This hack demonstrates exactly why we need full disclosure. If I used ImageShack to host important images for (e.g. a lot of people use it for blog images or forums) and someone figured out a way to hack in, I'd want to know about it so I can take steps to protect myself. What if someone uploaded child porn and it appeared on my forum?
It's always better to know than to stay ignorant. It might harm the companies behind affected products, but if it was a safety issue (e.g. your car can occasionally explode while filling it with petrol, which actually happened) there would be no question that full disclosure would be a good thing.
Easy to identify ? (Score:3, Insightful)
Their language and style sounds rather distinct. If other writings of them are available on the web, they should be easy to identify.
There's also quite a lot of text.
Stephan
Re:Wow (Score:5, Insightful)
If it's free speech, mind if I come and write graffiti on the side of your house? If you stop me, you're censoring my speech.
I'm not sure I get it (Score:4, Insightful)
In order to put an end to security consultants and companies spreading fear of being hacked in order to sell security oriented products and services, they will go on a reign of terror hacking everything that isn't secured to the nines? Uhmmmmmm. I'm not sure how that works.
Re:Wow (Score:5, Insightful)
I'm hoping.. (Score:3, Insightful)
I mean, it's mostly only big corps that are for "non-disclosure".. the rest of the free world wants to know!
Re:so, they'd rather? (Score:3, Insightful)
Not only is the exact opposite of the OSS mindset, I'd be willing to be that it is motivated by exactly what you describe. These are not people concerned about security, these are people who want exploits kept secret so they can sell them and use them--the morons posting here in support of this don't get it. These people are not your friends.
There are a number of well-documented cases of vendors being notified well in advance of publication, and those vendors doing nothing until after publication (in some cases the publication was only made because the vendor refused to do anything). Full disclosure forces lazy, cost-cutting corporations to improve their products when they would otherwise have no motivation to do so. The only people who benefit from non-disclosure are black hat criminals.
Re:Astalavista (Score:5, Insightful)
They're just a bunch of assholes, same as the punks who key cars.
Re:I'm not sure I get it (Score:4, Insightful)
It probably makes more sense if you are 15.
Re:Leave door open or we will rob you ? (Score:5, Insightful)
Except that history has shown that many software companies won't actually fix problems until forced to do so by full disclosure.
Re:Making the world a better place. (Score:5, Insightful)
They want to discourage full disclosure, because it means they won't get to abuse undisclosed vulnerabilities as freely as they currently do.
Let me put it to you in more immediate terms: If the BH presentation on ATM exploits goes through, it will trigger a much more rapid response to patch the problem, which means the true exploiters have less time to plunder. Now this is just one example... There are hundreds of high-risk exploits discovered every day, some of which were obviously used to hack into ImageShack. These kiddies are scared that full disclosure will take away their "toys".
Re:Leave door open or we will rob you ? (Score:2, Insightful)
Are you sat in front of a keyboard with full access to the internet ? This isn't a written dissertation, it's a live environment. Look around for yourself. You probably would only argue semantics if he had cited other instances.
Re:What is their motivation? (Score:1, Insightful)
I doubt that they are script kiddies.
They just want companies to stop showing people exploits, so companies that rip people off by offering protection can't continue.
Re:Wow (Score:2, Insightful)
Re:Astalavista (Score:4, Insightful)
Just follow the money ...
Re:Wow (Score:1, Insightful)
We can ask "Where do our rights end?" and the best answer I've ever heard was "When they infringe on other people's rights". You say a group hacking sites and bringing them down to display their message is free speech!? That's as far as free speech as you can get, imagine if you wanted to speak out against government, and they jailed you and said "Our freedom of expression says that we can express it by shutting you up" that's exactly what this group is doing, they're not communicating, they're trying to silence and overwrite messages, they want to restrict speech and curtail basic freedoms.
Indians that block major roadways make no attempt to eliminate the awareness of the opposition, only make theirs known. This group is not simply yelling, they're yelling and silencing, you don't just need good earplugs, cause when they take down a security blog, earplugs would be useless in undoing the "damage" they have done.
Re:Making the world a better place. (Score:5, Insightful)
I think full disclosure is a good motivation for companies to fix their stuff. Notify them you found a problem, what the problem is, and that you will make the exploit public after a certain (reasonable) period of time, whether they fix it or not.
Double Speak (Score:1, Insightful)
That "manifesto" is an obvious attempt at reverse psychology. Large corporations and governments would LOVE to eliminate full disclosure. Exploits and fixes will then become trade secrets and sold off at a premium to the richest customers that can afford the "Elite Protection Package".
The best disinfectant will always be sunshine, not shadows.
Re:I'm not sure I get it (Score:4, Insightful)
You may need to go younger, ever seen a toddler when mommy or daddy tells them "no"? They tend to pitch a fit, and try to break stuff.
These guys may be smart as hell, but they are little more than toddlers who can hack. They are definitely NOT worth paying attention to beyond what is necessary to track them down and put them in jail.
BTW, do you know what happens to guys like these when they get caught? After jail time, they are generally banned from computers. I.e. more jail time if they are caught using one. That's got to be a virtual death sentance for a hacker.
I'm not sure these guys thought this thing through, they are definitely public enough to be traceable. I hope they don't like where they live very much!
Re:Leave door open or we will rob you ? (Score:5, Insightful)
2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits
There's at least a couple large-scale problems with this viewpoint.
The most direct one is that knowing about the exploit, and knowing how to use the exploit aren't really as different as you try to make them out. How long do you think for "bad guys" to figure out the full picture if you released enough information for people to protect themselves? i.e. "disable function X of server product Y". Well shit, you just gave a HUGE clue to the "bad guys", but probably didn't really give ENOUGH information to enough of the "good guys". What about the guys relying on "function x of server y" who simply can't disable it?
Exploits are often esoteric sounding enough that companies can just claim (and often have) "that vulnerability is entirely theoretical". It's often the case that the exploit is VERY exploitable, but the developers or companies are just being arrogant, don't understand, or don't care. In a perfect world where companies and developers had perfect knowledge of exactly how exploitable and dangerous a vulnerability was (and addressed the ones that needed to be addressed) your idea would work. The real world has proven otherwise.
The third problem is simply that the companies/developers responsible for fixing the problem often don't suffer the costs (or a much lower cost) or people actually exploiting the vulnerability. i.e. Microsoft doesn't suffer enormous losses when the latest worm ravages the internet. Since they suffer a lot less pain, they'll devote a lot less resources to fixing it. If the exploit eventually will get out then company X will be a lot more likely to fix it rather than just ignoring it and hoping nobody else ever finds out.
3) These exploits would still be in the hands of the security companies so that they could prepare protection against them
Heh. Where does this view that there's always the mysterious people who are just going to fix everything come from? If you think "Security Companies" are going to save you, blah blah blah Bridge to sell.. blah blah blah swamp land in Florida.
No, what needs to happen is if security is important it needs to be built into the product to begin with. Security isn't a product you "buy", it's something you are. This is nothing different than what people have been saying for 20 years.
Re:Making the world a better place. (Score:4, Insightful)
I think l0pht's home page back in the day had it right when they quoted Microsoft as saying:
"That vulnerability is theoretical." -Microsoft
...which is one of my arguments for releasing POC code. Some folks need to be hit with a bigger clue-stick than others.
Re:Some observations (Score:1, Insightful)
1) The text was syntactically and grammatically near perfect....
From the message, I'm absolutey certain they're in America
Huh? You've got to be kidding. Syntactically and grammatically near perfect English almost rules out the author being American. The number of Americans who can speak or write English with the skill of a well-educated non-native speaker is vanishingly small. The non-native speaker is not disadvantaged from having spent a lifetime listening to what passes for English in America. The poor American has to first unlearn much of his or her speech patterns before they can being to learn proper English syntax and grammar.
Re:Making the world a better place. (Score:5, Insightful)
Wow. I don't think you understand what full disclosure is and what they are allegedly advocating.
Nope. He has it right, you have it 100% wrong. The ATM issue is a perfect example. That vulnerability was disclosed to the vendor eight months ago and they haven't done jack shit. Now the threat of full disclosure - to the entire world - has caused the vendor to get an injunction to prevent disclosure. Where is the fix? I still don't see a fix. Under your theory of "full disclosure is just another word for limited disclosure" the vendor would have fixed the problem long ago.
It rarely ever works like that and we have 30+ years of history to prove it - the security industry used to work the way you wish and the results were the same, vendors didn't do shit. The only time a fix comes is when the vendor knows that the only way to stop the script kiddies and all the serious blackhats is to actually fix the problem instead of sitting on it. Without at least the threat of true full disclosure vendors won't fix their problems, they don't have enough of an economic incentive to do so.
Providing the public with a warning that a vulnerability exists is not unethical and neither is providing information to the vendor but providing full exploit information is not only unethical but completely useless to the end user and places them at additional risk.
Without the threat of true full disclosure, nothing ever comes of limited disclosure. [schneier.com]
Re:Leave door open or we will rob you ? (Score:3, Insightful)
Because you are the only one (or member of a minority group) that apparently lacks the predominant knowledge of the statement's truth. If I state a fact that is common knowledge, I do not need to cite it. If you dispute that fact, it is your job to find corroborating evidence in defense of your stance, not mine.
Re:Leave door open or we will rob you ? (Score:3, Insightful)
Both Gandhi and Martin Luther King, Jr. constantly broke the law with their peaceful protests.
Peaceful protests may break the law, but they don't break many people's morals; destroying servers (if you read their site, you'll see a history of "rm -rf /"'s), even with the best of intentions, is much less morally sound.