ImageShack Hacked, Security Groups Threatened 288
revjtanton writes "Last night a group calling themselves 'Anti-Sec' hacked ImageShack, one of the largest image hosting sites on the web, and replaced many of the site's hosted pictures with one of their own, which detailed their manifesto. The group's grievance is against full-disclosure of exploits, an issue that was debated recently after a presentation on an ATM exploit was canceled. Anti-Sec simply wants the practice within security circles to end, and they've promised to cause 'mayhem and destruction' if it doesn't. These people are taking direct aim against a sector of the IT industry that is already armed to fight the ... but they also already know that. It should be interesting to see how this plays out."
Their message is certainly ironic, (Score:3, Insightful)
What is their motivation? (Score:2)
I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.
Is this just another way of the internet evolving itself? If you're an asshole or are part of a company which fucks someones shit up for profit, then in that potential future you'd be vulnerable to backlash. This isn't the chaos ensuing from giving automatic weapons
Re: (Score:2)
Eradicating the script kiddies really sounds like a worthwhile goal in itself, but you're right, it doesn't really make the net any more secure or functional to trim off the low hanging fruit. This looks to be a lone black hat who wants it to appear he falls somewhere in the legitimately gray areas, but really is well over any ethical lines. I suspect the whole presentation of there being a group that stands behind the defacement is itself also false.
Re: (Score:2)
Possibly - anonymous itself could just be three guys in a basement. Then again, it could have started off in a single basement but grew because of the insinuation that it was a large distributed, anonymous organisation.
Both/and?
If the internet automatically detects censorship as damage and routes around it, we're going to be seeing larger and more intricate self-defence mechanisms as it moves from a simple chaotic knowledge-base towards sentience.
Doesn't matter if you don't believe it, the internet will jus
Re: (Score:2)
Why would eradicate the script kids?
They wouldn't have as ready a source of info to make their scripts with, but I don't get the feeling they'd be the ones making the scripts anyway. Their scripts come from black hats that have skills.
Frankly all this would do is mean that companies *cough* MS *cough* could get away with not patching stuff for longer, leaving things even more vulnerable. It's lunacy what they're asking for.
Re: (Score:2)
If these black-hats win, they'll not be giving shit to the script-kiddies. Period.
Lunacy is what we have already[1]. Reality is a bit more relative.
1 - Doing the same thing again and again, expecting different results. Buying the latest firewall or virus software has never, and will never be a guarantee of security.
Re: (Score:2)
I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.
It goes back to an amplified version of the old BBS philez [textfiles.com] days. Except now they're not historical curiosities but relevant instructions as the exploits they describe remain current. At least, for a short while.
Since we're not falling back to the old analog MODEM days, but remaining here in the current Internet era, these tutorials will be just as distributed as they are now. They'll be fed in to the underground community instead of the general public. But in the Internet era, that underground community
Re: (Score:3, Interesting)
If you discover another zero-day root exploit in the Linux kernel on your own, and you have the means to sell it to the highest bidder for a nice pile of cash, then neither you nor the winner have a motivation to pass on that secret to the underground.
If there are fewer active vulnerabilities floating in the underground - accounting for accidental or the occasional intentional leak - then how is that more chaotic than what we have now?
I'm curious - I'm not an expert in this stuff by any means.
Oh wait, this
Re: (Score:3, Interesting)
What would happen, is that the prevalence of unskilled script kiddies would massively decrease, and the background scans taking place constantly would decrease... Because the perceived threats would have abated, people wouldn't bother installing updates or taking any measures to protect themselves. Also without public disclosure and/or active exploitation, software vendors would downplay the seriousness of their vulnerabilities and delay providing patches for them.
The end result of this, is that the smaller
Re: (Score:2)
That's the stated goal. But all ideologies have at least one secondary goal which is of greater importance to the members - e.g. religions may preach love and peace, but will do anything (including contradicting the primary message) to protect the secondary goal of sustaining the religion.
Example - if they just manage to get all security companies out of business, then what's to stop new security companies popping up in the future once their movement starts to decay and their numbers drop? Nothing. It would
Re: (Score:2)
Or maybe the current situation is just a local maxima, which we are trapped in?
Every company out there has at least one person who re-uses passwords between systems. Even if it's "only" the admin or a temp - there only needs to be one weak link in the chain.
Security problems are an annoyance foremost, and rarely a disaster. 50% of the windows clients reading this thread could be part of some botnet and they'll never know.
Society as a whole needs to treat security with more respect in order to improve it. Ev
Re: (Score:2)
If that's their motivation, then they will fail.
History proves that bad ideas always poison themselves before too long. It's just simple evolution/ or rather emergence.
Is this considered full-disclosure ... (Score:3, Funny)
Re: (Score:2, Funny)
related to openssh rumors? (Score:2, Interesting)
These are the same people who say they've found an exploit in some versions of openssh. Any connection?
http://seclists.org/fulldisclosure/2009/Jul/0028.html
http://news.ycombinator.com/item?id=692036
http://lwn.net/Articles/340483/
Astalavista (Score:5, Informative)
For interested readers; these were the same people who killed astalavista. (Logs of that attack can be found all over the internet if you google).
Re: (Score:2, Troll)
Re: (Score:3, Interesting)
Hardly, given that they're anti-disclosure.
Re:Astalavista (Score:5, Insightful)
They're just a bunch of assholes, same as the punks who key cars.
Re: (Score:2)
No, one of the reasons they cite for their anti-full disclosure sentiments is that it allows hordes of script kiddies to "p0wn" sites.
Re:Astalavista (Score:4, Insightful)
Just follow the money ...
Re: (Score:3)
Well, not if you look at it this way: They're not against finding and exploiting vulnerabilities. They're against sharing those vulnerabilities so that others can exploit them. Think of it like an anti-nuke treaty. The US has nukes and will not give them up, but we're dead against letting anyone else have them.
Leave door open or we will rob you ? (Score:4, Insightful)
From what I can understand from their manifest, they don't want full disclosure of exploits so
1) Other script kiddies cannot use them too easily
2) General public is not aware of the risks
3) Security companies cannot prepare protection against them
This is like... let's thing about proper, slashdot analogy... bunch of car thieves telling that they are against installing immobilizers in cars and warning they will steal cars of immobilizer producers and supporters till they stop distributing immobilizers. When they stop, thieves will come back to stealing random cars, with less effort.
Re:Leave door open or we will rob you ? (Score:5, Informative)
2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits
3) These exploits would still be in the hands of the security companies so that they could prepare protection against them
I'm not sure how you came to your conclusions, I don't believe they are correct.
Re:Leave door open or we will rob you ? (Score:5, Insightful)
Except that history has shown that many software companies won't actually fix problems until forced to do so by full disclosure.
Re: (Score:2, Insightful)
Are you sat in front of a keyboard with full access to the internet ? This isn't a written dissertation, it's a live environment. Look around for yourself. You probably would only argue semantics if he had cited other instances.
Re: (Score:3, Insightful)
Because you are the only one (or member of a minority group) that apparently lacks the predominant knowledge of the statement's truth. If I state a fact that is common knowledge, I do not need to cite it. If you dispute that fact, it is your job to find corroborating evidence in defense of your stance, not mine.
Re:Leave door open or we will rob you ? (Score:5, Insightful)
2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits
There's at least a couple large-scale problems with this viewpoint.
The most direct one is that knowing about the exploit, and knowing how to use the exploit aren't really as different as you try to make them out. How long do you think for "bad guys" to figure out the full picture if you released enough information for people to protect themselves? i.e. "disable function X of server product Y". Well shit, you just gave a HUGE clue to the "bad guys", but probably didn't really give ENOUGH information to enough of the "good guys". What about the guys relying on "function x of server y" who simply can't disable it?
Exploits are often esoteric sounding enough that companies can just claim (and often have) "that vulnerability is entirely theoretical". It's often the case that the exploit is VERY exploitable, but the developers or companies are just being arrogant, don't understand, or don't care. In a perfect world where companies and developers had perfect knowledge of exactly how exploitable and dangerous a vulnerability was (and addressed the ones that needed to be addressed) your idea would work. The real world has proven otherwise.
The third problem is simply that the companies/developers responsible for fixing the problem often don't suffer the costs (or a much lower cost) or people actually exploiting the vulnerability. i.e. Microsoft doesn't suffer enormous losses when the latest worm ravages the internet. Since they suffer a lot less pain, they'll devote a lot less resources to fixing it. If the exploit eventually will get out then company X will be a lot more likely to fix it rather than just ignoring it and hoping nobody else ever finds out.
3) These exploits would still be in the hands of the security companies so that they could prepare protection against them
Heh. Where does this view that there's always the mysterious people who are just going to fix everything come from? If you think "Security Companies" are going to save you, blah blah blah Bridge to sell.. blah blah blah swamp land in Florida.
No, what needs to happen is if security is important it needs to be built into the product to begin with. Security isn't a product you "buy", it's something you are. This is nothing different than what people have been saying for 20 years.
Re: (Score:3, Funny)
Good analogy- so it's not in keeping with the "proper, slashdot analogy" thinking.
You have to do a **BAD** car analogy for it to be that.
Re: (Score:2)
Re: (Score:3, Informative)
OT: your sig "I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas"
I assume you aren't going to try to deny that you are also a citizen of the United States of America at this point. Other people, now in jail, have tried not to pay income taxes and other federal taxes by claiming that they had renounced their US citizenship and were now just a citizen of the State of X, but not a US citizen any longer. None of these individuals actually successfully argued in court that th
Re: (Score:2)
Just to suck it up and pay your income taxes like everyone else.
Yeah, just continue to be a slave. It's cool everyone's doing it!
There are many stupid people in jail for many stupid things. Taking a stand, ANY stand, against people OWNING YOUR LABOR is not stupid.
Re: (Score:2)
Exactly. It sounds like straight out of the mouth of Zensursula [wikipedia.org], who enforced censorship and filtering of the net in Germany, to "fight against child porn", while is reality, it just results in a protective cover above the real child porn criminals.
Re: (Score:2)
Respectfully, you're missing the point. Their point is that full disclosure helps the exploiters exploit more. Anti-sec is pointing out that there are two main ways that full disclosure is a bad thing:
1. Full disclosure allows cut and paste script kiddies to wreak continual havoc with detailed and fully documented exploits from the whitehat security industry.
2. The whitehat security industry (antivirus, firewalls, auditing services) profit hugely from full disclosure by scare tactics.
They are pushing for ch
Re: (Score:2)
The ends don't justify the means. These are people willing to destroy other people's work to make their point, and it is not ethical. These guys have lost all right to take the moral high ground, and their arguments will now and forever be tainted with "Aren't these the guys who hacked Imageshack? Why the hell are we listening to them?"
I'll take script kiddies over assholes like these any day. They may have valid points, but they sure as hell don't have my support, not now anyway. These jackasses are no
Re: (Score:3, Insightful)
Both Gandhi and Martin Luther King, Jr. constantly broke the law with their peaceful protests.
Peaceful protests may break the law, but they don't break many people's morals; destroying servers (if you read their site, you'll see a history of "rm -rf /"'s), even with the best of intentions, is much less morally sound.
Pretty much (Score:2)
It'll be quite amusing to watch their dumb asses get drug off to prison if they actually carry out their threat of "destruction and mayhem." Cyber criminal types seem to forget that when it comes to criminal investigations, the bigger a target you make yourself the more likely you are to get caught. When you are just causing trouble, there just isn't enough care to really devote any resources to going after you. However if you do real damage, all of a sudden there's more interest. The more damage, the more
HaCk ThE PlanET!!! (Score:5, Funny)
wow what an awesome idea! (Score:5, Interesting)
Re:wow what an awesome idea! (Score:5, Informative)
Except they haven't replaced all of the images. I just looked in my account and only one of my images (a horribly outdated tf2 screenshot, of all things) was replaced.
Best pro full-disclosure advert ever (Score:4, Insightful)
This hack demonstrates exactly why we need full disclosure. If I used ImageShack to host important images for (e.g. a lot of people use it for blog images or forums) and someone figured out a way to hack in, I'd want to know about it so I can take steps to protect myself. What if someone uploaded child porn and it appeared on my forum?
It's always better to know than to stay ignorant. It might harm the companies behind affected products, but if it was a safety issue (e.g. your car can occasionally explode while filling it with petrol, which actually happened) there would be no question that full disclosure would be a good thing.
Re: (Score:2)
If I used ImageShack to host important images
Then you're a bit of a prat?
Re: (Score:2)
Do you think everyone has their own server which can withstand the traffic generated by images used on popular forums?
I guess maybe you are the kind of prat who laughs at people for not investing vast amounts of time and money in 5-nines services, but I tend to just try and get on with my life and spend the money on more important things like food.
Re: (Score:2)
Easy to identify ? (Score:3, Insightful)
Their language and style sounds rather distinct. If other writings of them are available on the web, they should be easy to identify.
There's also quite a lot of text.
Stephan
They have a point but it's not that simple (Score:2)
But I'm not sure it's much better only having a few experts able to steal money and run bot nets over a longer period of time or a lot of clueless script kiddies doing it within a shorter period.
Re: (Score:2)
The biggest problem with this thinking is that the experts eventually sell the tech to the script kiddies to gain maximal value from the exploit. So, in this case, you have the worst of both worlds- they use it over a longer period of time AND then you have a lot of clueless script kiddies doing it over a medium period of time before the companies get pressured into fixing the damn thing in the first place.
Security through obscurity is NOT an answer- as you pointed out, they typically don't fix it if they
From their manifesto: (Score:2)
Apparently they are against full disclosure of exploits, because this would lead to the cracks in the first place.
Sounds to me like they are Microsoft PR workers in disguise. ^^
So rash (Score:2, Funny)
I'm not sure I get it (Score:4, Insightful)
In order to put an end to security consultants and companies spreading fear of being hacked in order to sell security oriented products and services, they will go on a reign of terror hacking everything that isn't secured to the nines? Uhmmmmmm. I'm not sure how that works.
Re:I'm not sure I get it (Score:4, Insightful)
It probably makes more sense if you are 15.
Re:I'm not sure I get it (Score:4, Insightful)
You may need to go younger, ever seen a toddler when mommy or daddy tells them "no"? They tend to pitch a fit, and try to break stuff.
These guys may be smart as hell, but they are little more than toddlers who can hack. They are definitely NOT worth paying attention to beyond what is necessary to track them down and put them in jail.
BTW, do you know what happens to guys like these when they get caught? After jail time, they are generally banned from computers. I.e. more jail time if they are caught using one. That's got to be a virtual death sentance for a hacker.
I'm not sure these guys thought this thing through, they are definitely public enough to be traceable. I hope they don't like where they live very much!
I'm hoping.. (Score:3, Insightful)
I mean, it's mostly only big corps that are for "non-disclosure".. the rest of the free world wants to know!
Ok. (Score:2)
Guess the OpenSSH bug is real...
Confused... (Score:2)
I'm confused.
So they're a group of black-hat hackers? I assume this since, well, what they did qualifies as black hat hacking.
So that would mean they WANT a less secure world, right? They don't want vulnerabilities fixed. They don't want people to know about them. They want less competition from script kiddies.
But they're arguing against full disclosure in a way that makes it sound like they want a more secure world.
Actually, that's Brilliant!
It's almost like saying "I want more republicans in office, s
Some observations (Score:3, Informative)
1) The text was syntactically and grammatically near perfect. You don't often see that in these sorts of things.
2) The cadence and style was sort of familiar. I was always able on usenet to identify forgeries not by the path, but by the way they were written. Any idiot can put words where they're not supposed to be, but very few people can wrote like somebody else.
3) I posit that if they weren't good intentioned they'd have hacked DHS.
It would not surprise me if this turned out to be a bunch of CS/security professors or the like, or their minions doing their work.
From the message, I'm absolutey certain they're in America, and had either a very rigorous or British schooling.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Funny)
I no get rigorous or Brit schooling and I are good grammer.
What I mean is, that is quite a statement to make, there are plenty of people who learned to write by reading, not in school.
Re: (Score:3, Informative)
Actually they are retired Sergeants of Marines... (Score:2)
ac
Judging by the thought process behind this (Score:2)
So the average age of this group is apparently what, 15 or thereabouts?
Re: (Score:3, Funny)
Oh sorry that's mental age.
The motive and action contradict each other.. (Score:2)
Their message is complete bullocks tough. Full disclosure in combination with destructive exploitin
My best guess is... (Score:4, Funny)
"Look out, we'll further ruin our own credibility" (Score:2)
Excellent use of irony (Score:3, Interesting)
I think they are pro full-disclosure, and this action is just a pun.
The message they are trying to get across is: "If you close your eyes, the world doesn't disappear. Here's an example of a hack, just to show you that vulnerabilities will continue to exist even if you don't make them public. Not only that, but there will also be people who will find them and use them, regardless of your will to make them public or not".
The message is worded well, others noticed it too; I think the author is too intelligent to be so ignorant of the truth.
Re:Wow (Score:5, Insightful)
Re:Wow (Score:4, Insightful)
...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?
Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.
Re:Wow (Score:5, Funny)
...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?
Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.
And trust me, the dwarves are not happy about that.
Re: (Score:2)
Re: (Score:2)
So that's how Melkor created the orcs!
Re: (Score:2)
Re: (Score:2)
If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?
Because they already tried that and nobody listened?
Re:Wow (Score:5, Insightful)
If it's free speech, mind if I come and write graffiti on the side of your house? If you stop me, you're censoring my speech.
Re:Wow (Score:5, Insightful)
Re: (Score:3, Funny)
They did a LOT more than that!
They came inside the house. Sat down at the TV and ordered PPV and drank all the beer!
Bastards!
Re: (Score:2)
sure, as long as you use washable ink. After an attack, what has changed except delay access for a few and more cash in the pockets of IT security contractors?
Re: (Score:2)
I'll be by your house later with some spray paint--I, too, have a message to share with the world, and your attitude toward defacement of private property is refreshing.
Re: (Score:2)
I would argue that these are not attacks but free speech (as in freedom of expression). Sure, some security sites will be down, that's just the way it is. A mDDOS attack, assuming this is going to be their method, is just like free speech but through the mouth of your NIC card. Ok it's more like yelling but all they need are good earplugs.
Right up until you decide to have a press conference in my living room. Break into my house and you may get shot.
Re: (Score:2, Insightful)
Re: (Score:2)
.
There's a reason people fear public speaking more than death. Anybody can write graffiti on a toilet door without risk, but it takes character to say the same thing in front of an assembly of your peers. Don't think these peo
Re: (Score:2)
Re: (Score:2)
I'd like to see where this goes. This is gutsy, and apparently they know what they're doing and they mean business. Their message is clear, concise, and I don't completely disagree with them. Interesting.
Oddly, this comment, verbatim - save the "Wow" is the subject and not "Wow...", is on another story [mashable.com] about this.
Personally I fear people that would go to lengths to post the exact same thing on multiple sites than people with causes.
I'd like to give a shout out to Zorg, from the Fifth Element on this one "I don't like warriors. Too narrow-minded, no subtlety. And worse, they fight for hopeless causes. Honor? Huh! Honor's killed millions of people, it hasn't saved a single one."
Re:Help for the unfamiliar (Score:5, Interesting)
Re: (Score:2)
img1...us is running on 4.5; there is no img998...us though. Yes, the logs definitely don't show all details nor do we hav
Re: (Score:2)
Re: (Score:2)
Re:I was a victim... (Score:4, Funny)
Re: (Score:2)
"My mom sent an email to the whole family with my high school graduation pictures using ImageShack to host them, but something went wrong and all my relatives saw goatse.cx pictures instead."
Since you're posting anonymously, it was probably an improvement.
Now, back on-topic ... rule #1 - "follow the money and see who benefits". Who else is against full disclosure? Malware vendors, anti-virus companies, Microsoft, the Russian Business Network, click-fraudsters, bot-netters - they're ALL against full di
Re: (Score:2)
My mom sent an email to the whole family with my high school graduation pictures using ImageShack to host them, but something went wrong and all my relatives saw goatse.cx pictures instead.
Ohh... Sorry... I thought that was your graduation. You know... Senior prank to the principal. Shake his hand and, OH MY GOD!
Re: (Score:2)
Re:Making the world a better place. (Score:5, Insightful)
They want to discourage full disclosure, because it means they won't get to abuse undisclosed vulnerabilities as freely as they currently do.
Let me put it to you in more immediate terms: If the BH presentation on ATM exploits goes through, it will trigger a much more rapid response to patch the problem, which means the true exploiters have less time to plunder. Now this is just one example... There are hundreds of high-risk exploits discovered every day, some of which were obviously used to hack into ImageShack. These kiddies are scared that full disclosure will take away their "toys".
Re: (Score:3, Informative)
They want to discourage full disclosure, because it means they won't get to abuse undisclosed vulnerabilities as freely as they currently do.
Let me put it to you in more immediate terms: If the BH presentation on ATM exploits goes through, it will trigger a much more rapid response to patch the problem, which means the true exploiters have less time to plunder. Now this is just one example... There are hundreds of high-risk exploits discovered every day, some of which were obviously used to hack into ImageShack. These kiddies are scared that full disclosure will take away their "toys".
Wow. I don't think you understand what full disclosure is and what they are allegedly advocating. It seems like they are not advocating to not disclose the vulnerability to the vendor but rather to not disclose not only the existence of vulnerability but also an example exploit to the world. This full disclosure is precisely what results in "script kiddies" getting their toys because they don't have to be part of any particular hacking group or hack significant "skillz". It creates a mad rush for the vendor
Re:Making the world a better place. (Score:5, Insightful)
I think full disclosure is a good motivation for companies to fix their stuff. Notify them you found a problem, what the problem is, and that you will make the exploit public after a certain (reasonable) period of time, whether they fix it or not.
Re:Making the world a better place. (Score:4, Insightful)
I think l0pht's home page back in the day had it right when they quoted Microsoft as saying:
"That vulnerability is theoretical." -Microsoft
...which is one of my arguments for releasing POC code. Some folks need to be hit with a bigger clue-stick than others.
Re:Making the world a better place. (Score:5, Insightful)
Wow. I don't think you understand what full disclosure is and what they are allegedly advocating.
Nope. He has it right, you have it 100% wrong. The ATM issue is a perfect example. That vulnerability was disclosed to the vendor eight months ago and they haven't done jack shit. Now the threat of full disclosure - to the entire world - has caused the vendor to get an injunction to prevent disclosure. Where is the fix? I still don't see a fix. Under your theory of "full disclosure is just another word for limited disclosure" the vendor would have fixed the problem long ago.
It rarely ever works like that and we have 30+ years of history to prove it - the security industry used to work the way you wish and the results were the same, vendors didn't do shit. The only time a fix comes is when the vendor knows that the only way to stop the script kiddies and all the serious blackhats is to actually fix the problem instead of sitting on it. Without at least the threat of true full disclosure vendors won't fix their problems, they don't have enough of an economic incentive to do so.
Providing the public with a warning that a vulnerability exists is not unethical and neither is providing information to the vendor but providing full exploit information is not only unethical but completely useless to the end user and places them at additional risk.
Without the threat of true full disclosure, nothing ever comes of limited disclosure. [schneier.com]
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Not only is the exact opposite of the OSS mindset, I'd be willing to be that it is motivated by exactly what you describe. These are not people concerned about security, these are people who want exploits kept secret so they can sell them and use them--the morons posting here in support of this don't get it. These people are not your friends.
There are a number of well-documented cases of vendors being notified well in advance of publication, and those vendors doing nothing until after publication (in some
Re: (Score:2)