AOL Security Compromised by Teenager

Freaky_Friday wrote with a link to an InfoWorld article about a teenage kid accessing customer information at AOL. The alleged criminal trespass began late last year, and extended up through early April. According to the article, the guy used some 'off-the-shelf' hacking software he downloaded online to gain access to, and then transmit information from, AOL's systems. "The complaint states that Nieves admitted to investigators that he committed the alleged acts because AOL took away his accounts. 'I accessed their internal accounts and their network and used it to try to get my accounts back,' the defendant is quoted as saying in the complaint. He also admitted to posting photos of his exploits in a photo Web site, according to the complaint ... If the defendant was honest about his motivation in his reported confession, it's safe to assume that he wasn't interested in stealing data for financial gain, [Managing director of technology at FTI Consulting Mark] Rasch said. Still, it'll be interesting to find out what steps AOL is taking if customer data was in fact compromised, he said."

Comments

Hmmm

[NightWulf]

Kid must be pretty smart if he was able to hack AOL's servers. *Reads article* Ohhhhh to get his account back...hmm forget it.

Re:Hmmm

[Anonymous Coward]

Well there have always been tools out there to hack AOL, some of the more notorious were AOHell and WAAS (We are all sinners), LOFT even had a whole series of tools for AOL. Most of them just contained a lot of script kiddy stuff but there were some others that gave you shell access to the network about 10 years ago or so AOL was really like a pretty face over a custom IRC type network. If you could drop down out of the pretty face and get to the raw shell which was only really only protected by the fact that the pretty face was there and most AOL users were too dumb to realize that there was something going on under the AOL screen. You could peek around, but then once you got yourself an overhead account you really could run through the system at will. While I imagine it has improved over the years I am guessing a lot of the base code and concepts of the network are there still.

Re:Hmmm

[ehrichweiss]

How dare you misspell the name of one of the greatest organizations ever. It's L0pht.

This is news?

[Zeebs]

I mean I won't even go with the obvious AOL bashing. But is it really news that Teens are committing computer crime? Isn't that the stereotype? The pimple faced dateless wonder in his parents basement 'pwning' the 'g1bs0n'?

Re:This is news?

[j_presper_eckert]

I heard that he was attempting to send some obscure command to the AOL servers: "Execute Order 66".

For his age-frame, I think he'd have been better off trying to go three integers higher.

Of course, for that you have to leave the basement eventually. Gotta leave that womb-like comfort to obtain...uh...some *other*...womb-like comfort...oh, never mind.

Re:This is news?

[fafalone]

Well, the fact that this is news can mean only one thing; AOL has massively overhauled their security system and now has state of the art, well designed, and highly effective security. Because the AOL I remember had its security severely compromised by teenagers several times a day. Serious breaches too, read my other post in this thread. It happened so incredibly often, there's no way a breach would be national news. So logically, if its now rare enough to be newsworthy, they must have stopped the endless onslaught of easily exploited holes...
...because a journalist would never just write up a non-story to insult AOL or do some "omg haxors" fearmongering... never...

Curious....

[ScottKin]

I, for one, would like to know why he lost his original AOL accounts in the first place.

Hacking, maybe? ;)

ScottKin

I remember...

[firpecmox]

I tried to hack someone once but that damn 127.0.0.1 was behind a firewall and it just messed up my computers

Re:Some of us say why others say why not?

[dreamchaser]

No, we need kids who don't go getting their accounts cancelled then break the law trying to get them back. We need kids who think up positive creative solutions to problems and aren't malcontents. He *should* face criminal charges. If he was banned wrongly there are other avenues to pursue. Not punishing him would just encourage others to do the same type of thing.

Suuurrree

[FalleStar]

Among his alleged exploits:
* Accessing systems containing customer billing records, addresses, and credit card information
* Infecting machines at an AOL customer support call center in New Delhi, India, with a program to funnel information back to his PC
* Logging in without permission into 49 AIM instant message accounts of AOL customer support employees
* Attempting to break into an AOL customer support system containing sensitive customer information
* Engaging in a phishing attack against AOL staffers through which he gained access to more than 60 accounts from AOL employees and subcontractors

Yeah, sounds like he was JUST trying to get his account back alright.

Re:Suuurrree

[VirusEqualsVeryYes]

Engaging in a phishing attack against AOL staffers through which he gained access to more than 60 accounts from AOL employees and subcontractors

You'd think employees of an ISP, who routinely warns its customers about it, would be wise to rudimentary "attacks" like phishing scams.

Re:Suuurrree

[ShaunC]

You'd think employees of an ISP, who routinely warns its customers about it, would be wise to rudimentary "attacks" like phishing scams.

You'd be surprised. Back in the late '90s, when phishing first became a problem on AOL, they went so far as to modify the Instant Message window so that it contained a disclaimer, in very obvious red text, saying that no one from AOL will ever ask for your password. Believe me, very few people paid attention to that warning.

I recall sitting in the nerve center chat with the likes of VARST, UTRST, JXRST, etc. and having the occasional moron walk in trying to phish in the chat. They didn't generally last long, but I also have seen a VARST operator type his password into the chat. It's sad how easily some (high-level) employees can be socially engineered. That's what you get when you hire Joe Regular into an enterprise position and you don't give him adequate training.

Why?

[flyingfsck]

If he had internet access already, why on earth would want an AOL account? Just a schtoopidttt script kiddie...

Article is Loaded with Errors

[Anonymous Coward]

Mike aka Virus is far misrepresented by this article and the (at least) two others about this. AOL did not track him down by themselves, he was snitched on by a fellow member in the 'aim scene'. Causing $500,000 in damage by logging onto internal and overhead accounts to suspend and unsuspend account, way to try to make a case for yourself AOL. If anyone in this case needs to get in trouble it is AOL. AOL completely fails to train their employees against social engineering techniques, therefore their own employees are really the ones accountable for any customer information being revealed. AOL is notorious for exchanging favors for information on exploits and snitching on your "friends".

To quote the article:
"AOL has had pretty good security over the years."

This is a massive error in any credibility on AOL's part. Within the past 6 months there have been countless exploits in their systems including the ability to register accounts that were 1 or 2 characters long, register accounts of names that were already in use, including over registering internal accounts and accounts such as "AOL System Msg", the ability to register accounts with vulgar and racist words in them via non-American AOL sites, and thats just to name a few off the top of my head. Currently there is still a major issue with accounts having more than one working password.

I could go on and on about the flaws of AOL, but why bother, they know that the flaws exist but instead of tying to fix them they bury them by going after the people who find them, and leaving the holes still in their systems.

Re:Some of us say why others say why not?

[rmadmin]

ohhh. Been there, done that. NCSA telnet on an old skewl mac to my box at home on dialup. Monilith dynamic dns. Except I was "Playing games" not hacking. Sadly, that teacher is still teaching Claris works or some crap like that while I manage the ISP division of a Telco/CatTV/ISP. *yawn*

Re:Some of us say why others say why not?

[Zantetsuken]

I guess you missed the part where it said "off the shelf hacking software"

Just because you can click yes all the way through installing something on Windows doesn't mean the NSA should hire you to harden the Linux or BSD kernels they use on their systems...

This kid's a punk.

[Anonymous Coward]

He might have been ratted out by his hacking crew, but he deserved it. He is a jerk, special ed all his life for anger issues. And it wasn't just AOL, so that BS about "just trying to get my account" back doesn't fly. The jackass was so freaking high on himself that he would use social engineering to gain access to companies databases, then send screen caps to the FBI. Including his aim handle. Which he also had on his myspace page. Dumbass.

Re:Some of us say why others say why not?

[TubeSteak]

He *should* face criminal charges.

Yes

If he was banned wrongly there are other avenues to pursue.

This is AOL we're talking about.
In what bizarro world does AOL have good customer service, such that they'd investigate and remove a ban?

What are these other avenues?
A civil lawsuit?

Re:Some of us say why others say why not?

[Scoth]

I was in high school from 95-99, so the internet revolution/everybody having a computer thing went from just getting going to the beginnings of big time. Almost every single time I mentioned I was into computers to anyone, the first question was always "Are you a hacker?". Anytime I did anything other than load Word, Solitaire, or Netscape, someone would ask me "Are you hacking?". It all got old very quickly. I used to prefer an auto-hiding taskbar, and they almost permanently banned me from the library computers for "hacking" when I turned it on for the hour or so I had alloted to me at the time. As it was, I kept their computers running pretty much single-handedly (county IT dept was useless, and the only other student that was at all techy like me had already screwed up his chances by using his access to steal teacher/student private information) so I wasn't too worried about getting banned.

Incidentally, they were all Windows 95 boxes with some pretty bad security software on it. I found at least two ways through it - the fun one was they didn't lock down Winkey-F. Search on the program you wanted to run, and run it. Likewise, you could load an "approved" program, pull up the Open File dialog, and find the program in there and run it. The other way was Winkey-E. It would pop up a "You don't have permission to run this program" error. Hold it down and the screen filled with them very quickly. Eventually, Windows ran out of memory, Explorer crashed, and it would automatically repop without the security software there. Voila.

So, I guess I was kind of a hacker. Oh well :)

This is news?

[Bob Cat - NYMPHS]

Who DIDN'T own AOL when they were a teenager?

In other news...

[thib_gc]

Other shocking headlines: "Ape defeats security of Diebold voting machines"

Re:Some of us say why others say why not?

[Trentus]

Last year (my final year of school) I found that if you yanked out the network cable when it said "applying security settings", it wouldn't apply the group policy. It was rather handy, because one of the things we had disabled was right clicking... nearly drove me mad that did...

Same old same old

[ShaunC]

From the perspective of someone who was in that scene more than a decade ago, it's enlightening to see how much of this is still going on. I don't see where in the article it says he used "'off-the-shelf' hacking software," but I guess these days it doesn't take much talent.

I remember when the phishing trend started. AOL's biggest mistake at that point was creating a special People Connection lobby that overhead/internal accounts would default to. Initially, it was just a private room whose name changed occasionally (who else remembers THEBLIMPSAIDITALL, and numerous incarnations of IllIlIIlIIlllIlIIlI...?). Anyone who knew the name could get into the room with any regular account, and phish privileged accounts to their heart's content. Eventually AOL made some progress and created a viewruled lobby, which they assumed would keep the riff-raff out, but they forgot to plan for the fact that the riff-raff already had access to privileged accounts.

In the early to mid 90s, there was no such thing as phishing. If you wanted privileged access, you had to work for it, and it was a thankless (but sometimes rewarding) task. There were a handful of folks - okay, probably a few handfuls, maybe numbering in the tens - who spent their free time doing real hacking. Those of us on the Mac side were busy poring over logs from Serial of Champions, reverse engineering the client-server communications. Through trial and error, we determined that every client request would send a two-character "token" and an argument to match. For example, double-clicking a message board to open it up might send the token "mB" with the message board's ID as the argument. Using the Keyword feature would send a Kk token, that's the only one I still remember for sure.

We eventually compiled a list of the various "tokens" that made up the AOL protocol, and what they did. There was a developer's client extension that allowed for sending arbitrary token/args, and like most things inhouse, it was leaked to a few people. This gave some of us the ability to do things nobody else could. Way before AOL ever introduced "Mail Controls," for instance, we were able to reject mail from specified users. The feature had been built into the system from the beginning but had never been released to the public (IIRC, the then-system-devs didn't even know it was possible). We'd stumbled upon the feature by sending random tokens to the server.

Here's a funny story about how something went from blackhat to implemented feature. At some point I discovered a token that would refresh the client's installed list of screen names. Basically, if you had AOL installed on multiple computers, or had multiple copies of the client on one machine, the list of your available screen names would inevitably become outdated across clients: if you created a new screen name on one client, then switched to another, the new name wouldn't show as a sign-on option. Likewise, if you deleted a screen name while you were logged in from one machine, that name would still (incorrectly) display as available on another machine. There was no way to synch up the list of names, so if you created screen name FoobarMan on machine A, the only way to sign onto it from machine B was to reinstall the client.

Well, I found out that if you sent a certain token to the server, it would force a client-side refresh of the screen names on the sign-on list. Having legitimate access to publish things - did I mention I was not only a haxx0r, but also remote staff - I created a little form with a link that would send that token, thus refreshing the client's list of screen names. I passed it on to a TechLive friend who started giving it out to members who were having this (common) problem. Eventually someone inhouse got wind of it. I got reamed, my creation was removed, and a month later a shiny new feature appeared at keyword: NAMES... "Refresh Screen Name List."

Go figure. :)

Accessing member information is hardly anything new. AOL has a customer management system

Re:Same old same old

[fafalone]

Well it sounds like I was in "the scene" a year or two after you. We took the token thing to a whole other level. Tokens are a small part of the scripting language AOL runs on, FDO. Thanks to some leaked internal documentation and lots of trial and error, a small group of us became quite good with FDO and could pretty much run amok among every resource on AOL. We wrote programs that automatically mapped the tens of thousands of objects; every mF token (forms), and my personal project, every eB token, which were the file libraries. Not only could a normal user invoke an eB token for a beta library, we could obtain staff only files too. The eB libraries didn't contain customer billing records, but they did contain internal operations documents, alpha release software, staff tools, and all sorts of other goodies. Mapping the tokens unleashed the real power of FDO; imagine having a list of every single window that made up the AOL software including ones you could not get to from a non-empowered account, and then being able to view the source code for that window and then having complete control of that code locally. While I wasn't involved personally, I believe one exploit that descended from that power was the ability to bypass the SecureID (a physical device with a code that changed every 60 seconds) of internal accounts by recoding the entry window to behave as if it was entered. And of course, countless ways to terminate or take over normal accounts and access billing systems (I never messed with anyone elses account or info, of course in part due to the legal risk, but mainly because I actually did have morals as a young teen, and I was in it for the challenge, knowledge, and yes the glory and fame that came with being among the first to harness the power of AOL's internal language, which made us the elitest of the elite among the AOL programmer/hacker kiddies).
I won't go into much more detail, but good ole star tool (as it was called, adding a menu titled * that gave any account a direct interface to the internal FDO scripting) led to countless exploits for the small group of people able to take full advantage of it (i.e. it was significantly harder to interface with AOL through FDO than the Visual Basic programs everyone with half a brain flooded the scene with). Some of the more ambitious exploits made the news; I recall one time the leak of the next version of AOL months before it was even supposed to enter early beta got a mention in a major news outlet; while it wasn't me that leaked it, I was the one who found the eB library where it resided and passed along the token to those who did make it public. OpsSec (operations security, the highest level of AOL network security staff) knew us by name, and terminated my access more than a few times. It was really cool stuff, especially for a kid. I don't know if newer AOL software still allows clients to use tokens and other FDO code, or if AOL figured out how to secure privileged resources from those who could program in it, but back in the day security was so poor that our group of 10-13 year olds walked in and out of staff resources like they were our own personal playground.

Re:Same old same old

[ShaunC]

I think we were marginal contemporaries. If I have it right, y'all were doing "invokes" (like 32-41908) while the Mac side was busy sending token/args. Yes, I remember the * menu on WAOL. Its equivalent on the Mac side was the "Bullet Menu," named for the fact that instead of being a *, it showed up in the menu bar as a bullet (cmd-8 on a Mac).

FDOs and atoms were the Windows side of things. Your mention of OpsSec brings up another anecdote. There was an internal account, "NOC Nodes," run by network ops. I once created a fake account with the screen name "N0C Nodes" (november zero charlie Nodes) and IM'd a friend with his full phone number. The poor bastard logged off and wiped his hard drive. It only became a joke years later when he forgave me.

Fun times. :)

Re:Same old same old

[fafalone]

First we documented all of the tokens with just invokes yes; but from there we went on to writing our own windows and modifying the behavior of existing windows, working with every part of the FDO stream, not just the token invokes. If I remember correctly, the invoke menu command was only for invoking mF tokens anyway. That's all people could do before my time, where learning how to use all the other FDO commands was made possible by a internal documentation of the entire FDO language, a large manual covered in "CONFIDENTIAL" and "INTERNAL USE ONLY" stamps. Just invoking an mF token for a form would display the graphics and such, but if you really wanted to do something worthwhile, invoking that token was only the start of a stream. FDO has hundreds of commands besides invoke; we figured out how to do entire streams using all the commands, atoms, etc. Too bad I'm traveling with my laptop right now, I have hundreds of custom FDO scripts and documentations in my storage archives back at home. But anyway, FDO was an entire language, invoke was just one command, once one knew the entire language a whole new world of possibilities opened up that you could never accomplish with a simple invoke. I'll share another OpsSec story. My account got terminated for no good reason, so I called up the support line (CAT i think) and asked to be transferred to OpsSec. I was told no such department exists. I asked to speak to a supervisor, since granted a low level support peon might not know about it. The supervisor also told me it didn't exist. I explained in great detail why I knew it existed, and was then told 'well, you're not speaking to them' and got hung up on. So I started digging around all the internal documents we had, and in a couple hours came up with a phone number for OpsSec. I called them up, and right after I said hello, they called me by my handle, told me my account was killed for hacking, and told me knock off the token scanning and stop harassing tech support. First time I ever talked to someone who worked for AOL that actually seemed like an intelligent person who knew what was going on, and how I found out the highest levels of the company were actually worried about what we could now do with FDO.

Re:Some of us say why others say why not?

[golgoj4]

you know, if I had mod points I would throw some your way. Yeah he needs to be punished, but I think a fine line between punishment & use of his knowledge would be fine. Alienating people doesn't seem like such a good idea. Maybe put him in sort of community service type of position where he can see a benefit when actually contributing as opposed to just wreaking havok. But my whole opinion really hangs on his reasons for doing what he did. if his intent was as he says, why not try to bring him into the fold? Not without some penance of course...

AOL, so easy to hack

[Khyber]

No wonder it's #1!!!