ImageShack Hacked, Security Groups Threatened

revjtanton writes "Last night a group calling themselves 'Anti-Sec' hacked ImageShack, one of the largest image hosting sites on the web, and replaced many of the site's hosted pictures with one of their own, which detailed their manifesto. The group's grievance is against full-disclosure of exploits, an issue that was debated recently after a presentation on an ATM exploit was canceled. Anti-Sec simply wants the practice within security circles to end, and they've promised to cause 'mayhem and destruction' if it doesn't. These people are taking direct aim against a sector of the IT industry that is already armed to fight the ... but they also already know that. It should be interesting to see how this plays out."

Comments

Their message is certainly ironic,

[Anonymous Coward]

in a "shoot the innocent bystander while sounding all righteous about risk" sort of way.

Re:Their message is certainly ironic,

[Anonymous Coward]

It is not ironic. It is the same message that terrorists have used in every age, whether they be the Weathermen, the KKK, the IRA, or Hezbullah: do X or something bad will happen to innocent people. So these people use computers to deface the work of others, or perhaps to destroy some online website that they disagree with. How are these terrorists to be treated? As the criminal scum they are. Hunt them down, arrest them, try them, convict them, and stuff them in to cages with other scum-bag criminals.

As soon as they decided to cause harm to people in order to FORCE their particular point of view upon everyone, they became terrorists.

Re:Their message is certainly ironic,

[Anonymous Coward]

At least now I know why my sig and avatar pics are broken. Hopefully imageshack.us has some backups and can recover from this skulduggery.

Re:Their message is certainly ironic,

[Anonymous Coward]

I'm all for égalité, but why then software vendors are not accountable for their mistakes? If a bug is found on an ATM and a bank is defrauded, find the vendors and then hunt them down, arrest them, try them, convict them, and stuff them in to cages with other scum-bag criminals.

Is this considered full-disclosure ...

[neilobremski]

... of their movement?

Re:Is this considered full-disclosure ...

[ILuvRamen]

well not exactly but wouldn't it be funny is someone did publish the exploit they used to hack imageshack? :-P

Making the world a better place.

[moj0e]

I think they are North Korean.... :) (JK)

Actually, I find it interesting that the group wants to make the world a better place by
discouraging full disclosure.... the funny thing is that they want to do this
by destroying things.

Re:Making the world a better place.

[Architect_sasyr]

How does lack of full disclosure make the world a better place? The way I see it, if I know how an attack is operational I can figure out how to defend against it, if I don't then I won't know how (or more importantly why I am having) to write secure code. My other issue with a lack of full disclosure is the indication that only, say, the richest people (or companies) can afford them - effectively monopolizing things like the anti-virus or firewall industries.

Re:Making the world a better place.

[billcopc]

They want to discourage full disclosure, because it means they won't get to abuse undisclosed vulnerabilities as freely as they currently do.

Let me put it to you in more immediate terms: If the BH presentation on ATM exploits goes through, it will trigger a much more rapid response to patch the problem, which means the true exploiters have less time to plunder. Now this is just one example... There are hundreds of high-risk exploits discovered every day, some of which were obviously used to hack into ImageShack. These kiddies are scared that full disclosure will take away their "toys".

Re:Making the world a better place.

[aristotle-dude]

They want to discourage full disclosure, because it means they won't get to abuse undisclosed vulnerabilities as freely as they currently do.

Let me put it to you in more immediate terms: If the BH presentation on ATM exploits goes through, it will trigger a much more rapid response to patch the problem, which means the true exploiters have less time to plunder. Now this is just one example... There are hundreds of high-risk exploits discovered every day, some of which were obviously used to hack into ImageShack. These kiddies are scared that full disclosure will take away their "toys".

Wow. I don't think you understand what full disclosure is and what they are allegedly advocating. It seems like they are not advocating to not disclose the vulnerability to the vendor but rather to not disclose not only the existence of vulnerability but also an example exploit to the world. This full disclosure is precisely what results in "script kiddies" getting their toys because they don't have to be part of any particular hacking group or hack significant "skillz". It creates a mad rush for the vendor to get the patch out there before it can be exploited by lamerz using a script they either downloaded off a website or a script that they copied from the the disclosure with some minor changes.

Providing the public with a warning that a vulnerability exists is not unethical and neither is providing information to the vendor but providing full exploit information is not only unethical but completely useless to the end user and places them at additional risk.

Re:Making the world a better place.

[moj0e]

Hello :)

I think aristotle-dude did a great job of explaining of why the lack of full disclosure is a good thing.
Please see his post below (if you haven't already).

Thanks!

Re:Making the world a better place.

[lordofwhee]

If proof-of-concept code is never released, what's to motivate the vendors to release a patch? If nobody actually exploits a vulnerability, Joe Q. Public isn't going to care that someone could (even if they did, most people don't care...).

Plus, if a white hat gets their hands on the exploit code, they may be able to release a patch well before the vendor can, or at least try to mitigate the possible damage caused (saying 'program x is vulnerable to a buffer overflow!' isn't useful to ANYBODY). Full disclosure has worked so far, why do we need to change it?

Re:Making the world a better place.

[Thiez]

I think full disclosure is a good motivation for companies to fix their stuff. Notify them you found a problem, what the problem is, and that you will make the exploit public after a certain (reasonable) period of time, whether they fix it or not.

Re:Making the world a better place.

[Magic5Ball]

Providing the public with a warning that a vulnerability exists is not unethical and neither is providing information to the vendor but providing full exploit information is not only unethical but completely useless to the end user and places them at additional risk.

Partial disclosure of a new class of vulnerability can also result in new ways of thinking about problems. For example, to exploit webmail interfaces, I don't have to disclose how to write a CSS file that positions malicious links over a particular webmail app's legitimate interface links, just that such is possible. (FWIW, this was first fully disclosed to the major vendors/operators in 2000. Most of them spent weeks trying to convince themselves that it wasn't a problem that "Reply" lead to an off-site re-login screen... It was fixed only after the attack was described, as above, on a public list in 2001.)

With respect to ATMs, where could an attacker provide input into the app? Via 2-3 mechanisms on the ATM card, the UI, via displayed details of individual accounts, or other means. Perhaps "I can has <BOM>" is all someone needs to find out what to attack, after which an implementation would be relatively trivial.

Re:Making the world a better place.

[Anonymous Coward]

They appear to have some details at this URL: http://romeo.copyandpaste.info/

Of particular note:

~ Fuck full-disclosure
~ Fuck the security industry
~ Keep 0days private
~ Hack everyone you can and then hack some more

  - Blend in.
  - Get trusted.
  - Trust no one.
  - Own everyone.
  - Disclose nothing.
  - Destroy everything.
  - Take back the scene.
  - Never sell out, never surrender.
  - Get in as anonymous, Leave with no trace.

Re:Making the world a better place.

[UncleTogie]

I think l0pht's home page back in the day had it right when they quoted Microsoft as saying:

"That vulnerability is theoretical." -Microsoft

...which is one of my arguments for releasing POC code. Some folks need to be hit with a bigger clue-stick than others.

Re:Making the world a better place.

[JumpDrive]

Plus it would also make it more difficult for anyone to figure out who was using the exploit.
If only a few people have the exploit, then it is a lot easier to catch the people who are using the exploit to extract money from banks. If everyone has it then it's difficult to figure out who was using it in past crimes.
But what will probably happen is the exploit will get out to the script kiddies and some stupid hacker wannabe is going to be nailed for a lot of crimes.
So if I had the exploit and was using it, I think now would be a good time to release it to the 2600 crowd.

Re:Making the world a better place.

[Jah-Wren Ryel]

Wow. I don't think you understand what full disclosure is and what they are allegedly advocating.

Nope. He has it right, you have it 100% wrong. The ATM issue is a perfect example. That vulnerability was disclosed to the vendor eight months ago and they haven't done jack shit. Now the threat of full disclosure - to the entire world - has caused the vendor to get an injunction to prevent disclosure. Where is the fix? I still don't see a fix. Under your theory of "full disclosure is just another word for limited disclosure" the vendor would have fixed the problem long ago.

It rarely ever works like that and we have 30+ years of history to prove it - the security industry used to work the way you wish and the results were the same, vendors didn't do shit. The only time a fix comes is when the vendor knows that the only way to stop the script kiddies and all the serious blackhats is to actually fix the problem instead of sitting on it. Without at least the threat of true full disclosure vendors won't fix their problems, they don't have enough of an economic incentive to do so.

Providing the public with a warning that a vulnerability exists is not unethical and neither is providing information to the vendor but providing full exploit information is not only unethical but completely useless to the end user and places them at additional risk.

Without the threat of true full disclosure, nothing ever comes of limited disclosure.

Re:Making the world a better place.

[stanchion7]

I hadn't really come to a conclusion on this event yet, but I feel your summary is spot on. Many, many years ago, I remember how jealously script kiddies would guard their toys. That is exactly what this feels like. "Security through obscurity is no security at all"

Re:Making the world a better place.

[spinkham]

No one really fully understands a topic as controvercial as full disclosure, and your perspective isn't complete either. Neither is mine.

Full Disclosure doesn't necessarily mean exploit code. It does mean full details for someone skilled in the art to be able to produce exploit code. There is a world of difference. Of course, these days for any worthwhile flaw the time from full disclosure to in the wild worm type exploit code is now usually only 48 hours or so, but that isn't usually released by the researcher.

Full disclosure is the A bomb, scorched earth, last resort of most legit security researchers, and legit researchers will follow some sort of "responsible disclosure" timeline, but if the vendor does not fix the problem in a reasonable amount of time(where reasonable varies widely by software, # of deployments, complexity of the fix, etc), Full Disclosure is the big stick threat that usually will get results if nothing else does.

Re:Making the world a better place.

[Anonymous Coward]

if you put one more double negative in your post i'll never be able to... aw nevermind, i skipped it.

Re:Making the world a better place.

[The End Of Days]

Sure, blackmail is perfectly fine when you have good intentions.

Re:Making the world a better place.

[Anonymous Coward]

suppose the vendor has a fix, but not all of their clients have applied it. if their clients get owned, it looks bad on the vendor, but you cant force your clients to do anything.

Re:Making the world a better place.

[billcopc]

It's not blackmail, just potentially embarrassing.

If some guy threatens to out your extramarital affair, or the fact you've been defrauding your employer, or any other thing you'd rather keep secret, and they want money to keep quiet... that's blackmail.

If someone outs your ill affairs for free because you're an irresponsible prick, that's justly deserved. Disclosure of found exploits falls under this umbrella, not blackmail.

Re:Making the world a better place.

[billcopc]

You can't force clients to do anything, but much like the upstream vendor, if there is a serious threat to their bottom line, clients will do backflips on command if you can make the gaping hole go away.

There is also a rather broad culture of vendor-managed or reseller-managed equipment. For example, if a vulnerability is discovered in any of the software I've build and sold to my clients, it is a simple matter for me to log into each box and patch every single one of them, and email the fix to the remaining few whose installations I don't manage. For those who don't enjoy such a strong vendor-client relationship, there is often an auto-update mechanism built into off-the-shelf apps, all you have to do is click it and reboot.

Re:Making the world a better place.

[lennier]

"if their clients get owned, it looks bad on the vendor, but you cant force your clients to do anything."

That's because it IS bad on the vendor. End of story.

The vendor should have taken all due precautions to prevent security flaws in their code BEFORE they released it. They didn't. Any ownage is now entirely their fault, regardless of patching. It should never be the client's responsibility to apply a patch.

We don't tolerate 'apply a patch after the fact' as an answer in other disciplines. We shouldn't tolerate it in computing. Do it once, do it right, zero tolerance for security bugs.

If your language (*cough* C, C++) does not help you do this then stop using that language and use/create appropriate tools.

Re:Making the world a better place.

[OrangeCatholic]

There's something odd about a hacker going after security groups. Feels like they are taking a hostage, and threatening the very agencies who would defend against such hacking.

I wouldn't assume these people are well-intentioned. If they are, they are wasting our time or they are un-prioritized. Script kiddies? Who cares? What about Total Information Awareness?

The easiest way to hack Imageshack would be to inspect the packets going in and out until you gathered enough passwords to log in as administrator.

Who can perform packet inspection? The phone company can.

Wow

[Anonymous Coward]

I'd like to see where this goes. This is gutsy, and apparently they know what they're doing and they mean business. Their message is clear, concise, and I don't completely disagree with them. Interesting.

Re:Wow

[Kell Bengal]

Wait, wait. How is messing with other people's stuff on the net from safely behind a computer 'gutsy'? Sounds like cowardice to me. I don't care what their message - if they're fucking with my, or other people's, stuff then whatever their argument is will go unheard. If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Re:Wow

[jombeewoof]

...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.

Re:Wow

[taoye]

No it isn't. These guys don't even understand what they're talking about... and we'll see if they mean business when the FBI comes a knockin'...

Re:Wow

[Anonymous Coward]

...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.

And trust me, the dwarves are not happy about that.

Re:Wow

[Anonymous Coward]

...why can't they convince us with a logical argument?

Because...

o/` Love is a battlefield. o/`

Re:Wow

[sqlrob]

If it's free speech, mind if I come and write graffiti on the side of your house? If you stop me, you're censoring my speech.

Re:Wow

[Zak3056]

I would argue that these are not attacks but free speech (as in freedom of expression). Sure, some security sites will be down, that's just the way it is.

I'll be by your house later with some spray paint--I, too, have a message to share with the world, and your attitude toward defacement of private property is refreshing.

Re:Wow

[bistromath007]

PETA and Greenpeace are terrorist organizations. They do alot worse than nuisance hacking. :|

Re:Wow

[Niris]

Good point, they should stop doing things over the net. Time to start building those bombs!

Re:Wow

[Anonymous Coward]

...and we won't get into what the halflings think about it...

Re:Wow

[Kell Bengal]

I'm not sure if that's supposed to be a legitimate argument or a fantastic piece of trolling, but if it's trolling then I'm impressed. You've combined free speech, activism, minorities, anti-corportism and anti-social behaviour into one slick package without differentiating any of their goals or means. There is no concordance between peaceful protest and hacking a webpage to spread a message. One just makes noise, the other interferes with the lives and property of other people. The ends do not justify the means.

Re:Wow

[houstonbofh]

I would argue that these are not attacks but free speech (as in freedom of expression). Sure, some security sites will be down, that's just the way it is. A mDDOS attack, assuming this is going to be their method, is just like free speech but through the mouth of your NIC card. Ok it's more like yelling but all they need are good earplugs.

Right up until you decide to have a press conference in my living room. Break into my house and you may get shot.

Re:Wow

[NickFortune]

Why stop at the outside? Break into the place and scrawl all over his wallpaper. That's effectively what anti-sec did here.

Re:Wow

[maxume]

Better to protest living in cold climates by smashing his windows during the middle of winter.

Re:Wow

[Sebilrazen]

I'd like to see where this goes. This is gutsy, and apparently they know what they're doing and they mean business. Their message is clear, concise, and I don't completely disagree with them. Interesting.

Oddly, this comment, verbatim - save the "Wow" is the subject and not "Wow...", is on another story about this.

Personally I fear people that would go to lengths to post the exact same thing on multiple sites than people with causes.

I'd like to give a shout out to Zorg, from the Fifth Element on this one "I don't like warriors. Too narrow-minded, no subtlety. And worse, they fight for hopeless causes. Honor? Huh! Honor's killed millions of people, it hasn't saved a single one."

Re:Wow

[Anonymous Coward]

What's brave about making a logical argument? This moron is risking jail time. I've never understood the need to call terrorist we don't agree with cowards. Bush call Osama a coward, for having other people fight for him, then it took Bush years to even visit Iraq. Foolish people may be brave, but I'm not impressed.

Re:Wow

[Anonymous Coward]

...If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Because logic doesn't always work. Logic in the hands of those who count the beans is usually twisted into some diseased, desecrated version of it's former elf.

And trust me, the dwarves are not happy about that.

And why wouldn't dwarves be happy about a diseased, desecrated elf?

Re:Wow

[sysgeek01]

It's not censorship. It's enforcing the castle doctrine by protecting my property and family.

Re:Wow

[GeorgeS]

They did a LOT more than that!
They came inside the house. Sat down at the TV and ordered PPV and drank all the beer!

Bastards!

Re:Wow

[Anonymous Coward]

Ladies and Gentlemen, we have a new logical fallacy! Argument through Pwnage!

Re:Wow

[Kell Bengal]

It takes brains and introspection to produce a convincing and well-reasoned statement of ones position. Putting your ideas out there - ideas you may be passionate about - is always a risk. You risk rejection, you risk being proven wrong, but most of all you risk the consequences.

.

There's a reason people fear public speaking more than death. Anybody can write graffiti on a toilet door without risk, but it takes character to say the same thing in front of an assembly of your peers. Don't think these people are cowards? Ask them to put their names and contact details in the message next time.

Yes, there is a role for anonymous whistleblowers to get important truths aired, but most people would get their point across with letters to journalists, not defacement. And besides, I hardly think security companies pose a threat to the safety of their members, just for holding the views that they do. These people only 'need' their anonymity to protect themselves against the repercussions of hacking other peoples' webpages.

Re:Wow

[Nautical Insanity]

True, they're exercising free speech in the text of their manifesto. They have their right to that. However, while you're entitled to say what you want, how you say it is quite naturally under some limitations. For example, you are free to say that you like flowers. But if you said that by lighting houses on fire so that from the air, the flames could be read, then you'd get arrested for massive arson. Hacking into the site is clearly illegal and this group should get busted for that.

Re:Wow

[Jurily]

If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Because they already tried that and nobody listened?

Re:Wow

[__aasqbs9791]

*Whoosh!*

Re:Wow

[RandomU]

I would argue that these are not attacks but free speech (as in freedom of expression).

This is also the stance of most Real Terrorists. They justify taking hostages, destroying planes or killing innocent people, so the world will hear their message. Their message might even be a good one. In the end no one might be seriously hurt, as in the case of taking hostages, but releasing them afterwards. But don't try fooling yourself or others into thinking that this is NOT an attack. That's just BS double speak.
.
If the people had done the same actions but without a political message would you still try claiming it wasn't an attack. Just because you add a political message doesn't make it any less of an attack.
.
You can even justify the action, as in the case of civil rights protestors vandalizing property, or US soldiers attacking German Soldiers to free Jewish Holocaust Victims. However it is still an attack.
Lets stop with the PC BS.
.
RandomU

Re:Wow

[Anonymous Coward]

We can ask "Where do our rights end?" and the best answer I've ever heard was "When they infringe on other people's rights". You say a group hacking sites and bringing them down to display their message is free speech!? That's as far as free speech as you can get, imagine if you wanted to speak out against government, and they jailed you and said "Our freedom of expression says that we can express it by shutting you up" that's exactly what this group is doing, they're not communicating, they're trying to silence and overwrite messages, they want to restrict speech and curtail basic freedoms.
 
Indians that block major roadways make no attempt to eliminate the awareness of the opposition, only make theirs known. This group is not simply yelling, they're yelling and silencing, you don't just need good earplugs, cause when they take down a security blog, earplugs would be useless in undoing the "damage" they have done.

Re:Wow

[Anonymous Coward]

For example, you are free to say that you like flowers. But if you said that by lighting houses on fire so that from the air, the flames could be read, then you'd get arrested for massive arson.

Worst. Analogy. Ever.

Re:Wow

[lordofwhee]

I WONDER WHY. It CERTAINLY has NOTHING to do with the fact that their argument amounts to 'full disclosure is bad durr!!'. Nope, nothing at all.

Re:Wow

[General Wesc]

Wait, wait. How is messing with other people's stuff on the net from safely behind a computer 'gutsy'?

Ah, yet another person who mistakenly assumes what they do on the Internet is anonymous and therefore risk-free. If you're just being an annoying troll, you're relatively safe, but if you get the law and security experts involved, the supposed anonymity drops away pretty quickly most of the time.

Re:Wow

[dna_(c)(tm)(r)]

because the image of the elf was substituted by one of an angry hacker.

Re:Wow

[MadUndergrad]

So that's how Melkor created the orcs!

Re:Wow

[osu-neko]

Ah, yet another person who mistakenly assumes what they do on the Internet is anonymous and therefore risk-free. If you're just being an annoying troll, you're relatively safe, but if you get the law and security experts involved, the supposed anonymity drops away pretty quickly most of the time.

They clearly don't believe this. If they did, they wouldn't have bothered to do this anonymously. They'd sign the names to their work and show how 'gutsy' they really are. The fact that they didn't reveal this information indicated that they believe it can be effectively hidden. And, in fact, it can, if you know what you're doing. The "supposed anonymity" drops way pretty quickly most of the time because most of the time, the people making the supposition don't know what they're doing.

Re:Wow

[Kell Bengal]

It's still cowardice to anonymously conduct vandalism, even if that anonymity is an illusion. So, it would appear to be anti-sec's assumption, not mine.

Re:Wow

[Anonymous Coward]

usually twisted into some diseased, desecrated version of it's former elf.

An orc?

Re:Wow

[Magic5Ball]

Eh? I thought PETA got taken over by the only marginally good satire writers from the Onion and MAD.

This group needs to hire a good copy/PR writer to explain what "exploit", "disclosure", "script kiddie", "whitehats", and "rm'd" mean, and also how their proposed technical solution of targeting individuals for removal purports to solve the problem of socially motivated script kiddies, and what this technical demonstration has to do with their business objectives.

In short, this group has successfully met all the criteria to be a typical late '90s dot-com company.

Re:Wow

[dimeglio]

sure, as long as you use washable ink. After an attack, what has changed except delay access for a few and more cash in the pockets of IT security contractors?

Re:Wow

[JumpDrive]

Jesus, what planet did you come from?

Re:Wow

[Anonymous Coward]

If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

Silly rabbit, their trix aren't for you. Their plan is to help grease the path for the fuckers in Congress trying to get this POS Cybersecurity Act of 2009bill passed. Once a good portion of the Internet structure becomes nationalized, any full disclosure of vulnerabilities could be considered as posing a national security threat and thus would have to be kept secret. What this means, of course, is that any software vendor providing a product that constitutes a major portion of the federal government information infrastructure as well an the internet commerce and banking, will be protected from full disclosure of vulnerabilities in their product by the federal government based on national security policy.

As this relates to "anti-sec", they want to build the impression that will be amplified by a scaremongering media that the Internet is being besieged by warring factions of evil hackers. There will even be some useful idiots pointing to the ramblings of these assholes as proof that even the sec community is divided on issue of FD. Which it is, but mostly debate revolves around the timing of disclosure and not whether to disclose at all. This is a sham war designed to put pressure on Congress members to pass a really, really, bad bill.

I think the timing of this incident, along with recent botnet attacks and other media grabbing "cyber" events within the few months just before this bill was introduced, couldn't be more perfect to create a campaign to justify the takeover of the Internet infrastructure by the federal government. http://www.eff.org/deeplinks/2009/04/cybersecurity-act

Re:Wow

[Vexorian]

Hey, I had some dejavu when I read his post. Then I google for "I'd like to see where this goes. This is gutsy, and apparently they know what they're doing and they mean business. Their message is clear, concise, and I don't completely disagree with them. Interesting." and it shows me that this strange post abouhow consice the message is everywhere where this is reported uh.

And well, I guess I would be more impressed if they hacked an actual central part of the security industry like they threaten to do rather than just a photo hosting site (are they needy for attention or something?)

Re:Wow

[The End Of Days]

So just to be clear, you're alright with people vandalizing your house as long as it costs you nothing more than time and money to fix it.

Re:Wow

[Anonymous Coward]

And fuck your wife?

Re:Wow

[socceroos]

If their message is clear, concise and not disagreeable, why can't they convince us with a logical argument?

That made me laugh. You got beat up in school because you tried to' logically argue' with the bullies over your differences didn't you?

The world is run by bullies. You either stand up to them, or do what you do: blow hot air. Speak to a brick wall. Request that the pigs take flight.

There is a place for words, a very prominent place. It is the first port-of-call when dealing with issues. But if you honestly had any idea how long this issue has been going on despite decades of the most carefully crafted arguments, then you would realise that the time for words alone is clearly over. I'm not advocating aggressive behaviour by default, but I'm certainly not going to sit on my bum and 'talk to the hand' while these idiots continue to put us all at risk. Its been going on for a while now, dude.

Re:Wow

[Kell Bengal]

You might be interested to know that I was bullied as a kid. When they insulted me I ignored them. When they attacked me I fought back and I won. I wasn't picked on after that.

.

But this is different. They have a political agenda they are powerless to affect unless we pay attention to them. The fact that they are acting illegaly to push their message disinclines me to give their position the consideration it might otherwise have received. And yes, bullies generally do go away when you ignore them, and if they attack you then I say respond decisively and with all requisite violence. But that's not the point of my original post.

My point is they can't resolve their differences in a civilised way then they don't deserve to be heard. It's one thing to be disenfranchised because of injustice; it's another thing to break the law just to make a point.

Re:Wow

[Anonymous Coward]

Yea, he should have said that lighting cars on fire to spell the message would get you arrested. Car analogies are ALWAYS better.

related to openssh rumors?

[Anonymous Coward]

These are the same people who say they've found an exploit in some versions of openssh. Any connection?

http://seclists.org/fulldisclosure/2009/Jul/0028.html

http://news.ycombinator.com/item?id=692036

http://lwn.net/Articles/340483/

Re:related to openssh rumors?

[Anonymous Coward]

On investigating this link, http://seclists.org/fulldisclosure/2009/Jul/0028.html It looks like they hacked into Logan of New Zealand and posted the logs of their antics. They begin with a similar manifesto

"Some of you have seen a lot of casualties lately in the
webhosting scene: hosting companies being wiped and rm'd at the expense of their
clients. While some of this is collateral damage, we're about to show you,
ladies and gentlemen, that sometimes you aren't pwned because of who you
host but what you say. Practice what you preach."

The site they targeted, Logan of NZ has this as a signature...
"Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html"

I'd call it full-disclosure...

[Anonymous Coward]

...of a bowel movement.

Astalavista

[Spyware23]

For interested readers; these were the same people who killed astalavista. (Logs of that attack can be found all over the internet if you google).

Re:Astalavista

[Threni]

Hardly, given that they're anti-disclosure.

Re:Astalavista

[tomhudson]

Hardly, given that they're anti-disclosure.

... but they ARE in favour of people p0wning sites - which requires disclosure of vulnerabilities - something they're against. Kind of contradictory ...

They're just a bunch of assholes, same as the punks who key cars.

Re:Astalavista

[alexhard]

No, one of the reasons they cite for their anti-full disclosure sentiments is that it allows hordes of script kiddies to "p0wn" sites.

Re:Astalavista

[tomhudson]

No, one of the reasons they cite for their anti-full disclosure sentiments is that it allows hordes of script kiddies to "p0wn" sites.

... in other words, they (Anti-Sec) don't want competition that will ruin the economic value of the 'sploit prematurely.

Just follow the money ...

Re:Astalavista

[Monkey Angst]

... but they ARE in favour of people p0wning sites - which requires disclosure of vulnerabilities - something they're against. Kind of contradictory ...

Well, not if you look at it this way: They're not against finding and exploiting vulnerabilities. They're against sharing those vulnerabilities so that others can exploit them. Think of it like an anti-nuke treaty. The US has nukes and will not give them up, but we're dead against letting anyone else have them.

They're just a bunch of assholes, same as the punks who key cars.

Oh yeah, this too.

Re:Astalavista

[Anonymous Coward]

Hardly, given that they're anti-disclosure.

... but they ARE in favour of people p0wning sites - which requires disclosure of vulnerabilities - something they're against. Kind of contradictory ...

Wrong.

They are against FULL disclosure.

If I understand their manifesto correctly, showing that the vulnerability exists is acceptable; telling people how to easily exploit it, is not.

Re:Astalavista

[tomhudson]

Selective disclosure benefits the people they proclaim are benefiting from full disclosure. Selective disclosure benefits anti-virus companies - it gives them time to react, and make more money, rather than put pressure on the OS vendor to FIX the f*ing problem.

They're either stupid, liars, or useful tools. Or all 3.

Selective disclosure is the same as security through obscurity - never worked, outdated, and too prone to abuse and gaming the system.

Re:Astalavista

[Anonymous Coward]

Well maybe if people didn't disclose every vulnerability they wouldn't be able to hack sites meaning they wouldn't have this message to get out or the ability to get this message out in the first place.

so, they'd rather?

[Anonymous Coward]

So, it sounds like they'd rather be able to sell their exploits to the highest bidder instead of publishing them for anyone to see. It will be interesting to see how much support this movement gets around here (there are already a few posts supporting them), because from the sounds of things it's almost the exact opposite of the OSS mindset.

Re:so, they'd rather?

[MaskedSlacker]

Not only is the exact opposite of the OSS mindset, I'd be willing to be that it is motivated by exactly what you describe. These are not people concerned about security, these are people who want exploits kept secret so they can sell them and use them--the morons posting here in support of this don't get it. These people are not your friends.

There are a number of well-documented cases of vendors being notified well in advance of publication, and those vendors doing nothing until after publication (in some cases the publication was only made because the vendor refused to do anything). Full disclosure forces lazy, cost-cutting corporations to improve their products when they would otherwise have no motivation to do so. The only people who benefit from non-disclosure are black hat criminals.

Leave door open or we will rob you ?

[abies]

From what I can understand from their manifest, they don't want full disclosure of exploits so
1) Other script kiddies cannot use them too easily
2) General public is not aware of the risks
3) Security companies cannot prepare protection against them

This is like... let's thing about proper, slashdot analogy... bunch of car thieves telling that they are against installing immobilizers in cars and warning they will steal cars of immobilizer producers and supporters till they stop distributing immobilizers. When they stop, thieves will come back to stealing random cars, with less effort.

Re:Leave door open or we will rob you ?

[binkzz]

1) I think that's a good thing
2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits
3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

I'm not sure how you came to your conclusions, I don't believe they are correct.

Re:Leave door open or we will rob you ?

[Svartalf]

Good analogy- so it's not in keeping with the "proper, slashdot analogy" thinking.

You have to do a **BAD** car analogy for it to be that.

Re:Leave door open or we will rob you ?

[Hurricane78]

Exactly. It sounds like straight out of the mouth of Zensursula, who enforced censorship and filtering of the net in Germany, to "fight against child porn", while is reality, it just results in a protective cover above the real child porn criminals.

Re:Leave door open or we will rob you ?

[whoever57]

3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

Except that history has shown that many software companies won't actually fix problems until forced to do so by full disclosure.

Re:Leave door open or we will rob you ?

[smoker2]

Prick.
Are you sat in front of a keyboard with full access to the internet ? This isn't a written dissertation, it's a live environment. Look around for yourself. You probably would only argue semantics if he had cited other instances.

Re:Leave door open or we will rob you ?

[not_anne]

Respectfully, you're missing the point. Their point is that full disclosure helps the exploiters exploit more. Anti-sec is pointing out that there are two main ways that full disclosure is a bad thing:

1. Full disclosure allows cut and paste script kiddies to wreak continual havoc with detailed and fully documented exploits from the whitehat security industry.

2. The whitehat security industry (antivirus, firewalls, auditing services) profit hugely from full disclosure by scare tactics.

They are pushing for change in the whitehat security industry itself, so that script kiddies and security companies stop exploiting the consequences of full disclosure.

Re:Leave door open or we will rob you ?

[Anonymous Coward]

not really, idiot

Re:Leave door open or we will rob you ?

[Anonymous Coward]

3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

Except that history has shown that many software companies won't actually fix problems until forced to do so by full disclosure.

This is absolutely true. PoC code is a necessary evil as much as I'd hate to admit it (I was originally in support of project mayhem).

  People wont believe you, or see your shit as legit until you show them how badly you can fuck them.. it's mostly because most people are all talk and in a world of all talk, code speaks volumes.

Re:Leave door open or we will rob you ?

[sqldr]

slashdot is like a ford focus. they're both, er, um, you can get green ford focuses.

Re:Leave door open or we will rob you ?

[Tycho]

OT: your sig "I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas"

I assume you aren't going to try to deny that you are also a citizen of the United States of America at this point. Other people, now in jail, have tried not to pay income taxes and other federal taxes by claiming that they had renounced their US citizenship and were now just a citizen of the State of X, but not a US citizen any longer. None of these individuals actually successfully argued in court that they were just a citizen of State X and not a US citizen, so they no longer had to pay income tax. Most idiots in this position would have found their lawyer unwilling to make that argument, or if acting as their own lawyer these idiots might have found themselves stopped as soon as they started and fined $5000 each time during trial for even trying. When one makes a frivolous argument that is not valid and that relates to income taxes in court, expect a bill. Obviously the lesson to take back in this argument and with others is to not parse words intentionally incorrectly, and that you will not find any valid loophole to avoid paying any income taxes. Just to suck it up and pay your income taxes like everyone else. If you are behind on filing a year or two, contact a tax lawyer and then negotiate with the IRS and do so before the IRS calls you, you will always end up better off that way.

Re:Leave door open or we will rob you ?

[Bigjeff5]

The ends don't justify the means. These are people willing to destroy other people's work to make their point, and it is not ethical. These guys have lost all right to take the moral high ground, and their arguments will now and forever be tainted with "Aren't these the guys who hacked Imageshack? Why the hell are we listening to them?"

I'll take script kiddies over assholes like these any day. They may have valid points, but they sure as hell don't have my support, not now anyway. These jackasses are nothing more than little children going around breaking things when things don't go their way.

They deserve to be in jail, not sought out for security advice. What the hell were they thinking?

Re:Leave door open or we will rob you ?

[Anonymous Coward]

From what I can understand from their manifest, they don't want full disclosure of exploits so
1) Other script kiddies cannot use them too easily
2) General public is not aware of the risks
3) Security companies cannot prepare protection against them

This is like... let's thing about proper, slashdot analogy... bunch of car thieves telling that they are against installing immobilizers in cars and warning they will steal cars of immobilizer producers and supporters till they stop distributing immobilizers. When they stop, thieves will come back to stealing random cars, with less effort.

I'd rather have a mature hacker gain access to my porn collection and download what he likes. Heck he can even check out the low balance on my checking account and move on. As opposed to some kids, leaving $13.37 in my account and deleting my porn by accident or because he wants to play a prank on me for having more porn than he does.

Re:Leave door open or we will rob you ?

[DrugCheese]

Just to suck it up and pay your income taxes like everyone else.

Yeah, just continue to be a slave. It's cool everyone's doing it!

There are many stupid people in jail for many stupid things. Taking a stand, ANY stand, against people OWNING YOUR LABOR is not stupid.

Re:Leave door open or we will rob you ?

[Vellmont]

2) They don't want the world to not know about the exploits, they just don't want the world to know how to use those exploits

There's at least a couple large-scale problems with this viewpoint.

The most direct one is that knowing about the exploit, and knowing how to use the exploit aren't really as different as you try to make them out. How long do you think for "bad guys" to figure out the full picture if you released enough information for people to protect themselves? i.e. "disable function X of server product Y". Well shit, you just gave a HUGE clue to the "bad guys", but probably didn't really give ENOUGH information to enough of the "good guys". What about the guys relying on "function x of server y" who simply can't disable it?

Exploits are often esoteric sounding enough that companies can just claim (and often have) "that vulnerability is entirely theoretical". It's often the case that the exploit is VERY exploitable, but the developers or companies are just being arrogant, don't understand, or don't care. In a perfect world where companies and developers had perfect knowledge of exactly how exploitable and dangerous a vulnerability was (and addressed the ones that needed to be addressed) your idea would work. The real world has proven otherwise.

The third problem is simply that the companies/developers responsible for fixing the problem often don't suffer the costs (or a much lower cost) or people actually exploiting the vulnerability. i.e. Microsoft doesn't suffer enormous losses when the latest worm ravages the internet. Since they suffer a lot less pain, they'll devote a lot less resources to fixing it. If the exploit eventually will get out then company X will be a lot more likely to fix it rather than just ignoring it and hoping nobody else ever finds out.

3) These exploits would still be in the hands of the security companies so that they could prepare protection against them

Heh. Where does this view that there's always the mysterious people who are just going to fix everything come from? If you think "Security Companies" are going to save you, blah blah blah Bridge to sell.. blah blah blah swamp land in Florida.

No, what needs to happen is if security is important it needs to be built into the product to begin with. Security isn't a product you "buy", it's something you are. This is nothing different than what people have been saying for 20 years.

Re:Leave door open or we will rob you ?

[osu-neko]

They are pushing for change in the whitehat security industry itself, so that script kiddies and security companies stop exploiting the consequences of full disclosure.

You weren't doing too badly until you got to the "so..." part. The reasons why they're doing this are fairly obvious, it's the same reason drug runners would oppose drug legalization -- it would devalue the product. These are clearly people who engage in black-hat activity (witness the fact that they just did -- any argument that they aren't is in stark contradiction to the known facts). The "so..." part of your above sentence should say, "... so that script kiddies can no longer do what we do more cheaply." You can buy access to botnets and such from people like this. They are selling a product. This is BIG business. Ending full disclosure will (they believe) reduce the number of script kiddies with access to the same information and exploits as they have. This will increase the value of the product they sell, and make them even more money than they already rake in. Any other reason they give is just an attempt to convince other people who would be compelled with the "it'll make us richer" reason.

Re:Leave door open or we will rob you ?

[Anonymous Coward]

There's a difference between disclosing vulnerabilities and disclosing exploits.

Re:Leave door open or we will rob you ?

[Anonymous Coward]

Looks like you are having a little trouble with the word "merely."

Re:Leave door open or we will rob you ?

[not_anne]

I was pointing out what their reasons were based on their manifesto. Nothing more.

Re:Leave door open or we will rob you ?

[not_anne]

Playing devil's advocate here...

Both Gandhi and Martin Luther King, Jr. constantly broke the law with their peaceful protests.

By your logic, we shouldn't admire or revere Gandhi or MLK because they broke the law hundreds of times.

I disagree.

Re:Leave door open or we will rob you ?

[Ifni]

[citation needed]

Translation: I'm too lazy to do a Google search, or remember any one of a bazillion Slashdot articles that support this.

Alternate translation: I'm a Microsoft shill.

Re:Leave door open or we will rob you ?

[binkzz]

Why would it be me that has to search?

If your claim is so easily backed up, link it.

Re:Leave door open or we will rob you ?

[Ifni]

Very true. Police officers, the military, fire rescue workers, even the loathed clerks at the DMV all OWN THEIR OWN LABOR, and expect to be paid for it. They don't just offer you their services out of the goodness of their heart, they do it so that they can pay their bills so that the recipients of those bills can be paid for THEIR labor, which they also OWN. Are you starting to understand how this all works now? Let me spell it out for you - where does the money to pay for these public benefits come from? The word "public" might afford a clue. That's right, it comes from your taxes. And as a citizen, you also have the right not to agree with everywhere your taxes are going, but you change that by voting, not by withdrawing funds. This is the "blade cuts both ways" part of living in a democracy - sometimes you find yourself in the minority and you just have to suck it up or change public opinion (or your own) so that you are back in the majority.

I suspect you'll reply with all sorts of propaganda about how we're not really a democracy or taxes are an unfair burden or whatnot, but they are irrelevant to the basic fact that fair taxation is not tantamount to someone else owning your labor. The only relevant subject to debate is what exactly is "fair" (and it is certainly a value much in excess of "zero") and how that burden is determined. However, this isn't the forum for such a debate.

Re:Leave door open or we will rob you ?

[Ifni]

Because you are the only one (or member of a minority group) that apparently lacks the predominant knowledge of the statement's truth. If I state a fact that is common knowledge, I do not need to cite it. If you dispute that fact, it is your job to find corroborating evidence in defense of your stance, not mine.

Re:Leave door open or we will rob you ?

[binkzz]

I have to disagree. For one, I believe the majority of people would not know whether that statement is true or not. Also, no knowledge is predominant, except perhaps breathing - but you could argue that that isn't true knowledge.

Too many people make assertions or draw conclusions too fast for me to accept anything posted in an internet message as absolute truth -- including yours. If I make a statement, and you'd like me to link you to a source, I would, and I cannot rightly understand people being offended as they are if I ask for it.

Re:Leave door open or we will rob you ?

[shish]

Both Gandhi and Martin Luther King, Jr. constantly broke the law with their peaceful protests.

Peaceful protests may break the law, but they don't break many people's morals; destroying servers (if you read their site, you'll see a history of "rm -rf /"'s), even with the best of intentions, is much less morally sound.

Re:Leave door open or we will rob you ?

[Ant P.]

These assholes are like wannabe racers that do twice the speed limit and yell at everyone else for holding them up while thinking they own the road. Also they drive SUVs, so they should f off and die. ..was that good (bad) enough?

Re:Leave door open or we will rob you ?

[Ant P.]

(also: does anyone know why the site keeps eating my line breaks and random characters like that?)

Re:Leave door open or we will rob you ?

[Vellmont]

If I make a statement, and you'd like me to link you to a source, I would, and I cannot rightly understand people being offended as they are if I ask for it.

This isn't a research paper, it's a discussion forum. This also isn't a general forum for Joe Sixpack, it's Slashdot. If you're not up to speed on the generally accepted knowledge base it's up to you to find and dispute it.

Re:Leave door open or we will rob you ?

[shish]

I have to disagree. For one, I believe the majority of people would not know whether that statement is true or not

Speaking as some random guy who just happened to scroll down and hit this conversation, I do know his statement to be true -- I have indeed seen several front page slashdot articles about major security holes being exploited with the footnote "the vendor was informed about this, but chose not to do anything because they didn't think it was important", but I too can't be arsed to find them (last I checked, the slashdot search engine was pretty shit, and I don't want to waste any more time fighting with it :-P)

Re:Leave door open or we will rob you ?

[schamarty]

exactly, which is why they don't like full disclosure.

As someone said somewhere else, this is a group of people whose revenue source is drying up because too many people (on all 3 sides of the fence -- user/luser/victim, whitehat, skiddie) are finding out what previously only they knew.

They're just protecting a failed business model. ...sort of like the RIAA, if you don't take the analogy too far :-)

Re:Leave door open or we will rob you ?

[binkzz]

Perhaps - I still believe it is not trolling asking for a source. Although I do think "generally accepted knowledge" is too relative to be a substantial argument.

Re:Leave door open or we will rob you ?

[TheTurtlesMoves]

1) I think that's a good thing

Why the hell can't script kiddies get their scripts off underground sites, like they already do? Eliminating full disclosure will not change a dam thing about script kiddies.

Re:Leave door open or we will rob you ?

[Dhalka226]

Fair point.

On the other hand, neither Gandhi or MLK hid from the consequences of what they did. Indeed, accepting the consequences is what civil disobedience is all about.

They also didn't destroy unrelated peoples' property to make a point like these people did. Whether it's wise or not, many of these people aren't going to have backups of their own photos, and I'm not sure if ImageShack is going to be able to restore them from backup either. In any event, it's going to cost ImageShack thousands of dollars to try to figure out what happened, close the holes, repair the damage, restore what they can and move on. And neither ImageShack nor the people whose photos were altered can realistically influence whether or not any security hole details are released in the future. It would be like Rosa Parks yanking white people out of their cars and throwing them on the street to protest the seating laws on the bus. None of these people are part of the problem except in the most generic of ways.

And, for good measure, neither Gandhi nor MLK threatened to hurt even more people if their demands aren't met. "Do what we say or we'll destroy more things" is closer to terrorist than protester, much less peaceful protester. MLK and Gandhi's actions sparked debate on what's right and what's wrong; these guys make it perfectly clear that they've made up their minds and everybody had best fall in line before they get angry.

Maybe these people are right and maybe they're not. Maybe they'll get their way and maybe they won't. History will tell all of that. Either way, it's hard to argue they're not a bunch of petulant, self-righteous children undeserving of admiration.

It's not blind adherence to a law that determines whether somebody should be admired for their actions, it's their motives and their methods. To bring it back to the grandparent's comment, "the ends justify the means" has and will continue to be one of the most dangerous ideas in the history of the world.

Re:Leave door open or we will rob you ?

[Vellmont]

It's not an argument, it's an observation about the environment. This isn't about correct or not correct, it's about who's responsible for doing the legwork.

Re:Leave door open or we will rob you ?

[binkzz]

If you're talking about responsible for the legwork, I'd say it's almost always the user making the assertion. If I claim the Earth is revolving around the Sun, and you ask me for a source or link, I'd be happy to link you.

Re:Leave door open or we will rob you ?

[Svartalf]

Excuse me...

In my sig, I do not claim I do not owe taxes- in no way is that claim in my sig indicating that this is the case. In fact, I ended up finally paying the back taxes owed during the dot-com bust back with my 2007 returns. I take quite a bit of umbrage at you insinuating that with what I claim there is about taxes. It's actually quite telling and part of the reason I put it there in the first place.

What I do claim in that line is that those in government and business should quit treating me as "just a taxpayer" or "just a consumer"- which is what they are all doing (Even with the current US Administration and Government... Change I can believe in...largely more of the same...).

I'm a Citizen of a specific State, and the State and the Federal Government are answerable to me for what they do. I'm not just a money source and an occasional source for votes.

I'm your customer if you're a business- consumers just take what they're given and they should enjoy the privilege. As a customer, you have to convince me to take on your products and services and I'm just as likely as not to turn my back on you if you do something stupid (RIAA members, for example...) and find other sources or do without.

Heh... Where in all of that (Or my sig, for all that matter...) comes what you came up with? There ISN'T anything of the sort and you assumed something. But, hey, I guess I shouldn't be upset...this is /. after all; where lack of critical thinking and understanding of your rights passes for the opposite all the time.

Re:Leave door open or we will rob you ?

[Svartalf]

No, he's just doing the /. exercise program. Jumping to conclusions is quite good exercise you know... ;-)

Re:Leave door open or we will rob you ?

[Tycho]

Sorry, I was in a bad mood. I was tired of seeing others on the internet claim they were citizens of the state only and actually seemed surprised after being charged and convicted of tax evasion using this claim. You are both a citizen of Texas and of the United States as well. The idiotic position of citizens of the state only is better refuted here:
http://evans-legal.com/dan/tpfaq.html#sovereigncitizens

I also apologize for the the harshness of my original post.

I was a victim...

[Anonymous Coward]

My mom sent an email to the whole family with my high school graduation pictures using ImageShack to host them, but something went wrong and all my relatives saw goatse.cx pictures instead.

Re:I was a victim...

[Niris]

Thankfully you're a /. user, so the goatse.cx picture was probably better.

Re:I was a victim...

[tomhudson]

"My mom sent an email to the whole family with my high school graduation pictures using ImageShack to host them, but something went wrong and all my relatives saw goatse.cx pictures instead."

Since you're posting anonymously, it was probably an improvement.

Now, back on-topic ... rule #1 - "follow the money and see who benefits". Who else is against full disclosure? Malware vendors, anti-virus companies, Microsoft, the Russian Business Network, click-fraudsters, bot-netters - they're ALL against full disclosure. They ALL would rather that vulnerability information be closely held, so that they can either ignore it or exploit it to their economic advantage.

I'm not saying Anti-Sec is working with them - they may also fit the definition of "useful fool." But either way, they ARE acting like a bunch of tools, in the Urban Dictionary sense of the word.

Re:I was a victim...

[houstonbofh]

My mom sent an email to the whole family with my high school graduation pictures using ImageShack to host them, but something went wrong and all my relatives saw goatse.cx pictures instead.

Ohh... Sorry... I thought that was your graduation. You know... Senior prank to the principal. Shake his hand and, OH MY GOD!

Re:I was a victim...

[Anonymous Coward]

"follow the money and see who benefits"

That's "follow the money" and "cui bono?".

they may also fit the definition of "useful fool."

The term is "useful idiot". It's often attributed to Lenin though there's a lot of doubt as to whether Lenin actually coined it.

You're welcome.

Re:I was a victim...

[tomhudson]

I wrote "follow the money and see who benefits" because in this case it's one and the same.

Also, "useful tool", as per the Urban Dictionary definition of "tool"

"One who lacks the mental capacity to know he is being used. A fool. A cretin. Characterized by low intelligence and/or self-steem."

someone who is a complete idiot/ one who is used by other people, and usually dosen't even realize it/ someone who can't think for themselves/ an asshat.

So no, the term "idiot" in "useful idiot" doesn't go far enough. They're tools.

Re:I was a victim...

[maxume]

AC's confusion is understandable, you wrote 'useful fool' in your initial message.

Re:I was a victim...

[tomhudson]

I used both :-) I called them useful fools, and tools, because they ARE both. Then a poster tried to say I was incorrect, and should have used the expression "useful idiots". Intelligent people can still be fools and tools, but idiots are just idiots.

Re:I was a victim...

[maxume]

If you meant to communicate 'useful tool' in your first message, you did a crappy job of it. I mean, there is even a period between 'useful' and 'tools', and you use 'bunch of' to modify 'tools'.

I shall endeavor now to stop splitting hairs.

Fing Funny

[Anonymous Coward]

That's the problem with limiting free speech. Who is enlightened enough, trust worthy enough, and wise enough to be the gate keepers of knowlege?

Anti-Sec?

The same idiot who would do this and threaten what they have done? Maybe Anti-Sec should talk to Theodore Kaczynski about how well threatening others because of one's lofty ideas works out.

SERIOUSLY offensive BS. And I'm diametrically opposed to its position. FIX THE SOFTWARE THEN!!! And don't tell me I don't have the right to know about the security flaws in YOUR software YOU want ME to use.

Re:Fing Funny

[Kell Bengal]

Why should knowledge need a gatekeeper in the first place? People say "We can't let this fall into the wrong hands!" but security through obscurity is a losing strategy, if that's all you're doing. I'm not advocating we have no secrets, but I think we have more to gain by disclosing and improving than we do through hiding what we know under a white sheet in the hopes that nobody else knows about it. Remember, if we figured it out, they can figure it out - and then we'll still have the problem but nobody else will be informed or prepared when the hammer falls.

Comment removed

[account_deleted]

Comment removed based on user account deletion

not again

[delete2kill]

its the new fad.. or it it the same old bottled in new trust it to die out soon...

HaCk ThE PlanET!!!

[carn1fex]

These punks dont know who theyre messin with!! Me and my posse are put on our roller blades, spike our hair and take them out with our camouflage thirty three point six bee pee ess moh demz.

Re:HaCk ThE PlanET!!!

[Xenoproctologist]

You know, I had happily repressed that little slice of cultural wasteland. Now it's all flooding back -- and it's brought most of the `80's along for the ride.

Re:HaCk ThE PlanET!!!

[Anonymous Coward]

ObLiGaToRY!!1

Re:HaCk ThE PlanET!!!

[Anonymous Coward]

-- and it's brought most of the `80's along for the ride.

Your childhood... utterly decimated. (Kid-Safe unless they were born in 1980.)

Re:HaCk ThE PlanET!!!

[Anonymous Coward]

oh.my.fucking.god

Re:HaCk ThE PlanET!!!

[Anonymous Coward]

These punks dont know who theyre messin with!! Me and my posse are put on our roller blades, spike our hair and take them out with our camouflage thirty three point six bee pee ess moh demz.

Um, I think that should be "camouflage thirty three point six kay bee pee ess moh demz."

Re:HaCk ThE PlanET!!!

[Ifni]

The turtles merged into 'Turtle Saint' and displayed his biggest power.

There is way too much wrong with that.

wow what an awesome idea!

[trybywrench]

What an effective way to distribute a message, hack one of the worlds most popular image hosting sites and replace all the images with your manifesto! Every site with an image linked back to imageshack would be displaying your message. Instant.global.audience. I'm not justifying what they did and I'm all for the feds handing out a beat down, afterall, the law is the law but man, what a good idea.

Re:wow what an awesome idea!

[Pyrion]

Except they haven't replaced all of the images. I just looked in my account and only one of my images (a horribly outdated tf2 screenshot, of all things) was replaced.

Re:wow what an awesome idea!

[noidentity]

And these guys are the real deal, too! The font in the image? Sub-pixel rendered of course! They left out no details.

Re:wow what an awesome idea!

[Anonymous Coward]

imageshack have been pretty quick off the mark (theres a thread on reddit where one of them is talking about it) and have been fixing it server by server. for a few hours though every image served up by imageshack was redirecting to the anti-sec message. it was a redirect of some sort though - no images were over-written.

bitchslap kids

[Anonymous Coward]

These morons prove that when you have a small penis and no brains, you'll do anything to get your 15 minutes of fame. I hope they get caught and become an obedient bitch for some big convict one day soon.

Best pro full-disclosure advert ever

[AmiMoJo]

This hack demonstrates exactly why we need full disclosure. If I used ImageShack to host important images for (e.g. a lot of people use it for blog images or forums) and someone figured out a way to hack in, I'd want to know about it so I can take steps to protect myself. What if someone uploaded child porn and it appeared on my forum?

It's always better to know than to stay ignorant. It might harm the companies behind affected products, but if it was a safety issue (e.g. your car can occasionally explode while filling it with petrol, which actually happened) there would be no question that full disclosure would be a good thing.

Re:Best pro full-disclosure advert ever

[MonsterTrimble]

I agree fully. Personally, I want to know why these guys decided to hit image shack - easy target? They say that they are going after exploitive & detremental communities which do the full disclosure thing. Maybe I missed the memo, but when the hell did imageshack become astalavista? BTW - you killed Astalavista? YOU BASTARDS!!!

Re:Best pro full-disclosure advert ever

[EdZ]

If I used ImageShack to host important images

Then you're a bit of a prat?

Re:Best pro full-disclosure advert ever

[Anonymous Coward]

Given how nonsensical their argument is, and given how their methods argue for the exact opposite of their statement... I wonder if these hackers are not actually trying to rile-up people into being for full disclosure.

People generally don't like giving in to threats. Publicly telling people "avoid full disclosure or we'll mess with you" might actually be a ruse to generate buzz about how important it is to publicize exploits and stop them before they are used to do exactly what these hackers did.

Re:Best pro full-disclosure advert ever

[AmiMoJo]

Do you think everyone has their own server which can withstand the traffic generated by images used on popular forums?

I guess maybe you are the kind of prat who laughs at people for not investing vast amounts of time and money in 5-nines services, but I tend to just try and get on with my life and spend the money on more important things like food.

Re:Best pro full-disclosure advert ever

[EdZ]

Let's put it this way: If you have images that are actually important, then it's almost certain the site you're running has hosting where you should be placing these images. A forum avatar or a 'witty' animated signature image are not important images. Even assuming that image hosting alone is required, regardless of the site that links to them, then a paid service (e.g S3, where the hosting costs would be pennies per month) makes a lot more sense than a free ad-supported service if the images are actually important.

Re:Best pro full-disclosure advert ever

[Jah-Wren Ryel]

If I used ImageShack to host important images for (e.g. a lot of people use it for blog images or forums) and someone figured out a way to hack in, I'd want to know about it so I can take steps to protect myself. What if someone uploaded child porn and it appeared on my forum?

Too bad they didn't. Imagine making instant felons out of half the population of the internet. What better way to demonstrate how the laws that criminalize simple possession are absolute bullshit used to make politicians look good instead of requiring the police to focus on crimes that actually hurt children.

Re:Best pro full-disclosure advert ever

[Anonymous Coward]

Not really...

If they disclosed the methods to everyone (which is what "full-disclosure" means), you couldn't do a thing to stop every other script-kiddie on the planet to hose your images!

If they disclosed the methods to ImageShack exclusively, then the problem could be fixed, and your images would still be kind of safe. At least, until someone else discovered the vulnerability and used it to hose your images. But, by then, ImageShack would at least know about the flaw.

Re:Best pro full-disclosure advert ever

[AmiMoJo]

I'm not talking about avatars, I'm talking about diagrams, photos and other large images that tend not to be stored on the forum server but rather linked to on ImageShack.

Re:Best pro full-disclosure advert ever

[EdZ]

Then when someone PMs you saying your image is down, re-uplaod it to one of the five million other free image hosts. Because nobody is foolish enough to 'store' an semi-important image on a Generic Ad-Supported free Imagehost, right?

They have a point but it's not that simple

[Anonymous Coward]

Yes, by using full disclosure some exploits become much worse because then it becomes something anyone can do. But some companies won't fix their exploits if they're not known about and I'm not sure I'd feel much better with a handful of experts able to pinch my money over a long period of time or having a load of script kiddies able to do it in a shorter period of time.

Re:They have a point but it's not that simple

[Svartalf]

The biggest problem with this thinking is that the experts eventually sell the tech to the script kiddies to gain maximal value from the exploit. So, in this case, you have the worst of both worlds- they use it over a longer period of time AND then you have a lot of clueless script kiddies doing it over a medium period of time before the companies get pressured into fixing the damn thing in the first place.

Security through obscurity is NOT an answer- as you pointed out, they typically don't fix it if they can help it. :-D

Re:They have a point but it's not that simple

[osu-neko]

But I'm not sure it's much better only having a few experts able to steal money and run bot nets over a longer period of time or a lot of clueless script kiddies doing it within a shorter period.

I'm sure. I'd rather have some idiot punk walk into my house and steal the TV than some knowledgeable professional come in, empty the contents of my safe, and steal the far more valuable painting on the wall while leaving the relatively worthless TV alone.

If the argument is it reduces the number of idiot punks running around, so I don't find out about the defect in my security system until the professional comes along, it's fairly easy to see why it's a bad thing, even if it does in fact reduce the number of idiot punks running around stealing TVs.

Easy to identify ?

[sugarmotor]

Their language and style sounds rather distinct. If other writings of them are available on the web, they should be easy to identify.
There's also quite a lot of text.

Stephan

Re:Help for the unfamiliar

[klui]

It doesn't show the details but their website gives a summary. http://romeo.copyandpaste.info/txt/imageshack-pwned.txt How accurate, who knows.

They have a point but it's not that simple

[thetoadwarrior]

Yes, full disclosure can make things worse but some companies take an "out of sight, out of mind" approach to fixing exploits and if no one knows about it they don't fix it.

But I'm not sure it's much better only having a few experts able to steal money and run bot nets over a longer period of time or a lot of clueless script kiddies doing it within a shorter period.

From their manifesto:

[Hurricane78]

Apparently they are against full disclosure of exploits, because this would lead to the cracks in the first place.

Sounds to me like they are Microsoft PR workers in disguise. ^^

So rash

[UnixUnix]

They didn't even bother to Ask Slashdot :(

Re:Help for the unfamiliar

[Anonymous Coward]

Obviously fake: that shows a Linux box getting hacked into.

What's New?

[Anonymous Coward]

People have been defacing websites for more than a decade. Twitter gets screwed nearly every day by kids. Some flashy kiddies who act so immaturely should just be ignored - all this slashdot article has done is further their attention grabbing. Anyhow, someone is always looking to break in. Give the chance for people to fix it, give time for the patch to propagate, let the people know what caused it - someone else might trigger something in their mind for some other software. And of course, this is fully usable in a malicious way. But my kitchen knife is also fully usable as a murder weapon.

Re:Help for the unfamiliar

[maxume]

They are running lighttpd and PHP (at least, that is what the headers say), so I doubt they are running on Windows.

Wikipedia?!

[jkxx]

Anyone seeming abnormally slow load times for wikipedia at this time? (Or at least a very odd title image)

Re:Wikipedia?!

[REBloomfield]

yes. thought it was me.

Re:Wikipedia?!

[Anonymous Coward]

I got one of the proxy/load-balancing servers telling me that it couldn't relay the connection (or something like that. it was a bit ago, and I've closed the tab.)

I'm not sure I get it

[sjames]

In order to put an end to security consultants and companies spreading fear of being hacked in order to sell security oriented products and services, they will go on a reign of terror hacking everything that isn't secured to the nines? Uhmmmmmm. I'm not sure how that works.

Re:I'm not sure I get it

[maxume]

It probably makes more sense if you are 15.

Re:I'm not sure I get it

[Bigjeff5]

You may need to go younger, ever seen a toddler when mommy or daddy tells them "no"? They tend to pitch a fit, and try to break stuff.

These guys may be smart as hell, but they are little more than toddlers who can hack. They are definitely NOT worth paying attention to beyond what is necessary to track them down and put them in jail.

BTW, do you know what happens to guys like these when they get caught? After jail time, they are generally banned from computers. I.e. more jail time if they are caught using one. That's got to be a virtual death sentance for a hacker.

I'm not sure these guys thought this thing through, they are definitely public enough to be traceable. I hope they don't like where they live very much!

Re:I'm not sure I get it

[Anonymous Coward]

Sounds familiar... Can't get what you want? Terrorize people... Gotta love CyberTerrorists, I wonder if they have beards and really bad B.O. too?

Re:I'm not sure I get it

[Sheik Yerbouti]

Yeah not to mention that imageshack is clearly a security website that's in favor of full disclosure and has profited from it what with all the goatse pics WTF?

Re:I'm not sure I get it

[PiSkyHi]

I suspect they found the exploit in imageshack and needed a manifesto to sound important enough at the same time.

Re:I'm not sure I get it

[TheTurtlesMoves]

they probably sell firewall and other security software for their day job. ;)

Re:I'm not sure I get it

[mtremsal]

"Do no harm or I pown you" worked for Celestial Being. ... but they had gundams so the comparison may fall short.

I'm hoping..

[slashkitty]

that this is just some sort of reverse logic... because now, anyone wanting to hide details of sec exploits are thrown into the group of these "nasty hackers"..

I mean, it's mostly only big corps that are for "non-disclosure".. the rest of the free world wants to know!

Re:I'm hoping..

[Anonymous Coward]

I mean, it's mostly only big corps that are for "non-disclosure".. the rest of the free world wants to know!

Er... I doubt the rest of the free world is even aware.

If you framed the issue of disclosure in rigourously neutral terms, including the background of the reasoning behind disputing viewpoints, I'm not convinced the greater population wouldn't agree with what you hold is a corporate view.

Just MHO and all that, but it's based on being 46, and having worked and lived and schooled among various levels of the middle- and working-class milieu. I'm for full-disclosure, and i'm quite used to the greater populace holding opinions different from my own; that's quite possibly one more of them.

How is imageshack a supporter of full disclosure?

[Anonymous Coward]

supporters of full-disclosure and the security industry in its present form

(whatever that is)

How does imageshack fit into that definition? I guess it's just another script kiddy who chose imageshack because he happened to know an exploit, and the alleged cause is pure trolling BS.

Ok.

[EddyPearson]

Guess the OpenSSH bug is real...

Confused...

[WPIDalamar]

I'm confused.

So they're a group of black-hat hackers? I assume this since, well, what they did qualifies as black hat hacking.

So that would mean they WANT a less secure world, right? They don't want vulnerabilities fixed. They don't want people to know about them. They want less competition from script kiddies.

But they're arguing against full disclosure in a way that makes it sound like they want a more secure world.

Actually, that's Brilliant!

It's almost like saying "I want more republicans in office, so go vote democrat!", but their subject matter is such that most people won't understand and actually agree with them.

Some observations

[rs79]

1) The text was syntactically and grammatically near perfect. You don't often see that in these sorts of things.

2) The cadence and style was sort of familiar. I was always able on usenet to identify forgeries not by the path, but by the way they were written. Any idiot can put words where they're not supposed to be, but very few people can wrote like somebody else.

3) I posit that if they weren't good intentioned they'd have hacked DHS.

It would not surprise me if this turned out to be a bunch of CS/security professors or the like, or their minions doing their work.

From the message, I'm absolutey certain they're in America, and had either a very rigorous or British schooling.

Re:Some observations

[Psyborgue]

I agree. Something doesn't smell right.

Re:Some observations

[maxume]

I no get rigorous or Brit schooling and I are good grammer.

What I mean is, that is quite a statement to make, there are plenty of people who learned to write by reading, not in school.

Re:Some observations

[Anonymous Coward]

The text (http://romeo.copyandpaste.info/txt/imageshack-pwned.txt) is far from perfect english. It is actually quite poorly written, though it does affect a learned style. I would not be surprised at all if this was written by someone who didn't have english as their first language.

Re:Some observations

[TheRaven64]

You have an odd definition of perfect grammar. Their writing style isn't bad, but they had run-on sentences and incorrect hyphenation in a few places early on and then deteriorates completely towards the end into something barely coherent.

Re:Some observations

[Anonymous Coward]

1) The text was syntactically and grammatically near perfect. You don't often see that in these sorts of things.

2) The cadence and style was sort of familiar. I was always able on usenet to identify forgeries not by the path, but by the way they were written. Any idiot can put words where they're not supposed to be, but very few people can wrote like somebody else.

3) I posit that if they weren't good intentioned they'd have hacked DHS.

It would not surprise me if this turned out to be a bunch of CS/security professors or the like, or their minions doing their work.

From the message, I'm absolutey certain they're in America, and had either a very rigorous or British schooling.

1) The text was syntactically and grammatically near perfect. You don't often see that in these sorts of things.

2) The cadence and style was sort of familiar. I was always able on usenet to identify forgeries not by the path, but by the way they were written. Any idiot can put words where they're not supposed to be, but very few people can wrote like somebody else.

3) I posit that if they weren't good intentioned they'd have hacked DHS.

It would not surprise me if this turned out to be a bunch of CS/security professors or the like, or their minions doing their work.

From the message, I'm absolutey certain they're in America, and had either a very rigorous or British schooling.

That's some serious insinuation. The academic security community is FOR public disclosure. That makes even less sense than the manifesto.

Re:Some observations

[osu-neko]

1) The text was syntactically and grammatically near perfect....

From the message, I'm absolutey certain they're in America

Huh? You've got to be kidding. Syntactically and grammatically near perfect English almost rules out the author being American. The number of Americans who can speak or write English with the skill of a well-educated non-native speaker is vanishingly small. The non-native speaker is not disadvantaged from having spent a lifetime listening to what passes for English in America. The poor American has to first unlearn much of his or her speech patterns before they can being to learn proper English syntax and grammar.

Re:Some observations

[tcolberg]

I've got a baaad feeling about this...

Re:Some observations

[Anonymous Coward]

You sound like that psycho-analyst from Die Hard 3 - who was almost completely wrong on all counts... but made himself sound important aswell ;)

Re:Some observations

[Anonymous Coward]

They used the spelling 'advise' where an American would have used 'advice'. So, probably British, Aussie or Kiwi - or pretending to be.

http://romeo.copyandpaste.info/txt/imageshack-pwned.txt

Re:Some observations

[Anonymous Coward]

What?

Your writing, like much of the writing in this thread, indicates you have no idea how language works. Like many people, you seem to have a very twisted notion of "correct". When large populations of people start saying something differently, that becomes the new "correct". What is correct will also vary by geographic and socio-economic factors.

Re:Some observations

[Anonymous Coward]

Or an American with bad spelling. :-)

I've noticed there is a lot of confusion among Americans about how to spell the phoneme /s/ in various words. Often they end up spelling outside of what is considered correct in their home country, but correct in other places, without realizing/realising it.

And that makes sense. The spelling of many words is confusing and arbitrary anyway.

Re:Some observations

[libkarl2]

I don't know about the CS prof theory, but I'm not really willing to simply dismiss it offhand.

There is a definite schiziodal declaration and different psychological knowledge embedded in their intent statement. The tracts of their manifesto (what I could find) struck me as doctrinaire, and para-moralistic: precisely the type of High Ideal/Low Internal Projection thinking that sucks in well intentioned but young, frantic, and inexperienced activists. They feel their cause is bigger than the damage they inflict on innocent by-standers, when in fact it is because their cause lies just slightly outside the normal person's worldview IMHO. They are becoming frustrated. They have to attack in order to be heard. They've already subverted their own cause in this regard. They've doomed themselves.

Security by obscurity is proven myth. I would hate to have to be on the wrong side of that debate. Doesn't sound like much fun, and anything you say or do is only going to serve to strengthen your opponent's position.

Ah, to be young again... and have absolutely no idea what I am doing...

Re:Some observations

[SlashBugs]

No, that use of "advise" doesn't make sense in British or Aussie English. Brits and Aussies agree with North Americans that "advise" is a verb, "advice" is a noun. It's just a typo. Skimming that text, nothing leaps out at me as being specific to British or US English.

Re:Easy to identify ?

[Anonymous Coward]

Not necessarily. To me it comes off a lot like Anonymous' writing style (and before I get attacked by rabid fanboys, yes I know they are _not_ Anonymous, completely different group, blah blah gtfo NEWB, and other assorted retarded memes)

Judging by the thought process behind this

[93 Escort Wagon]

So the average age of this group is apparently what, 15 or thereabouts?

Re:Judging by the thought process behind this

[smoker2]

Are we talking about /. now ?
Oh sorry that's mental age.

Re:Help for the unfamiliar

[Anonymous Coward]

meh.
if that's the system imageshak uses... linux 2.6.15-1 ... only that thing has 7 pages of bugs on securityfocus.com....

but... if you are against full-disclosure, why the heck do you hack imageshak ?
securityfocus, milw0rm, and countless other websites should be their target, intead they hacked imageshak...

to me, they're just a bunch of lamers who wanted to shout "hei! we're here too!"...
"everyone and everything is getting owned"... o come on... are you really *that* dumb?

"The security industry uses full-disclosure to profit and develop..."
"our battle is that of the removal of full-disclosure for the purpose of making it harder for the security industry to exploit its consequences"...

it's like saying "i got t3h guns! no one else must have it! i'll protect everyone!"
come on... this is childish...

Re:Help for the unfamiliar

[Anonymous Coward]

Shush, you're not helping the OP's superiority complex.

Re:Help for the unfamiliar

[Anonymous Coward]

Interesting. That does lend credence to the theory that they have an exploit for an old version of sshd, since it's explicitly mentioned in their script output that the servers were running openssh-4.5.

Then again, it's not unthinkable that the script output is faked, and they're just trying to ride the publicity from the supposed break. Without more details it's impossible to be sure.

What is their motivation?

[fictionpuss]

I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.

Is this just another way of the internet evolving itself? If you're an asshole or are part of a company which fucks someones shit up for profit, then in that potential future you'd be vulnerable to backlash. This isn't the chaos ensuing from giving automatic weapons to the mob, as the weapons would only be in the hands of those parts of the mob who give enough of a shit to actively study things which are beneficial to the internet as an organism; thereby sustaining a symbiotic relationship.

Or are they just a bunch of bored script-kiddies? Either way it's interesting.

Re:What is their motivation?

[Artifakt]

Eradicating the script kiddies really sounds like a worthwhile goal in itself, but you're right, it doesn't really make the net any more secure or functional to trim off the low hanging fruit. This looks to be a lone black hat who wants it to appear he falls somewhere in the legitimately gray areas, but really is well over any ethical lines. I suspect the whole presentation of there being a group that stands behind the defacement is itself also false.

Re:What is their motivation?

[Anonymous Coward]

I doubt that they are script kiddies.

They just want companies to stop showing people exploits, so companies that rip people off by offering protection can't continue.

Re:What is their motivation?

[ImYourVirus]

But within publishing the scripts does it not force that company to release a patch for said exploit? Sure by giving other people the ability to abuse it can cause a problem, but wouldn't you say that it causes more good than not?

What if some guy/gal finds a way to hack something and since they can't go public with it, they just share it with their friends or on a private board or something and then the problem goes unchecked and throughly abused until that company notices and *then* fixes it, what if they had known about the problem sooner, would they not have fixed it then?

I do agree that money should not be made from the abuse of the tool (or in any form for that matter (advertisements, selling the tool, etc)) and that perhaps those are the real people that should be targeted instead of the people I might would assume are trying to help by making it obvious that some company needs to fix something instead of letting them try to ignore it and sweep it under the rug.

Re:What is their motivation?

[fictionpuss]

That's the stated goal. But all ideologies have at least one secondary goal which is of greater importance to the members - e.g. religions may preach love and peace, but will do anything (including contradicting the primary message) to protect the secondary goal of sustaining the religion.

Example - if they just manage to get all security companies out of business, then what's to stop new security companies popping up in the future once their movement starts to decay and their numbers drop? Nothing. It would be stupid to only have that as the single goal because it's short-sighted.

So there is a secondary goal at work here, just curious what it actually is.

Re:What is their motivation?

[fictionpuss]

Possibly - anonymous itself could just be three guys in a basement. Then again, it could have started off in a single basement but grew because of the insinuation that it was a large distributed, anonymous organisation.

Both/and?

If the internet automatically detects censorship as damage and routes around it, we're going to be seeing larger and more intricate self-defence mechanisms as it moves from a simple chaotic knowledge-base towards sentience.

Doesn't matter if you don't believe it, the internet will just route around you.

Re:What is their motivation?

[Panzor]

>>This looks to be a lone black hat who...

wants to prove to someone that his life wasn't a waste.

Re:What is their motivation?

[fictionpuss]

Or maybe the current situation is just a local maxima, which we are trapped in?

Every company out there has at least one person who re-uses passwords between systems. Even if it's "only" the admin or a temp - there only needs to be one weak link in the chain.

Security problems are an annoyance foremost, and rarely a disaster. 50% of the windows clients reading this thread could be part of some botnet and they'll never know.

Society as a whole needs to treat security with more respect in order to improve it. Even if that means hiring lots of black-hats on expensive contracts who maintain their own guild-ethos and ungooglable secrets.

Who else is going to tame the corporate beast if not the people themselves? Government? It doesn't seem wise to institutionalise and sanction the use of such dangerous tools.

And isn't that, in a way, the point of this?

Re:What is their motivation?

[Anonymous Coward]

They just want companies to stop showing people exploits, so companies that rip people off by offering protection can't continue.

Or to shore up the black market sales value of exploits. Full disclosure obviously ruins profits.

Re:What is their motivation?

[fictionpuss]

If that's their motivation, then they will fail.

History proves that bad ideas always poison themselves before too long. It's just simple evolution/ or rather emergence.

Re:What is their motivation?

[Nursie]

Why would eradicate the script kids?
They wouldn't have as ready a source of info to make their scripts with, but I don't get the feeling they'd be the ones making the scripts anyway. Their scripts come from black hats that have skills.

Frankly all this would do is mean that companies *cough* MS *cough* could get away with not patching stuff for longer, leaving things even more vulnerable. It's lunacy what they're asking for.

Re:What is their motivation?

[fictionpuss]

If these black-hats win, they'll not be giving shit to the script-kiddies. Period.

Lunacy is what we have already[1]. Reality is a bit more relative.

1 - Doing the same thing again and again, expecting different results. Buying the latest firewall or virus software has never, and will never be a guarantee of security.

Re:What is their motivation?

[_Sprocket_]

I mean, if they got their way, completely. What would happen? Anyone motivated enough could find an exploit of their own and hack anyone else. But presumably this would eradicate the script-kiddie element as it would require an element of skill.

It goes back to an amplified version of the old BBS philez days. Except now they're not historical curiosities but relevant instructions as the exploits they describe remain current. At least, for a short while.

Since we're not falling back to the old analog MODEM days, but remaining here in the current Internet era, these tutorials will be just as distributed as they are now. They'll be fed in to the underground community instead of the general public. But in the Internet era, that underground community is much more connected and vast. The only limiting factor will be the rate of trickle-down as a zero-day spreads from the inner circles to the general community.

Of course, there's money to be made on this information. Malware markets and security vendors will both eagerly offer bounties for the information while attempting to cultivate direct contacts / placement in those communities. Once malware is developed on a new exploit, security vendors will analyze it to update their software. And in kind, once security vendors update their software, malware marketers will analyze patches / releases and develop malware seeking to take advantage of the adoption curve.

In short, we'll cycle through the 80s and 90s up to today's environment in record time. With arguably more chaos.

Re:What is their motivation?

[fictionpuss]

If you discover another zero-day root exploit in the Linux kernel on your own, and you have the means to sell it to the highest bidder for a nice pile of cash, then neither you nor the winner have a motivation to pass on that secret to the underground.

If there are fewer active vulnerabilities floating in the underground - accounting for accidental or the occasional intentional leak - then how is that more chaotic than what we have now?

I'm curious - I'm not an expert in this stuff by any means.

Oh wait, this reminds me a little of the Linux-development policy change with regards no longer enumerating the fixes and vulnerabilities which comprise each release version -- do you similarly believe that policy will lead to more chaos?

Re:What is their motivation?

[Bert64]

What would happen, is that the prevalence of unskilled script kiddies would massively decrease, and the background scans taking place constantly would decrease... Because the perceived threats would have abated, people wouldn't bother installing updates or taking any measures to protect themselves. Also without public disclosure and/or active exploitation, software vendors would downplay the seriousness of their vulnerabilities and delay providing patches for them.

The end result of this, is that the smaller number of people who can acquire exploits, and this includes paid criminal gangs, would have a lot more power because they would no longer have to compete against the script kiddies for control of drone systems.

Incidentally, i am also against the *free* disclosure of vulnerabilities in non free software... Commercial vendors charge you a lot of money for their software, and can often be hostile or uncommunicative towards people who find bugs in their software... These people finding bugs are effectively doing their jobs for them and get nothing but grief in return, so it's no wonder that so many bug hunters are now working for criminal gangs.
A lot of these vendors want you to do their beta testing for them for free, and then report the bugs privately to them so they can silently fix them not even giving you credit for the find and often not disclosing any details to the public other than perhaps providing a black box patch.

Re:What is their motivation?

[Bert64]

You won't be trimming off the low hanging fruit, you will simply be raising that fruit a few inches higher... And because less people will now be picking it, those people who are a bit taller will now have a lot more easily accessible fruit to pick.

Re:What is their motivation?

[Nursie]

1. How do you know?

2. *These* black hats. unlike all the other black hats that already provide the tools. Right.

Re:What is their motivation?

[maxume]

It's impossible to guarantee security, so saying something won't do it isn't exactly a huge indictment.

Re:What is their motivation?

[ImYourVirus]

My sentiments exactly.

Re:What is their motivation?

[fictionpuss]

1. I don't know. I can't see any reason why they would.

2. Currently there are at least two markets - the financial incentive for selling exploits, and the meritocracy for providing "tools" that script kiddies can use based on fully disclosed vulnerabilities.

What I see is a line drawn in the sand. For what reason I'm not sure.

Re:What is their motivation?

[_Sprocket_]

If you discover another zero-day root exploit in the Linux kernel on your own, and you have the means to sell it to the highest bidder for a nice pile of cash, then neither you nor the winner have a motivation to pass on that secret to the underground.

If there are fewer active vulnerabilities floating in the underground - accounting for accidental or the occasional intentional leak - then how is that more chaotic than what we have now?

Such markets exist today. Yet we still have public disclosure (full disclosure or otherwise) of vulnerabilities. And we still have an underground counter-culture. It would seem that a "nice pile of cash" is not the only motivator (although even public exposure can lead to said cash - which is part of the criticism made in the manifesto).

Black markets don't eliminate spreading of information. They are themselves motivators for dissemination. And they represent the worse possible channel for vulnerability research - a group financially motivated to use a vulnerability in the most effective hostile way. Whether that is "chaos" or not depends on your point of view.

Oh wait, this reminds me a little of the Linux-development policy change with regards no longer enumerating the fixes and vulnerabilities which comprise each release version -- do you similarly believe that policy will lead to more chaos?

On first glance, I would say that this isn't the same issue. One of the ultimate goals of full disclosure is to get a vendor's attention about a vulnerability and get it fixed. If the Linux kernel devs are the vendor and they've already fixed an issue, then it's not quite the same situation as an independent entity saying "hey - I found a problem you guys need to fix ASAP."

Having said that, another aspect of public disclosure is letting EVERYONE know that there's an issue to address. This behavior does no favors to Linux's user base who should know that there are issues that need to be addressed quickly. Serious problems may go overlooked unless someone else realizes the implications of the cryptic bug fix note and alerts their user base (i.e. a distro).

Is it chaos? It's not as bad as an unpatched vulnerability that becomes well-known to hostile entities. But a well known but not widely patched vulnerability could be just as bad (as our current botnet examples show).

I should note two things that I think I wasn't very clear on earlier: secrecy and markets.

First, the 80s demonstrate that the idea of keeping vulnerabilities secret doesn't work. Eventually things get uncovered and secrets get shared. And now our ability to share has increased dramatically. So while this manifesto might be appealing to the crowd that would like to put security back in the secrecy bottle, they're fooling themselves to think it's possible.

Secondly, my concern is that this is really about limiting market competition. If money is a motivation, you'll find it existing in open markets and black markets. The manifesto seems keen to tear down that open market. And while I agree that theres a lot of snakeoil in the security industry, I'm not so sure we want the malware market becoming the defacto place to sell vulnerability knowledge.

The motive and action contradict each other..

[Seth Kriticos]

The fact that they hacked ImageShack shows that there is a vulnerability, probably one that was exposed before. In terms of natural selection this is a good thing to make the severity of the vulnerability clear. I think it would be a good thing if this kind of attacks would happen more often to get a better relation to security situation overall, because many companies and individuals tend to ignore otherwise.

Their message is complete bullocks tough. Full disclosure in combination with destructive exploiting would harden the technology, but their agenda is to just 'not talk' about holes in the security, which is completely stupid, as it would only produce a temporal or no relief at all and then someone would wreck much more havoc.

So their statement "Security through obscurity" is complete crap, but we already know that.

Now away from wishful thinking, what will probably happen?

1. As these guys/girls (probably script kiddies, as they don't seem to have much cognitive power) did cause some financial damage, they will probably be tracked down and sentenced to something not nice for them (as they stepped on both sides toes).

2. People with financial interest exploiting vulnerabilities will continue to do so while they'll be staying below the radar (full disclosure or not, it stays like this), as companies don't give a damn in cases where the damage is not obvious or not on their side.

3. Security industry will stay as it is - because the white hat approach works better than the alternative.

More info

[mrkitty]

@ http://www.cgisecurity.com/2009/07/antisec-hackers-replace-all-imageshack-images.html

I agree

[Anonymous Coward]

Full disclosure is not the solution for security vulnerabilities like this one, oh wait...

Re:Help for the unfamiliar

[klui]

Interesting. That does lend credence to the theory that they have an exploit for an old version of sshd, since it's explicitly mentioned in their script output that the servers were running openssh-4.5.

Then again, it's not unthinkable that the script output is faked, and they're just trying to ride the publicity from the supposed break. Without more details it's impossible to be sure.

img1...us is running on 4.5; there is no img998...us though. Yes, the logs definitely don't show all details nor do we have any way of knowing if they're all true. Their hack into two other sites appear to indicate they used a OpenSSH 4.3 vulnerability. http://romeo.copyandpaste.info/txt/nowayout.txt http://romeo.copyandpaste.info/txt/ssanz-pwned.txt

Others have linked to other sites on this thread that speculates a 0-day vuln for the most up-to-date version of OpenSSH exists and this is a way for them to target more people. That would be interesting. It will show if the open method is good for exposing bugs in a timely manner. It will also show how a lot of sysadmins not have the time or maybe skill to go over all changes in a distribution to see if it's secure. I know many times I would download a dist. and compile and if make test passes, I install.

Re:Help for the unfamiliar

[klui]

Damn, I meant to say 998 doesn't show what version of SSH it runs.

Err... wait...

[Anonymous Coward]

Bring it on.

Let them attack as many sites as they like. If there really are that many top-secret vulnerabilities that they know about, why not let them reveal their existence?

Sounds pretty silly to me.

IMAGESHACK? OH NOES!

[Philip K Dickhead]

My Pr0n Has Been Replaced by a Manifesto!

What's next, Rapidshare?

WE WANT MORE!!!!

[Anonymous Coward]

http://www.zone-h.org/mirror/id/8961233

Pretty much

[Sycraft-fu]

It'll be quite amusing to watch their dumb asses get drug off to prison if they actually carry out their threat of "destruction and mayhem." Cyber criminal types seem to forget that when it comes to criminal investigations, the bigger a target you make yourself the more likely you are to get caught. When you are just causing trouble, there just isn't enough care to really devote any resources to going after you. However if you do real damage, all of a sudden there's more interest. The more damage, the more resources spent in finding you.

This is why when your car is broken in to, you get to fill out a police report and maybe have a cop come dust for prints. However if someone if murdered, there are cops all over, detectives assigned to the case and so on. The more harm you cause, the more dedicated they are to finding and stopping you.

However, my guess is like most of these Internet Tough-guy hacker types, they've got no way to actually carry out any sort of threat. So they'll just do stupid shit like deface images on imageshack, and nobody will care enough to try and track them down.

It's in their name

[Anonymous Coward]

Images hack us

my $0.02

[pjr.cc]

Reading the text of their "manifesto" is quite interesting (assuming the link above actually points at what they said).

I don't believe its incredibly accurate (what they claim). Full-disclosure (if you've been around for a while) sort-of came about due to the security industries inability to actually respond to real threats (and they are still incapable of it). Often exploits would become available over the 'net from script-kiddie producers (i.e. the people with the real brains to figure out wholes in software and produce something even a script-kiddie could use) and so when something like SSH was "exploited" it was typically a case of the script kiddies being armed before the targets of the exploit.

Now-a-days, full disclosure mostly benefits the industry cause when the "ssh" attack came out, every person who wrote an ssh server could check to see if they were vulnerable and patch appropriately rather then say (only) f-secure finding out about the hack, fixing their own server software then running around telling everyone that "only we're secure!".

However, i dont get why imageshack were attacked, they seem to have very little to do with the people they claim they "are a target" of their rampage. Or was it just cause its such a widely used website that alot of people would see it where as most security-related sites are pretty low on the radar for alot of people?. What are imageshack doing running fedora core 5 (at least, the way i read that post they appear to be running an fc5 kernel)?

Of course being a linux advocate, why couldn't they have attacked a windows based server farm? Or made every ATM in the world print their message (now THAT would have gotten some serious publicity).

Re:my $0.02

[Anonymous Coward]

Of course being a linux advocate, why couldn't they have attacked a windows based server farm? Or made every ATM in the world print their message (now THAT would have gotten some serious publicity).

Thats because linux is easier to root than windows. Linux has and always had overwhelmingly more exploits.

Though, % of incompetent sysadmins is higher on the windows side than on Linux. Simple things like keeping machines patched and not running executable attachments would eliminate 99% of all security problems on windows.

tl;dr

[Anonymous Coward]

If they really wanted to get their message across, they could have made it a bit more to the point. 90% of people aren't going to read some random wall of text.

Re:tl;dr

[Anonymous Coward]

I think the vey existence of the term tl;dr (too long; didn't read for those wondering) shows what's wrong with today's netizens.

They are either too stupid to express themselves coherently or too stupid to understand a well-written text.

Re:tl;dr

[The End Of Days]

Or just not interested in the same stuff as you.

I wish I could say I too long for the days when I was part of a special elite by virtue of the fact that I could use the Internet, but in truth regular people are a lot more fun to talk to than nerds so I don't.

Re:tl;dr

[Anonymous Coward]

If you were really not interested, why would you comment at all with a silly abbreviation like tl;dr instead of just ignoring the topic?

See, my point still holds. Commenting some long text with tl;dr shows you are remotely interested in the subject. But alas, you couldn't keep concentrated long enough to understand the whole text.

OR

The text is so badly written that it really is a chore to walk through. Either way, one of the participants in the discussion is showing his stupidity. Which is all I said.

Re:first post

[pitchpipe]

I love that the parent was scored (Score:-1, Redundant)

actually one more thing....

[pjr.cc]

(this is intended mostly as humor more than reality)

On the plus side, if any security group you buy software/hardware from gets hacked by these guys, you know that perhaps you choose the wrong security software/hardware provider... But, no doubt, the security consultant of their closest competitors will be knocking on your door shortly to sell their own product and show how anti-sec haven't hacked them yet! ;)

Example of a virus from Image Shack.

[afxgrin]

A friend of mine had her machine infected with one of the imageshack exploits. It was basically a double extension EXE, labelled like Aphoto.jpg__________________.exe

She wasn't paying much attention and had hit OK when prompted to run the program. So her computer had started sending me MSN links to similar images hosted on ImageShack.

Here's the EXE that I got sent.

Someone I was chatting with in a technology IRC chatroom had run the virus in a VM, and it apparently has code to detect the presence of a VM, rapes your registry, spreads itself to multiple EXEs across your system, and a bunch of other weird things. The code is apparently run through one of those code masher programs to prevent decompilers.

Re:Example of a virus from Image Shack.

[billcopc]

That's SOP for viruses these days, it's really just a matter of copy/pasting the relevant bits of code, and/or shoving the EXE through an obfuscator. Writing viruses only requires a modicum of C knowledge these days, everything else is automated with tools by real hackers.

The fact that we can "sneak" 100-200kb viruses certainly helps. Back in the day, you had to cram your attack into a 512-byte boot sector or hide it in the stack segment without increasing the file size... today's virus writers probably don't even know in which direction the stack grows :P

Actually they are retired Sergeants of Marines...

[atrocious cowpat]

What?

ac :)

US Gov't

[Anonymous Coward]

I believe the US Gov't and other industries that have been harmed by full-disclosure is involved with this, and that the effort involves more than one "group".

Double Speak

[Anonymous Coward]

That "manifesto" is an obvious attempt at reverse psychology. Large corporations and governments would LOVE to eliminate full disclosure. Exploits and fixes will then become trade secrets and sold off at a premium to the richest customers that can afford the "Elite Protection Package".

The best disinfectant will always be sunshine, not shadows.

My best guess is...

[bXTr]

• This is a legitimate threat, and they're truly against full disclosure.
• Or they're using reverse psychology and are for full disclosure.
• Unless they're using reverse-reverse psychology and are really against full disclosure.
• But maybe they're using reverse-reverse-reverse psychology and are really for full disclosure.
• ...
• Or they're just a bunch of script kiddies trying demonstrating their "l33t 5k1lz".

Re:My best guess is...

[misexistentialist]

I think this is an occasion, possibly, and with a shudder, to use the dread word, carefully and with much caution (Dare I say it? Can I in good conscience? Mea culpa!) irony.

Re:My best guess is...

[apresrasage]

• Or they're just a bunch of script kiddies trying demonstrating their "l33t 5k1lz".

Sadly, most scrip-kiddies would not be able to read the last sentence and paraphrase it. (btw: that's 1337)

"Look out, we'll further ruin our own credibility"

[Pahalial]

Is anyone else tremendously amused at the method these guys have chosen to get their message out? I don't necessarily disagree with them - specifically, I usually only believe in full disclosure being necessary when an exploit is already in use in the wild - but it seems to me that they're just going to polarize the debate against their own position. IT security geeks are notably stubborn, defiant, etc., and being attacked over this will only entrench them further in their position. And to add to this, the 'attack' is frankly negligible - your blog will be defaced! Of course, you will certainly have backups now that we've warned you, but it'll still be defaced for up to a few hours!

What a load of...

[Anonymous Coward]

Reading this "manifesto" very charitably for the sake of an argument, the point appears to be that these people think (or purport to think) that the security industry creates the problems it'll then fix for money.

This, of course, is patently absurd; the problem that needs fixing is not the existence of an exploit but the vulnerability that is exploited. If a security researcher found it, a blackhat might find (or have already found) it as well, and then there'd be real trouble. A boat does not spring a leak only after someone found and told people about it, even if that someone is a carpenter who offers to fix it for a nominal fee.

And what's bad about that, anyway? Of course the security industry is about money; it's an industry! The people who hire them also do so for money, specifically to not lose a lot of money when the aforementioned blackhat comes along and tries to crack their network.

Also, I have seen some people here argue that the internet would be a better place if vulnerabilities and exploits were only available to people in the know. Them I must ask: Are you insane?

From the ability to find these things good intentions do not necessarily follow. If you think they do, you might want to educate yourself about the blackhat industry; for starters, FireEye's blog does a relatively good job of explaining their methods (among other things). Unsurprisingly, it also works for money, but unlike the security industry, it is in the business of exploiting vulnerabilities instead of fixing them. Make no mistake, there are criminal syndicates (such as the RBN) that employ blackhats who are in the know.

Sure, you might have a few less script kiddies around (might, not would. Remember the internet 15 years ago? No disclosure, but also no shortage of script kiddies), but script kiddies are mostly just an annoyance. The really dangerous guys would absolutely love it if the vulnerabilities they exploit were kept secret.

Finally, it should go without saying but doesn't that this kind of vigilante approach is highly despicable, especially because whitehats are well within their rights to disclose whatever they want and would be so even if disclosure was morally questionable. Approve or disapprove of full disclosure, you do not get to tell them what to do.

All of this only applies if these people actually believe what they wrote there. I am not convinced of that, but until I see evidence to the contrary, I will assume they're just stupid, not evil.

so, does this mean...?

[Anonymous Coward]

Given slashdot's stance on full-disclosure and security, anybody think this site may be targeted? Just curious...

Re:Help for the unfamiliar

[WarlockD]

So wait, the whole explotie was 900+ servers of unpatched OpenSSH?

Why the hell was OpenSSH open to ALL those servers? Don't they have a VLAN for that sort of internal config? Hell, Yahoo uses a bunch of terminal servers hooked to the serial port to prevent this kind of thing. I bet this is older unpatched OpenSSH too.

Don't know if I agree with their messages, but since the OpenSSH exploits were public for a while now, one would think everyone would be patched.

Re:first post

[cbiltcliffe]

Yeah.

It's not so much "Redundant, because somebody just said that two posts higher," as it is "Redundant, because we've seen that for the past 28,751 /. stories...."

"What if someone uploaded child porn"

[Anonymous Coward]

What if someone uploaded child porn and it appeared on my forum?

Then you could start charging $20 at the door, Pedobear.

FYI, conviction requires intent. If you never intended it, you didn't commit a crime, except for manslaughter.

If you catch a thief breaking into a house...

[amn108]

Let me describe a useful analogy: When a house alarm code is "guessed" by a thief, and the thief is caught, the media report, if any, usually does not include disclosing the code on your TV-screen in big letters along with instructions how you too can do it, as they cover the incident. Does it? This is however much like what reality is for IT players. As soon as one person breaks into another partys authorization domain, he/she feels it is their democratic duty to let any and all others know how they can do the same. Disregarding any opinion the target party of the break-in may have about it. Why? Some twisted moral codex, mutated from reality into virtuality, I guess.

Re:If you catch a thief breaking into a house...

[shish]

If your alarm's password is broadcast over national TV, and you don't change it (ie, patch the hole), you're an idiot :-/

As soon as...

Last I checked, whitehat protocol says that you inform the vendor, and only release after they've either fixed it or spent a couple of months ignoring it

Re:If you catch a thief breaking into a house...

[zuperduperman]

Your analogy is the strawman they want to present. The reality is actually that nearly all whitehats subscribe to a policy of full disclosure only after notifying the vendor / owner of the software and giving them a period of time to address it. Full disclosure occurs when that process fails. So it's not the same as displaying your security code on TV - it's like sending the company that makes the security system a letter warning them about a fault in their system that applies to everybody using that system, then hearing nothing back, then realizing that a significant number crooks are probably aware of the problem and then finally publishing an ad in the newspaper when it is clear that there is enormous risk to the community.

Picking Legitimate Targets

[Zerocool3001]

It seems a little odd to me that they picked an image hosting site (especially one a few steps above rapidshare in usefulness) to attack first. One of their stated goals from their website:
http://romeo.copyandpaste.info/

-----[ Check list / Goals: Take down every public forum, group, or website that helps in promoting exploits and tools or have show-off sections. Publish exploits rigged with /bin/rm to whitehats, let them rm their own boxes for you. Spread the anti-security movement. Revive pr0j3ct m4yh3m.

I understand that imageshack might get people's attention and spread your message, but if you stated goal is to attack sites that host tools and disclose exploits, wouldn't something like Sectools.org be more appropriate? Or maybe they couldn't handle something legitimate... Also, it seems likely that they would use tools distributed from just such a site to exploit an OpenSSH vulnerability.

a better place

[Anonymous Coward]

Who knows anti-sec is a group? I wouldn't be surprised this sort of action comes just from one man, pretending to be a group a sick showoff. He needs some attention, in that he is succesful.

How would you know?

[Anonymous Coward]

How would you know? How would we even know it's a group, rather than a lone bottom feeder in his parent's cellar? Or just some loose bunch of people without much organisation, coherence or anything else that makes it an actual group? Even if it is, how would we know it's the same group as then?

Excellent use of irony

[gr8dude]

I think they are pro full-disclosure, and this action is just a pun.

The message they are trying to get across is: "If you close your eyes, the world doesn't disappear. Here's an example of a hack, just to show you that vulnerabilities will continue to exist even if you don't make them public. Not only that, but there will also be people who will find them and use them, regardless of your will to make them public or not".

The message is worded well, others noticed it too; I think the author is too intelligent to be so ignorant of the truth.

0day exploit in OpenSSH, and thieir IP address.

[Doug52392]

I'm surprised this hasn't been mentioned yet: This same group claims that there is a 0day vulnerability in OpenSSH, and used it to attack the site of a security consultant: More here.

And, what do you know? These kids (yes, script kiddies, most likely teenagers) FORGOT TO REMOVE THEIR IP ADDRESS FROM THAT POST. 125.238.144.224.

I, for one, find it quite ironic that they want "full-disclosure" abandoned, yet they know about a potentially devastating vulnerability in OpenSSH and won't tell anyone. Kind of reiterates why we need full-disclosure.

Re:0day exploit in OpenSSH, and thieir IP address.

[oberondarksoul]

I, for one, find it quite ironic that they want "full-disclosure" abandoned, yet they know about a potentially devastating vulnerability in OpenSSH and won't tell anyone. Kind of reiterates why we need full-disclosure.

Hardly ironic. If they claim to be against full disclosure of bugs, the last thing they want to do is to disclose their own pet vulnerability. It would be ironic if they were to disclose it, instead.

Re:0day exploit in OpenSSH, and thieir IP address.

[Anonymous Coward]

This same group claims that there is a 0day vulnerability in OpenSSH, and used it to attack the site of a security consultant:
They never claimed any such thing, They posted heavily-edited logs, and people assumed they have openssh 0-day.

And, what do you know? These kids (yes, script kiddies, most likely teenagers) FORGOT TO REMOVE THEIR IP ADDRESS FROM THAT POST. 125.238.144.224.
You're an idiot. That ip address belongs to the admin. Learn how to interpret the output of '/usr/bin/w'.

Um...

[shish]

They're demonstrating that full disclosure is bad, by making use of a secret exploit? And they aren't going to release the exploit so that it can be fixed, they're going to keep it for themselves so that they can hack more people? Do they not realise that they just shot their own point in the foot? :-/

no, this isn't interesting.

[Anonymous Coward]

You should hack them back.

Thanks

[Anonymous Coward]

Well done, saved me some typing. I was reading down through this whole thread wondering when someone was going to apply flatfoot 101 to this and come up with the (most probable) real explanation.

They messed up one of my posts on Superiorpics

[Master of Transhuman]

with this shit.

They better pray I never learn who they are in the real world. They've got a .45 hollow point coming fast toward their kneecaps.

Centrist terrorists

[Michael Woodhams]

This reminds me of a "Not the Nine O'Clock News"* skit interviewing a spokesman for a centrist terrorist group.

"All we want is peace and tolerance, and we're prepared to maim and kill to achieve our ends."

Straying off-topic, another favourite quote from the show: "Political scientists think they have finally understood current [Reagan era] American foreign and defence policy. Having been late for the last two world wars, they want to make sure they are extra early for the next one."

(Both quotes from ~25 year old memories and are therefore unreliable in detail.)

* A British 1980's politics/satire/skit comedy TV show.

anti-sec?

[Anonymous Coward]

more like anti-suck!

man, what a bunch of dicks..

Reminds me of my government

[JJJK]

Remember how germany outlawed "hacker tools"? I guess these anti-sec-terrorists can relate to that. Thinking that banning something easily available will help anyone but criminals is very similar to thinking that bullying people into shutting up will stop hackers from finding security holes.

Well-meaning but technologically ignorant politicians are one thing (personally I think they are the biggest threat to science and progress), jerks like this are another. I'm sure they are a bunch (if there is more than one) of angry young men who feel like they know exactly what's best for the world and who are almost religiously passionate about imposing their will on others.

I'm sure many of us have felt something similar at some point of our lives, but the origin of that emotion is a need to feel powerful - not solving some problem or anything altruistic at all. If you resort to terrorizing people so they act the way you want them to, then you are nothing but a power-hungry terrorist. No matter how pure you think your reasons are.

What are the trying to prove anyway.

[portalcake625]

Sure they were demoing Imgshack's insecurity, but this is really not the way to get heard. They should have made a racket at a DEFCON, where all their "security experts" are. Otherwise, this just pisses a whole fu**ton of people who haven't realized this and not switched to Photobucket.

Re:Help for the unfamiliar

[Anonymous Coward]

Can't believe they're using the glider as their favicon... the idiots probably don't even know what it means.

A good consipracy theory is an unproven one

[apresrasage]

Many a contributor asks here:
what's the motivation and why the specific target?

If we follow the money we get:
1) Non-open-source software shops
2) EOM software shops
3) Propriatory software shops

Oh, did I mention that posting spolits hurts those who are not open source, but helps
the open source community to debug and fix software in a fraction of the time this gets
(if every) done in closed shops?
It also allows sysadmins to take action in a meaningful
way. Yeah, the security dudes get a cut from this too if you let them.

As in other incidents where the terrorist and rebel has way less to gain than many other
interest groups ... something smells fishy here ... if we just could prove this ...

Removing competition?

[Anonymous Coward]

Remove full disclosure of exploits so script kiddies stop capturing the vulnerable systems that the "Anti-sec movement" guy wants for themselves. Nice.