Slashdot Mirror

← Back to Stories (view on slashdot.org)

Turning Attackers' Tools Against Them

Posted by kdawson on from the back-bearings dept.

Tasha26 writes "The BBC has an interesting Web security snippet from the SyScan 2010 security conference in Singapore. In a presentation, security researcher Laurent Oudot released details of bugs found in commonly used attack kits such as Neon, Eleonore, and Sniper. These loopholes could be exploited to get more information about the attackers, perhaps identifying them, stealing their tools and methods, or even following the trail back to their own computer."

13 of 75 comments (clear)

  1. Time for hacker bounty hunter! by maillemaker · · Score: 5, Interesting

    There should be bounties put on these folks spreading this shit.

    --
    A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
    1. Re:Time for hacker bounty hunter! by tnok85 · · Score: 4, Funny
      In a special two hour edition of Dog the Bounty Hunter, Dog gets his first Macbook and hacks his way to take down his target!

      *watches two hours of Dog learning to search for people on FaceBook*

    2. Re:Time for hacker bounty hunter! by betterunixthanunix · · Score: 3, Insightful

      Why? "We connected our mission critical systems to a public communications network, and random people on that network are probing our systems! Waaaaah! Wait, let's probe their systems too!"

      --
      Palm trees and 8
  2. But did he do "responsible disclosure"... by John+Hasler · · Score: 5, Funny

    ...or did he behave irresponsibly and publish the bugs without giving the vendors time to issue patches?

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
  3. Low hanging fruit by retardpicnic · · Score: 5, Insightful

    Meh... Thae fact that there are errors and vulnerabilities in web based tools just means that they were written by programmers who largely don't have peer code review, which is why so many computer viruses never get to trigger or release paylod, the only working part of them is the infection mechanism. Perhaps these vulnerabilities would aid n catching a script kiddie who had downloaded a poorly programmed tool and was dumb enough to launch from his own computer. Nobody with brains would launch from "home", they would use bots, which means the police will be storming an old age home with grandparents still using windows 95. I do applaud looking at hacking tools though, I workd for a company that used a stripped down, harmless version of the sub7 trojan to deploy software and it was far superior to commercial deployment solutions at the time.

    --
    sig loading.......
    1. Re:Low hanging fruit by DigitAl56K · · Score: 3, Insightful

      Thae fact that there are errors and vulnerabilities in web based tools just means that they were written by programmers who largely don't have peer code review

      The fact that there are errors in these attack suites in particular is probably more because their purpose is to attack others with no expectation that counter-attacks are likely to happen, at least against these tools themselves.

      I workd for a company that used a stripped down, harmless version of the sub7 trojan to deploy software

      Funny you bring that up. Older versions used to have a hard coded master password that could be used to steal Sub7 systems, W32/Leaves took over systems that way.

  4. No Honor Among Thieves by IonOtter · · Score: 4, Insightful

    Do you really think that the creators of these "tools" aren't going to leave SOME way of getting back into them? To prevent them from being used against their own systems?

    "Did you really think you could use my own spell against me , Potter?" -Severus Snape "HP: THBP"

    --
    [End Of Line]
    1. Re:No Honor Among Thieves by WrongSizeGlass · · Score: 3, Interesting

      Do you really think that the creators of these "tools" aren't going to leave SOME way of getting back into them? To prevent them from being used against their own systems?

      No, of course not ... though they may install a copy of Kaspersky to remove the competition from their latest conquest.

  5. In other news... by nacturation · · Score: 4, Funny

    In other news, researchers learn that script kiddies tend not to be very good software developers.

    --
    Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    1. Re:In other news... by Gadget_Guy · · Score: 5, Insightful

      In other news, researchers learn that script kiddies tend not to be very good software developers.

      Surely the very definition of a script kiddie is someone who doesn't write hacking software, but uses software built by others.

      I think this shows that the hacking community can be a bit arrogant, and they think that hackers won't go after one of their own.

  6. Illegal in many jurisdiction by Isao · · Score: 4, Interesting

    This is great intel, no doubt. There's a bit of irony in reporting vulnerabilities in malware - can I get a CVE for that? Counter-attack has a bunch of potential issues, though. The primary one is attack attribution, and the other primary one is that it's not legal in many places (including the United States) to counter-attack your attacker. If you execute code or access a system without the permission of the system-owner, you're in the same crime category as the original miscreant.

  7. drug dealers can't report theft of drugs by circletimessquare · · Score: 3, Insightful

    likewise, what hacker is going to report that someone reverse engineered his hack?

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  8. Re:walled garden version for the rest of us? by ArghBlarg · · Score: 4, Insightful

    Haven't they already taken the first step with compulsory driver signing in their 64-bit OSes? I hear there's a registry hack to disable it... for now. But MS would -love- it to be mandatory, they've been laying the foundations since the original "Trusted Computing Platform Alliance" days haven't they? I don't keep up to date on all this stuff so maybe it's not so true anymore.

    --
    ERROR 144 - REBOOT ?