Slashdot Mirror
Lone Iranian Claims Credit For Comodo Hack
nk497 writes "A boastful Iranian hacker has claimed sole responsibility for the Comodo security certificate attack, saying it had nothing to do with his government. The 21-year-old claimed via a note on PasteBin, 'I'm not a group of hacker, I'm single hacker with experience of 1,000 hackers.' While some researchers believed his claims, saying the media had accepted Comodo's claims that the attack was from the Iranian government too easily, others said it was impossible to tell if the hacker was real, or a PR move by Iran."
Isn't Slashdot providing this dude a platform for [free] publicity? Why is this story even here? Nothing about it is substantiated at all.
The only thing I can guarantee is that there is a human being at the other end who is now in the news.
New infosec meme.... "with experience of 1,000 hackers."
This message is sort of retarded. First he tried to solve prime factorization, and then he was like "maybe I should hack a CA instead"? And later he will do us the favor of "proving it is not possible" to come up with a prime factorization algorithm?
I'm glad there's no rule #34 of this Iranian hacker.
This is the first I saw a straightforward description of the hack... "SQL injection, then privilage escalation, got SYSTEM shell, remote desktop, investigation and I discovered trustdll.dll :)"
Where trustdll.dll was a c# lib he decompiled and saw hard-coded credentials.
This was it? Really?
I mean come on, really?
'I'm not a group of hacker, I'm single hacker with experience of 1,000 hackers.'
Sounds just like the Iraqi Information Minister or Kim Jong Il. "Oh no no no! I not a group or government no! I am super skilled hacker with skill of 1000 men. I can play 18 rounds of golf in 18 shots by getting 18 hole in one. Yes! I just that good!"
Weaselmancer
rediculous.
Hmm... If I understand your post correctly, let me comment a bit:
Do you know how certificate signing work ?
Done properly, one should never reveal its certificates private keys at any time. So in the end, a certificate signed by an external company should be as confidential as a self signed certificate or a certificate signed by a company you trust.
This is the whole idea behind PKI.
Granted, I have seen many people who do not understand this important point. I have seen cases where the the signing authority was aware of the private key but this should never occur if you know a bit about PKI 101.
Everything I write is lies, read between the lines.
The individual, who calls himself ComodoHacker
Well, there you are.
Snake Plisskin. I've heard of you. I HEARD YOU WERE DEAD!
I've grown 2,415 times smarter since then.
Follow-ups:
"I should mention my age is 21"
"How smartass you are?"
"My orders will equal to CIA orders"
"I'm a GHOST"
"I'm unstoppable, so afraid if you should afraid, worry if you should worry."
"I did it one time, make sure I'll do it again" (reminds me of Steve Ballmer)
"RSA 2048 was not able to resist in front of me"
deserves 1000 virgins in the afterlife, right?
I think 1,000 hackers is a pretty cool guy. eh takes over comodos and doesn't afraid of anything.
You can hold down the "B" button for continuous firing.
I read all of his Pastie's.
If you want a laugh, read them.
A lot of egotistical shit talk from a guy who doesn't realize RSA simply cannot be "cracked". It's impossible.
If you had any common sense, you would use your "hacks" on the actual people who have/had access to having CR's resigned.
Also, let's not just throw around "symmetric" and "asymmetric" when dealing with encryption and hashing, it just makes you look dumb.
And working on a way to derive two prime factors of a number is ridiculous, you won't ever accomplish it. Simply because we are dealing with numbers larger than the processing ability of most computers that can be accessed (spare some), and the fact that primality tests aren't something you can simply "write".
I thought I had an epiphany in math class a few weeks ago (pre-calc is boring as fuck, and my Ti-84 only can do so much, even with asm programmin), and realized that if you took any number, you can first run it against basic tests and tests of division. Even numbers out, numbers whom digits add up to a multiple of 3 are out, etc. After that, you are fucked.
RSA is secure. Period. It's implementation can only be *so* secure.
And lol, if you want to do something actually epic, and worth bragging about, steal the private RSA key and code yourself a resigner. Until then, stop acting like you did anything tremendously amazing.
This is all >implying this kid isn't just frontin.
-Thilo The "Hax"
Are you talking about yourself? You're only in high school. The extent of your formal math knowledge is beneath basic calculus. Shut up and get over yourself.
It loses it's magic after Google Translate... :P
On a serious note, Is it possible that the grammar mistakes are intentional? Would a decent hacker who'd have to deal with the English language all around make so many mistakes? I'm asking out of total ignorance here.
"Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
I am an Iranian dissident living outside Iran and this guy is VERY pro-government, which is a rarity in Iran if you are following the news.. Line 41: "A message in Persian: Janam Fadaye Rahbar" Means "my life sacrificed for the Leader". Only Khamenei goons otter that. I smell something fishy. Can't be a lone hacker...
He meant to say he had the skill of a 1000 hacks.
God spoke to me.
I think 1,000 hackers is a pretty cool guy. eh takes over comodos and doesn't afraid of anything.
Dude. I was in to 1,000 Hackers before they were cool. Now they're just sell-outs.
Jacob Appelbaum tweeted this earlier. Comodohacker may be for real.
It appears that the #comodogate hacker has posted the secret key for Mozilla's cert: http://pastebin.com/X8znzPWH
To bad suicide bombers, the virgins? It is this guy... mind you, if you examine world history especially in the sunnier parts... they might not mind.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Would you like to sell a vowel?
An interview with ComodoHacker: http://erratasec.blogspot.com/2011/03/interview-with-comodohacker.html His twitter account is @ichsunx
He had me till HAARP.