Slashdot Mirror
LulzSec Hacks the US Senate
jfruhlinger writes "LulzSec might not be as famous as Anonymous — they're really best known for hacking sites they like, to prove a point about security — but they may have just raised their profile significantly, posting what appears to be data taken from an internally facing server at the US Senate. However, the fun-loving group might find that the Senate reacts a lot more harshly to intrusions than, say, PBS did."
The group also recently grabbed data from Bethesda Softworks.
I hope these guys are as good as they claim to be, otherwise we will be seeing their faces with the caption "Further arrests from anonymous hacking group"
Apparently, Anonymous announced an intention to go after the federal reserve next: http://gizmodo.com/5811546/anonymous-goes-after-federal-reserve. It'll be quite interesting if they attempt it. I'm interested in seeing how the fed handles this.
Usually these end in tears. Only the most stupid black-hats (and that is all these morons are now) brag publicly.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Why target Bethesda? And what are their plans for a bunch of forum accounts? I don't get it.
All I can picture in my head is a mash-up of War Games, National Treasure, Highlander, and Mortal Kombat. If there data post is legit it represents a huge breach in security. More importantly, it's one of the first times a breach has been brazenly flaunted.
[http://it-tastes-so-good.blogspot.com] Are you hungry?
As much as I like chaos brought to the powers that be none of this hacking will have any long lasting effects. want to see some serious info leaked that damages someone with real power. I'd rather see these guy dig out info that calls out the hypocrites in positions of power.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Comment removed based on user account deletion
Risky. What if the other one is a great fool? There is ample evidence these for a significant part of the population and that intelligence and education are not reasonable predictor of this state.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It seems like the recent outbreak of high-profile cases of computer break-ins is almost calculated to provoke legislation locking down the internet. First the kill-switch proposal, the announcement by the US military that computer intrusion would be considered an act of war, now a constant drumbeat of reporting in the media about major cracks.
Perhaps the hacks are all just being done by people who don't see how useful such stories are to those who want to assert control over the net, but it would be foolish to think that the "problem-reaction-solution" method has stopped being used by those who are after power, or to discount the possibility that some of this hacking and the publicity it receives is actually being provoked or even orchestrated by those seeking to expand government control over the internet.
"Is life so dear, or peace so sweet, as to be purchased at the price of chains and slavery?" - Patrick Henry
This will be used to push forth legislation making script kiddies equivalent to terrorists.
How many more years will slashdot have an off-by-one error on your Score in your profile?
Or at least I'd hope not. (It's a joke, put down the pen and paper and/or your vehement email responses.) I'd actually hope this gets someone's ass kicked in the Senate's IT office. While there may not be much interesting found on there, it's still dangerous. If some silly media loving hacking group can gain access like this, it's certainly just as easy for some other malicious government or entity to get in and do worse. But I'm sure they're still too busy worrying about how to control the rights of the citizens to worry about something as trivial as this....
Well there's a big red line to cross. Would could possibly go wrong?!
Am I the only one thinking that these hacks get too much attention? Inform the people who are affected, but maybe keeping this stuff from the front pages would make it less lulz?
Looks like they got access to a web server and were able to list the apache conf and some files being served up.
I would've given bonus points had they manipulated the system into displaying random Wikileaks embassy cables.
Because it's more secure than Linux? har har ;)
"LulzSec might not be as famous as Anonymous â" they're really best known for hacking sites they like, to prove a point about security"
Wait, so is LulzSec known for hacking sites they like? Or is Anonymous known for hacking sites they like? Which one of them actually likes Sony since both groups hacked them? (Even disregarding Sony's claims about the stolen PSN information, Anonymous admitted to being responsible for the prior DDoS attack.) Does Anonymous like the Scientologists or does LulzSec like InfraGard? I'm kinda confused by the claim.
This Space Intentionally Left Blank
clearly the expected thing to do would be to build up an immunity to a specific poison for years and poison both
Or is this more of a case of stepping on the tail of a tiger?
Which is unfortunate. The legislation should instead instill some sort of competence insurance program for security specialists, and compliance audits for all businesses that handle personally-identifying information (PII).
The greater the amount of PII, the higher the legal requirement for security, and the more stringent and frequent the audits.
Make PII a cost center rather than a profitable resource, and watch the situation improve dramatically.
It seems like a new high profile hack happens every day. Is this just a fad? Will things calm down again? Or is this the beginning of a radical change for the internet. It used to be that you could get away with just a few weak security measures, but now that doesn't look sustainable. Not to mention the rise of DDOS attacks recently. Will we see a radical shift in the way tech companies operate? Is it really affordable to be secure? Maybe new technologies will be required to bring the cost down. Is it even possible to be secure? I'm sure all these companies thought they had locked the door tight.
Looks like the lucky senate.gov webmaster gets to see if the key revocation process actually works.
I am waiting for ... /halfempty /halffull
Fingers to get pointed at [INSERT ROGUE NATION] and we start a another un-just war.
On the brighter side maybe these guys [IT staff of the compromised servers, I am looking at you] will actually start considering tougher security on front facing servers
-- Brought to you by Carl's JR
And never go against someone who's read or seen The Princess Bride a thousand times, when death is on the line.
Damn, I had just posted a comment two days ago on another Slashdot thread about Anonymous hacking a Libyan website stating that there has been a huge increase in high-profile hacking this year. Now the US Senate? While I appreciate the work that Anonymous has done, this LulzSec crew seems to be much less interested in helping people, and more interested in just causing ruckus. Well see how long it takes before their lulzboat has a hole in it.
That's not some inside server. Look at their list of files. It's the Senate's outward-facing web server, "www.senate.gov". It also hosts the public web sites of individual senators. It looks like what you can see on a UNIX system with a guest account. Big deal. Every staffer on the Senate side has that much access.
They have the complete directory of all the paintings in the Capitol. The forms for registering as a lobbyist. Pictures of all the Senators. Lots of stuff for tourists. This session's voting results, in HTML. The base Apache config. Nothing exciting.
...and HalfLife 2 got delayed for months? If this stunt delays Skyrim, these tools deserve a kick in the nuts!
Never let a lack of data get in the way of a good rant.
I know what they did is wrong and all but what you wrote sounds like "Look what you did, you've angered the master, now he's sure to give us all a good whippin'"
Lulzsec's primary means of access is an Apache 0day. Also, one of their primary members works for a Tier 1 ISP, thus giving him privileged access to some high level routers/customer information.
This is the exact concern I've had since the start of these highly publicized intrusions. Instead of blaming lax security guidelines and policy at the places of intrusion, the public media is placing the blame in the hands of the people bringing making this knowledge public. Surly there are better ways to notify the companies at fault, but with the new development of "let's only solve problems when the public makes a giant scene out of it" (ex. people complaining on Twitter about issues they are having) this was bound to happen sooner rather than later. I really hope the people in power see the true issue and don't use it as an excuse to lock down and regulate even further (ha, yeah right). Prevention is the key measure, not treatment of the problem once it happens.
just how long have the Russians and Chinese been lounging around in that system? A year? A decade?
Running with Linux for over 20 years!
This is the wrong reason to condemn their actions.
Oh, the FedRes functions buddy boy. it just functions in ways we never intended it to.
What do you mean, "we"?
Hugs and kisses,
-- Hank Paulson
"What in the name of Fats Waller is that?"
"A four-foot prune."
Yeah, well, that's the "lulz" part of it.
I actually heard a blurb on a "conservative" radio station today that referred to them as "a hacking group devoted to exposing security flaws." So the narrative is changing. Then again I also heard a blurb a couple weeks ago talking about K2 like it was a new thing when its been around for a decade and already outlawed in a few states.
I will laugh when Lulz turns out to be a group of 12yo kids from japan
Ask John Draper sometime what happens when you taunt the government like this.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Did these people learn nothing from the lesson of Pvt Manning? Do they believe that they won't be found by the USSS and the three letter agencies? If these people are US citizens then they are being really dumb. If they aren't US citizens then it will be even worse for them when they are eventually caught. Will they still be laughing after the Feds make examples of them? We shall see.
I think it would be hilarious for LulzSec to hack Slashdot and post every single username and password, along with any financial details that they found on Thinkgeek.. Come on. Slashdot is so buggy, their security simply must be a joke. I'd be curious to see what the reaction is. My guess is that some people would still support LulzSec, even saying that they're glad that such a fine group of principled and honorable white hat hackers took the time to demonstrate the flaws of Slashdot's security.
Back when I was in college, I had a friend who used to break into cars that used The Club. He wouldn't steal anything but The Club itself, to demonstrate to them the uselessness of the product. I found it hilarious. Much like these web site hacks, it was just a harmless prank by some punk kid. But it was also pretty fucking antisocial. Did those people learn a valuable lesson? I don't know. Maybe. That doesn't change the fact that it was wrong to break into those cars.
By the way, I'm not saying that I'm some paragon of virtue, because, obviously, I'm not (I found the whole thing rather amusing and probably indirectly encouraged his activities by laughing). I don't think you need to be virtuous in order to speak about virtue, however.
Ok, for the lulz, all nice and dandy, but bragging only works in your favor if the one you're bragging to actually admires what you do. While we might have admired the person who egged the principal's car in school, we all hated him when we all had to stay longer "'til someone confesses". And this could easily end the same way, just more severe.
What will happen? What is to be expected as the reaction of the government? Just shaking their fists, then going on their knees and beg to stop? We live in an age where the most minimal of excuses is used to eliminate any traces of privacy left, especially in the vicinity of computers, and this is maybe more of an excuse than many things before. Can anyone here see this as a very welcome reason to tighten the screw on privacy? From outlawing open WiFi Routers and open onion proxies to mandatory backdoors for the feds in your machine, there's little anymore that's simply beyond discussion.
And what for? Did we actually get any "dirt" on any of the targets? What came out of the senate hack but a defacement? Any information? Anything the public would actually benefit from? Or is the only "benefit" that we now have an excuse for any kind of law crammed down our throat because we need "more safety"?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You're right, but it's still reasonable to be afraid of a good whippin. Particularly if no good came of it.
Once again, hackers got their lulz, and we'll enjoy the consequences, i.e. the "patriot act"-like laws for the Internet which are sure to follow.
Since 9/11, it has been made quite clear that the liberties and freedoms people take for granted can and will most likely be hindered by threats. The government has already shown that it is willing to step on freedoms and grey areas (such as the internet) in attempts to secure the "safety" of its people. And I think what Lulz has been doing with these sporadic attacks will lead to some unforeseen and unfortunate circumstances. Tread lightly; something that is not being used. It might be too late though. The government may respond, and the response may be limitations. And from those limitations will come more hackavist like activities and attacks which will lead to more limitations. Lulz most likely bit off more than they can chew at this point.
No, but you'll notice their release gives an address to make Bitcoin donations. "Bitcoin used to fund drugs and government-destroying hackers."
Two birds, one stone.
US-Advised-on-using-Stuxnet-style-attacks-in-Libya
http://www.mercurynews.com/breaking-news/ci_18263468
http://slashdot.org/submission/1647610/US-Advised-on-using-Stuxnet-style-attacks-in-Libya
Which, incidentally, is very likely to be more accurate than either of you want it to be.
What a depressingly stupid machine.
Let me take a wild guess: number of ethicists: zero.
I hope these guys are as good as they claim to be, otherwise we will be seeing their faces with the caption "Further arrests from anonymous hacking group"
I agree, if they really claim to "not like the US government", then a much smarter move would be to snoop around quietly and dig up something REALLY juicy. Where's the meat? They brag about hacking the Senate but then give us what looks like little more than a list of mundane files on a webserver, or something. Whoop. Sounds more like they managed to find one unsecured machine, and just couldn't wait to brag about it ... I can just see it ... 'ZOMG dude we hacked teh Senate!!11!' 'Oh yeah we're awesome!'. It has no class. They had an opportunity to get onto the network and look around for something really interesting, like evidence of corruption or something, instead they just hollered as loud as they could and now security will be stepped up, helping close the opportunity to do something good.
Hmm, seems they aren't doing nothing useful: http://www.mercurynews.com/breaking-news/ci_18263468?nclick_check=1
The media doesn't work anymore when it comes to whistle blowing news about our government.
- can't photo or record cops - guy that got brought in for recording a shoot out
- the entire decade of 2000 to 2010 lack of real coverage of anything to do with the middle east wars.
- any protection of anonymity.
The media has been "recovering" from the Bush era controls, but they still don't really do as good a job as they have in the past. They are more interested in selling the news that reporting it.
So, its up to US (people of the US) to record the news on our cells and post it to the internet before that gets controlled.
It also occurs to me that Hackers may become a form of Journalism at this point in order to protect the people from it's government.
Some may think this obvious but I felt it needed to be stated.
Come on LulzSec. Do something a bit more sophisticated than SQL Injections and XSS.
Any dingbat can put "a'; select * from users where '1'='1" into a search form on a random website.
nyah nyah!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
trying to figure out why there were all these unexplained logins from the wan.
Get a web developer
...if these guys could find Obama's Senate records....
Coder's Stone: The programming language quick ref for iPad
needs to hire less of the former and invest more in the latter. The only way the government can lock a determined individual down in their country via an internet restrictions approach is to cut the ethernet cable running to that person's computer. The internet as is is not by design meant to be restrictive, it's all technologies that have come after it that have waged the war.
I read it as "I, cozzbp, am a pathetic coward" but your description is good too. We have laws, LulzSec committed a criminal act, but if you are afraid that a few random teenagers will inspire Orwellian legislation then the problem is with the government not with LulzSec. The responsible citizens have to stand up to both cyber-bullies AND to power-mongers. If you yanks can still not have guns legislated against, after all that's happened, then allowing cyber legislation to screw you over is just sheer laziness.
Phillip.
Property for sale in Nice, France