Is This the Golden Age of Hacking?

Barence writes "With a seemingly continuous wave of attacks hitting the public and commercial sectors, there has never been a more prodigious period for hackers, argues PC Pro. What has led to the sudden hacking boom? Ease of access to tools has also led to an explosion in the numbers of people actively looking for companies with weakened defenses, according to security experts. Meanwhile, the recession has left thousands of highly skilled IT staff out of work and desperate for money, while simultaneously crimping companies' IT security budgets. The pressure to get systems up and running as quickly as possible also means that networks aren't locked down as tightly as they should be, which can leave back doors open for hackers."

Comments

Methinks it be the script-kiddies

[amalek]

Meanwhile, the recession has left thousands of highly skilled IT staff out of work and desperate for money, while simultaneously crimping companies' IT security budgets... ?

Re:Methinks it be the script-kiddies

[Anrego]

crimping companies' IT security budgets

Most were already crippled, which is really what I blame for the problem.

For a _long_ time "this could get hacked" was a theory. Yes if someone dedicated resources at you and knew where to look they could get in.. but who is going to target _us_.

The availability of tools that can automagically find these vulnerabilities and exploit them is what I blame. All these little holes no one worried about because "no one will ever bother looking there" are becoming a big deal.

Hopefully companies getting hacked left right and center will put the fear of the great fire cactus to the suits, and they in-turn will invest in real security.

Re:Methinks it be the script-kiddies

[JoeTalbott]

This reminds me of a plumber I once knew who bumped his head on a brick and a gold coin fell out. Ever since then he's been bumping his head on bricks looking for hidden coins. A sad tale indeed from which I learned that 'security through obscurity' depends largely on the obscure remaining so.

Re:Methinks it be the script-kiddies

[Batmunk2000]

I agree, except these "hackers" need to be labeled criminals and called out by our industry as such. Sure the companies could do better (and need to be called out when they are grossly negligent), but that can be like saying a home owner *could* or *should* have put up cameras, steel doors and bars on the windows to help deter the burglar. Sure we could make every house Fort Knox, but that isn't cost effective nor is it always the proper front of the battle. There is a reasonable amount of security that should be in place, depending on what is being protected, and a reasonable amount of vigilance from the law to go after these criminals.

Re:Methinks it be the script-kiddies

[Culture20]

The truly sad part of that story us that the giant dragon turtle who hid all those coins in the bricks lost all his money. He should have diversified.

Re:Methinks it be the script-kiddies

[cgenman]

Citi got hacked because you could plug anybody's account numbers into a website once you had logged in, and it would spit out valid information. That's just a complete lack of basic security. That's just bad initial design that wouldn't have cost any extra to secure if it had been developed by anyone with a clue.

And automated tools have existed for years. I'd say that the big difference is that it used to be very few people knew how to move 200k freshly stolen credit card numbers. Sellers and buyers had to know specific IRC channels or dial-up BBS's to log into. Now, thanks to social networking and the explosion of 0-configuration bulletin boards, anyone with a use for a million credit card numbers can hop onto Google and find a place where sellers hang out. People can make a good living renting out botnets or selling identities in a way that had been very difficult.

Re:Methinks it be the script-kiddies

[djowatts]

I don't think you can draw a comparison between the safetey of a private residence, and the security of a corporations network. Put lightly, If a theif manages to break into your home, it is likely he will only get away with either one arge item (Such as your 40" TV) or maybe pockets full of Jewellry and whatever cash they stumble upon. In comparison, if a hacker can break into the network of a corporation, that means customer data and other valuable information (possibly trade secrets etc.) could be compromised. Another comparison to draw is that items in your home are likely to be secured by insurance, but if this data gets out there then there is no insurance.

Re:Methinks it be the script-kiddies

[AmiMoJo]

From the board room's point of view security costs money with no tangible benefit. They find it hard to say to investors "we spent lots of money on securing our systems, it reduced our productivity and increased the size of our IT department but we were saved from all these hacking attempts, honest". On the other hand if they buy some cheap "network grade" anti-virus software they can claim to be both diligent and securing their systems and to be helpless victims of elite cyber criminal masterminds when things do go wrong.

Golden Lulz, not plain old gold

[Beautyon]

Umm no, its the Lulz age of hacking.

Re:Golden Lulz, not plain old gold

[Samantha Wright]

I'd give you a mod point, but instead I'm going to just try and highlight your point more clearly, since you seem to be accruing mod points anyway.

LulzSecurity is doing a bunch of high-profile, childish, silly things. That's all the weather there is to report. There's nothing else going on. There's no golden age, no silver age, no information age. Just one group being trollish, and otherwise, the attacks we're hearing about aren't that out of the norm. The exponential curve is right on schedule, as usual.

Hopefully, however, the LulzSec attitude—that you don't have to be important in order to be an interesting target for having your pants pulled down in front of the rest of the class—will drive organizations toward better security policies. TFA is obviously not interested in this aspect of things (and ends in a pessimistic note about people asking for help with test configurations) which is... not that surprising from PCPro.

1980s

[betterunixthanunix]

I guess they have forgotten about the 80s?

Perhaps not more common, just more visible

[gman003]

Haven't RTFA'd yet, but I would suspect that hacks aren't any more common now - just more visible and more reported. It's like when the news media has a "summer of the shark" - after a few notable incidents, the media realizes that these stories bring in viewers, and then any further incidents, no matter how insignificant, are publicized when they otherwise wouldn't be. Just look at the recent Bethesda hack - that kind of thing goes on all the time, and I was surprised anyone bothered paying attention to it. Sure, some of them were big - the first Sony attack was significant, and the US Senate hack is noteworthy - but a lot of these recent hacks have been relatively minor.

There's also the possibility that all this attention is actually causing more hacks - after the initial Sony hack, hackers realized that Sony was a big, vulnerable target. By extension, they realized that big companies actually aren't bulletproof - in fact, many of them have terrible security. I'm sure such knowledge was widespread in the black-hat world, but now the secret is public knowledge.

We need to take users out of the loop.

[FyRE666]

The problem most websites have is one of users choosing insecure login details, either through ignorance, laziness or disinterest. Although this is not a huge problem if it's front-end users, the same problem exists with admins, and those with elevated privileges. The most secure fortress is little protection if the passcode to open the front door is "1234".

I don't think this problem can be fixed by "forcing" users to choose long passwords, or to have a different password on every site they use. As we've seen, they simply won't do it, and why should they? It's different if you have a technical, or security-related background, and understand the risks - the average Joe isn't interested in spending the effort to maintain and organise a secure list of passwords in an offline location.

i think the only way this can be fixed is by using SecureID style authentication - either with stand-alone units, mobile apps, or units built into laptops or keyboards (separate from the other components). Obviously it would need to be physically separated from the machine being used to login (or at least sandboxed, in the case of a mobile app). We just need a good cross-platform authentication API that's easy for developers to implement, and cheap hardware/free software for the client.

Re:We need to take users out of the loop.

[dkleinsc]

If you are authenticating a user, the user will be involved. That's the reality of it.

Any of the pure hardware solutions you describe suffer from the fatal flaw that they aren't authenticating that the user is who they say they are, they're authenticating that the user has access to a particular piece of hardware. If, for instance, it's built into Alice's cell phone, and Mallory steals Alice's cell phone, then as far as Bob knows he's talking to Alice rather than Mallory, and if Alice tries to talk to Bob to correct the situation then Bob won't recognize Alice's new hardware.

There is no silver bullet in security.

Re:We need to take users out of the loop.

[Anrego]

I've never seen a pure hardware solution. Enter multi-factor authentication, which while not a silver bullet, is a lot better than a password.

Mallory can guess Alice's password. He can also steal her cell phone. Doing both however is considerably more difficuly. He needs the phone to even start guessing passwords, and once the phone is stolen there is only a short window for the guessing.

You can even throw in a biometric method, though personally I don't see much future for them. Most can be copied, and you can't just change your fingerprint when someone at the gas station makes a copy. As a third factor maybe they add some security, but I would never rely on them to replace either a token or a password.

The Negative Side of a Fight for Users' Rights

[eldavojohn]

What has led to the sudden hacking boom? Ease of access to tools has also led to an explosion in the numbers of people actively looking for companies with weakened defenses, according to security experts. Meanwhile, the recession has left thousands of highly skilled IT staff out of work and desperate for money, while simultaneously crimping companies' IT security budgets. The pressure to get systems up and running as quickly as possible also means that networks aren't locked down as tightly as they should be, which can leave back doors open for hackers.

But by that logic, we could have seen similar things when the dotcom bubble burst, right?

My view of this comes from a completely different place. I see an exceptionally large amount of users' rights being debated and discussed and we're seeing communities popping up devoted to this. Frankly, it seems like the users are just getting shit on. And, like any struggle for rights, there are negative things that happen. There are always going to be people that take it to an extreme level and there are going to be innocent bystanders turned into victims. While I still see this as a bad thing, some of these actions remind me of a sort of John Brown at Harpers Ferry incident. Similarly, there's the mindless looting during rights demonstrations and protest crowds at the G8 summit but it's not the overall message that's doing that. The opportunists come out of the woodwork.

Similarly the public and citizens of the internet are demanding more rights. While this fight is going on with Facebook, Sony, world governments, etc, the communities are going to pop up that take it to an extreme offensive. They will do bad things and I'm not going to be one condoning it but I see it as part of the growing pains of companies respecting peoples' rights.

It's a sort of vigilante justice that I don't agree with nor condone but I can somewhat sympathize when I feel like I've been unjustly wronged by some of the targets and have had no sense of justice in the matter. People who feel strongly about this and have that negative spark in them would have a motive to become a part of these new communities. And in my opinion that's a more plausible explanation as to why you're seeing an explosion -- not the recession or turnover in network employees.

Re:Hacking vs Cracking

[gman003]

I think it's time we give up on this. Sure, most of us know about the technical distinction between "hacking" and "cracking". But the mass public hasn't picked up on that, and even many hackers (old sense) now use the term hacking (new sense) for cracking.

At this point, trying to push the term "cracking" is futile. We won't change anyone's mind. In fact, all we'll do is come across as semantics-arguing dweebs. It's probably best to just accept that "hacking" now means "gaining unauthorized access to a system". It'll be easier to make a new term for "person who messes with computer systems for fun".

This?

[rossdee]

"Is This the Golden Age of Hacking?"

This what?

This century?
This decade?

How long is an 'Age'

Weak Security

[wintercolby]

What do you expect to happen when you hire Systems Administrators for 6 month contracts to build your systems, and then let the contract expire after the servers are built? Servers don't usually patch themselves, nor do they remain compliant with your security standards once you give developers and DBA's root access.

Re:Hacking vs Cracking

[metlin]

Indeed. And I think we can use black hat vs. white hat to distinguish the intent of the hacker.

That's something that the public can relate to a lot more easily, and in fact I've seen the terminology used in non-technical journalism as well.

Software

[DaMattster]

I think it is more bugs in software than the network infrastructure! Everyone is so quick to blame the infrastructure engineers when I have seen more poorly written applications with memory leaks and ones that run with root privileges than poor network designs.

Re:Dawn of the novice script-kiddie

[Anrego]

The issue is that ANYONE can crack these days.

In an ideal world, this wouldn't matter because with decent security these script-kiddie attacks shouldn't have any teeth. Things like "got in because they were using an unpatched version of..." just shouldn't happen.

The _real_ problem is that people said for years "well yes technically it's probably a vulnerability, but who is ever gonna target us and find it". For a long time this was true. People ran outdated software on public facing systems and left them fully connected to the internal network, fully aware it was a bad idea, because unless someone dedicated time and energy at them (and who is gonna do that to _us_), it wouldn't be a problem.

Now script-kiddies just run a (sometimes _graphical_) tool that scans an entire network for any of 10 bazillion vulnerabilities, and all these little holes suddenly get found.

Perfect storm actually...

[mlts]

There are a lot of reasons for this to be an age of intrusions galore:

1: Corporate philosophy. I mention this often, but it is very true -- security is a cost center, so in a lot of firms, it gets hind teat in the budget.

2: Ease of getting away with intrusions. Got a botnet? Just create some PPTP/L2TP connections and you can manually try breaking into machines and one can either not be traced, or have the blame shifted to another party. Especially if the intrusions come from a country that is disliked.

3: Lack of international cooperation. All it takes is one proxy to be in a country that doesn't like another, and there is no way an intrusion can be traced, much less prosecuted.

4: Lack of meaningful security tools. A lot of the tools used in businesses are all sizzle, and not much steak. Take AV programs. They are great at catching last week's stuff. However, most attacks are polymorphic 0-days that just zing past AV program detections.

5: Ease of infecting via ad rotation services. Ad rotation services can sling malware without ever getting caught because people will blame the website, not the servers slapping the ads on it. The same ad servers that can target by demographic can target a company and just that company for malware.

6: Using the Internet for all traffic. In the past, there were backbones that were not accessible to anyone that transactions ran across. Now the same wire that gets pr0n to Joe Sixpack also carries bank data and transactions.

7: Failure to use basic security protocols in password storage. Hell, crypt(3) is better than most ways passwords are stored. The best thing is to look at known secure utilities like TrueCrypt and follow their example.

8: SQL injections and parametrized queries. Simple stuff, but because a lot of dev projects just want a code base regardless of bugs, this stuff gets ignored until the breaches start.

9: No real network security. A firewall doesn't cut it anymore. Instead, companies have to use VLANs and keep departments separated. This way, a compromise in receiving doesn't mean finance or HR is pwned too.

10: Legacy protocols. FTP (other than anonymous FTP), telnet (except for use for debugging), and other insecure protocols need to either be limited via packet filtering mechanisms and router ports, or eliminated altogether. Instead, if two machines need to share data, have them use a LUN presented to them and a filesystem that allows for this.

11: Lack of internal policies and procedures. Security isn't just clicking "secure mode" on an appliance and walking off. There needs to be a process if someone calls in from an internal line demanding info, or someone physically is picking a lock.

12: Separation of duties and data. This is expensive relatively, so it tends not to be done, and the same server with the source code build may have the HR payroll data. This makes for a field day for an attacker.

13: Chain of custody of data. Either the machine it sits on is properly secured, or the data is stored encrypted with proper key management. For example, some enterprise level backup programs have data encrypted at the client end, and only that end has the key. This way, if the enterprise backup server gets compromised, the data can be destroyed, not accessed or modified.

14: Morale. Morale is so easily forgotten, especially with companies that do the low bidding among the last 3-5 candidates. High morale means people are proactive on security. Low morale means people will ignore breaches assuming they won't be thrown under the bus.

15: Cloud computing. There is no benefit for a cloud provider to give anything but token gestures for security financially, so one is begging to be compromised unless there is solid encryption with good key management done before the data leaves the client. Even then, blackhats can have free and unfettered access to the encrypted data and can detect patterns over time. SLAs are meaningless; a cloud provider can change hands or go bankrupt and all the privately stored data can be made into a torrent or sold to anyone with cash.

Because most businesses pay lip service at best to security, it is no wonder why blackhats are having a field day.

No it's not

[blahbooboo]

The golden age of hacking was the late 1970s and 1980s. Things they pulled off back then were far more impressive and interesting to watch.

Re:No it's not

[phantomfive]

Interesting, maybe, but I don't know that I've seen anything more impressive than heap spraying. That's a hard technique to pull off.

Jealousy, or Stupidity?

[Subratik]

Now, I do not condone Lulz Security or Anonymous, but the fact of the matter is they're not just 'script-kiddies'. Every tech-savvy webpage I've gone the ones that are user-submitted have belittled the efforts of both hacking groups as if they could do the same things so easily. I'm not sure why there is such a pretentious atmosphere of 'pro' coders here... but to be real honest with everyone, they have spent a lot of time researching web security vulnerabilities, and the biggest joke of all is that a good portion of readers on slashdot are probably sysadmins who think their system is protected by a golden firewall, which they probably bought from some other software vendor.. Blah, blah, it's just sql injections... lol, yeah... that's the greatest joke of all, they guessed your table names and you allowed escape characters... And these people certainly realize they don't even have to lie or fabricate their stories considering they get in with the simplest, MOST known vulnerabilities.. I think some of lulz's actions deserve merit, the fact that they haven't been caught yet is a sure sign that they're somewhat competent at what they do.... much better in-fact than the security companies that supposedly get paid top-dollar to ensure data protection.. In essence, the biggest joke is not the simple attacks of the hacking groups, it's honestly the over-abundance of hypocrisy and finger pointing that essentially does nothing next to actually coming up with valid security solutions.. The best example of all this is simply Mitnick, he didn't even have to hack.. he just called someone up for a password.. you know why, because the smartest hacker doesn't waste 9 years trying to guess/crack a hash, especially when people are so much easier to manipulate than software.

Hackers 2

[jimmerz28]

Can we make another movie with Angelina and just throw in Brad Pitt so we can get the 2x the eye candy in a techy movie? Keep Megan Fox out she's way too dumb for a hacker-esque movie...

Re:Oh they are talking about cracking...

[elrous0]

Denial isn't just a river in Egypt. "Hacker" was decided back in the 80's. You can keep pretending if you like, though. Myself, I still like to delude myself that there's a chance "Firefly" may come back.

Re:I'd argue the opposite

[Darfeld]

If you consider that "Hacker" now mean "Evil Spawn who do something illegal with a computer", I would say TFT is right, by your own argumentation. More and more people feel the need to break law on a level or an other to do what they want with their devices. So effectively the number of hackers raise.

Me I think that the more lucrative informations will be hackable, the more hackers will be happy.