Hackers Dump Millions of Records From Banks, Politicians
hypnosec writes "TeamGhostShell, a team linked with the infamous group Anonymous, is claiming that they have hacked some major U.S. institutions, including major banking institutions and accounts of politicians, and has posted those details online. The dumps, comprised of millions of accounts, have been let loose on the web by the hacking collective. The motivation behind the hack, the group claims, is to protest against banks, politicians and the hackers who have been captured by law enforcement agencies."
Yes let's ruin millions of innocent lives to protest the arrest of criminals!
To offset political mods, replace Flamebait with Insightful.
Banks got billions in bailout but apparently put none of it into security. Like the bailouts the Banks and politicians win and the consumers lose.
Chief Thinker www.devotedskeptic.com
The powers-that-be, which includes banks, corporations and lawmakers, have been driving all of us "ordinarylings" towards a future where we are increasingly under 24/7 surveillance, whether we like it or not. They have been building a "surveillance grid" that becomes more sophisticated every day, and that knows everything from what we are buying/consuming, to what we are reading, to where we surf on the net when we get up in the morning, to where we park our cars, or go for an evening walk. ---- In a sense it is almost fair that the people who have been encouraging & bankrolling & constantly expanding this surveillance grid get their own digital lives hacked, and thrown online for everyone to scrutinize. ----- If we weren't surveilled digitally, 24/7, and so cruelly, I would say that these hackers have done "a bad thing". ------- Things being what they are - we are watched every more closely by the surveillance grid - its hard, morally speaking, to blame these hackers for their unorthodox actions and tactics.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Score against banks - a bit of a headache, some minor bad P.R., a temporary drop in share price maybe. Don't worry, it'll come back up when the next scandal pushes this one off of people's memories.
Score against the people they're standing up for (the public) - millions of lives ruined as their credit goes to pot, countless hours and days of effort spent to try and recover, thousands of dollars of extra interest payments now their credit score has been dropped down, potential bankruptcies and divorces and split households from the stress...
What a bunch of jackasses. Maybe these people should think who they're really hurting once in a while.
Seriously, has anyone actually looked at these so called "dumps"? Most of them are a single field from a table, with no relational data to associate the bits. I see email addresses with nothing else. I see [email] addresses with nothing else. I see First and Last names, but nothing else. Phone numbers... the same. Then there are loads of obvious blog style records that is used to populate their "news" and such sections (which are obviously on their front page anyway). Where is the damage?
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
The motivation behind the hack, the group claims, is to protest against banks, politicians and the hackers who have been captured by law enforcement agencies.
(emphasis mine)
Yeah, I'd be protesting against those stupid hackers too. I mean, they got caught? Horrors!
Is no one proofreading these submissions?
Those who can, do. Those who can't, write technology blogs.
Seriously, has anyone actually looked at these so called "dumps"? Most of them are a single field from a table, with no relational data to associate the bits. I see email addresses with nothing else. I see [email] addresses with nothing else. I see First and Last names, but nothing else. Phone numbers... the same. Then there are loads of obvious blog style records that is used to populate their "news" and such sections (which are obviously on their front page anyway). Where is the damage?
I've looked at over 20 so far and all have been absolutely worthless. Even the ones that didn't hash their passwords (BookData? what site is that, can't even find their landing page and all the logins look to be JP e-mail addresses) I can't find where I'm supposed to log in. Furthermore, some of these look like some automated testing software when I see rows like:
Those two filled in columns are username and password by the way. So I'm going to say there's three possibilities:
1) these are completely fabricated tables mixed in with (like you noticed) front page public news items and HTML to make them look authentic.
2) these are legitimate but just plain crappy sites. How is it that they only get ~1200 user records from a site unless the site is so worthless that it only has 1200 users?
3) they have everything. They have sensitive stuff but what they've done is show the targets that they have been compromised by releasing only the sensitive data that won't hurt the small users. Since they are publishing the structure of the databases and the targeted entities know that if you have access to that structure, you have/had access to all of the many user information.
I can't believe Teenfad hashed their passwords but some of these other seemingly more sensitive sites didn't. Who the hell is storing plain text passwords in a database!? Well, I guess we have a list of worthless sites that do it now.
My work here is dung.
Working on it... See for yourself: http://par-anoia.net/midasbank/midas.rar It's 2MB, 21MB text.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
TeamGhostShell, a team linked with the infamous group Anonymous
No.
This is the single most inflammatory and weaselly-worded sentence in the article, and it's the first frigging one.
Perhaps it's pedantic by this point, but I am tired of stupidity like this and I'm just irritable enough right now to attack some misinformation.
"Anonymous" is not a group. It's not a collective. It's not even an "it". Anonymous is synonymous with "the masses", with a specific connotation of anonymity and being on the internet. I'll grant that XxXTeamNameChosenByMiddleSchoolersXxX is a "member" of anonymous, but that's like saying that Barack Obama is a "member" of the human species, it doesn't mean anything useful.
Stop doing this.
You should turn signatures off.
As much as I'd like to claim same-shit-different-group on this one, what exactly are they protesting? Generally against banks because...you like to keep your money in the place place you stash your Playboy so mom doesn't find it?
... so let's not do that.
Security requires thoughtfulness, planning, good practices and a lot of things they just don't want to do. These are the consequences of bad security.
That there is dirty laundry or information which might be considered controversial or damaging is another matter.... also too bad for them. But if these targetted parties are learning anything at all, it is that tighter security is important so they don't get caught. They are not learing they shouldn't do things which might look bad if they are exposed.
Apparently the slashmods missed the memo: "The Supreme Court ruled Wednesday that consumers can be bound by an arbitration clause in a cellphone deal or other contract even when state law permits a class-action lawsuit for claims arising from the deal."
Along with a lot of other people, for some reason, despite there being almost a dozen slashdot articles on it. Must be because I'm a troll. You know, one of those fact trolls. Damn you facts! DAAAAAMMMMMNNN YYYOOOOOOUUUU!!!
#fuckbeta #iamslashdot #dicemustdie
"The motivation behind the hack, the group claims, is to protest against banks, politicians and the hackers who have been captured by law enforcement agencies."
Banks, politicians, and hackers were captured by law enforcement agencies?
The best line would have been "who captured who?"
Questions raise, answers kill. Raise questions to stay alive.
Sure, it's semi-random data from a bunch of semi-random databases.
There are e-mail addresses in there to be harvested. (I'd hesitate to say even that much, but I'm sure the spammers have already jumped all over those.)
There are passwords. Even though at least some are encoded, that still gives crackers something to run rainbow tables against.
I'd mention more, but I really don't want to give random wannabee social engineers too many clues. (Even dead simple ones.)
There are real security issues here, and pretty much every company on-line in the world had better be tightening up ship, asking users to change their passwords, and combing through that data to see what visible dangers there are.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
While trying to link to the files (from TFA) on my independently hosted Wordpress-based website, I encountered a very peculiar situation where any attempt to include this link: http://pastebin.com/BuabHTvr -- resulted in a failed or deleted post. That link directs to the files mentioned in the story above. But any effort to include it in a post on Wordpress results in an error message.
I have created a video to document the experience here.
I'd really appreciate any insight as to WTF this is happening. And please pardon the quality in advance; I spent waaaay too much time trying to edit out the black-space, but either I don't get pitivi, or it sucks. Anyway, it must be watched in HD to see the text.
Forward! -- Emperor Norton, 2012
Some lazy assumptions in your analysis
Unreal. He at least took the time to actually look at the data. What did you do? You gave us "lazy assumptions" (that's being generous) like this: "Condemn Intel for insinuating their under-baked IP into all the pipes."
Well, if there weren't any damages, why would this be news?
I was promised a flying car. Where is my flying car?
Looks like a script which downloads all the data from here: https://privatepaste.com/download/450c2e35de
no, it was driveby MySQL vulnerability. using your terrible analogy, it's the equivalent of visiting each organisation across the world looking for a well known safe manufacturer that has a vulnerability in their locking system.
The free market itself is a myth.
I find your lack of faith in the invisible hand disturbing...
Sorry, I just couldn't let the image of Darth Adam Smith choking some scoffer with an invisible force hand alone...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I took time to dig into the data, before I posted that rant.
Did you?
Like I said, when I make random test addresses I do not bother going to the effort that would have been required if those lists of addresses were fabricated. Maybe someone did go to the trouble, but the data did not look that way to someone who thinks about what the data should look like.
Pointing too much out would be helping wannabee script kiddies, so that's about as far as I'm gonna say here. (It's bad enough to confirm to the spammers who lurk here that there are probably live addresses in those lists.)
I also took time to dig into Intel's, Microsoft's, and now Apple's non-efforts at security.
And I refrain from being more specific about that for similar reasons, but it is precisely because of the no-brainer holes that the market leaders leave in their security that more than half of that load of data was harvested. And it is the market leader wannabees in the Linux communities, trying to "be like the big boys", that have produced similar holes in many of the Free/Open systems available..
Now, who's unreal here?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
No. You absolutely lost it when you put the square brackets in.
"First they came for the slanderers and i said nothing."