Slashdot Mirror
Heartbleed Turned Against Cyber Criminals
Rambo Tribble writes: "In a case of 'live by the sword, die by the sword,' researchers have used the now-infamous Heartlbeed bug in OpenSSL to gain access to black-hat forums. A French researcher named Steven K. is quoted as saying, 'The potential of this vulnerability affecting black-hat services is just enormous.' Reportedly, the criminal-minded sites Darkode and Damagelab have already been compromised."
In related news, U.S. Cybersecurity Coordinator Michael Daniel posted an article at Whitehouse.gov yesterday reaffirming that the U.S. government had no prior knowledge of Heartbleed. He said, 'We rely on the Internet and connected systems for much of our daily lives. Our economy would not function without them. Our ability to project power abroad would be crippled if we could not depend on them. For these reasons, disclosing vulnerabilities usually makes sense. We need these systems to be secure as much as, if not more so, than everyone else.'
3 days after the news about Heartbleed is broken, my email account is hijacked and someone is sending my former teachers emails about Viagra. I have a hunch that this bug is the reason...
duh!
Ahhh. There it is. The wiggle room.
Chances are better that he is:
- lying
- is purposefully kept in the dark so he can say these things
Perhaps Michael Daniel's office would care to contribute. It might benefit their ability to project power abroad.
Oh good, you accessed a scriptkiddie forum that any 12 year old and his Imac could visit.
I wonder why they didn't patch their system.
Besides the trivial answer that they are incompetent script kiddies, i came up with these:
1 - the site is abandoned
2 - maybe only those who can exploit heartbleed can gain access to the forum (tests for expertise and maintains anonymity)
Patents Drive Free Software as Hurricanes Drive Construction Industry
Incompetent if they didn't find heartbleed [they are supposed to protect our infrastructure].
And massively irresponsible if they knew and didn't disclose it.
The overall damage is 1,000,000 times whatever the NSA might have gained as a penetration weapon in the arsenal. If they knew and didn't disclose, this is tantamount to doing more damage to U.S. [and world] interests than any cyber-criminal/terrorist/nation-state the NSA might hope to catch.
Like a good neighbor, fsck is there
The "government" (by and for the people) did NOT know about "Heartbleed"....
But the Shadow (government) knows....
3. People have websites they don't even remember they own.
4. Some people don't care that much.
This is just as bad as the NSA hacking into your computer.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
Blackhat or whitehat. It does not matter. Hacking is hacking regardless of the target. This 'researcher' belongs in jail.
"Disclosing a vulnerability can mean that we forego an opportunity to collect crucial intelligence that could thwart a terrorist attack stop the theft of our nationâ(TM)s intellectual property, or even discover more dangerous vulnerabilities that are being used by hackers or other adversaries to exploit our networks."
I'm troubled by the mention of "intellectual property" in Daniel's post. I'd understand it if he restricted his description to theft of military or intelligence secrets, but does this vague term mean the US intelligence agencies are now in the service of the entertainment industry?
they are lying of course...only idiots they got access to are ones that copy and put links up and files that already existed.
the united hackers association was not operational the whole time this bug existed for example....now you know one reason why....
of there are more issues they aren't telling you...notice when i say this they start yammering about IE again
they need you all on chrome....
[Nelson]
Haw-haw
[/Nelson]
For these reasons, disclosing vulnerabilities usually makes sense. We need these systems to be secure as much as, if not more so, than everyone else.'
Go blow that smoke up someone else's ass. If that was true then the NSA would "usually" publish the black-market zero day exploits they purchase as ammo for their Ferret Cannon exploit launching system. But they don't, ever. They just use them till someone else finds and fixes it.
Those fuckers don't need our shit to be secure at all. They don't want it to be so either. They don't even use the same networks we do for secure coms. Hell, that's what the Number Stations are all about. Every once in a while my scanner will catch one of my favorite broadcasts: Old school, just a monotonous series of digits. I'll fall asleep listening to them droning on and on -- no doubt only decipherable by one-time pads. You know, because public key crypto just moves the key-sharing problem of authentication around -- The endpoints still have to exchange the public keys, just like they'd have to exchange one-time pads (hundreds of Gigs of pad can fit in a micro SD card now). The CA system just moves the authentication problem from "which is their public key" to "which CA are they using" and adds: "Which CA can be trusted?" (none).
Look, if it was so damn important that the SSL systems were secure then the VERY BROKEN CA system would have been fixed a long time ago. As it stands now it's just a collection of single points of failure and any one compromised CA brings the whole thing down (see: Diginotar Debacle). SSL has NEVER provided security, ever. At least with pre-arranged / pre-shared keys if you do manage to transmit the key out of band (in person, at your bank, etc) no one can ever MITM the connection. All TLS / PKI did was ensure that all SSL connections had a potential MITM via the CA. No competent security researcher would design a system like that. You have American, Iranian, Turkish, Chinese, Russian, and etc. root certs trusted in your browser. If they compromise any router between you and your destination they can MITM the connection, you'll see a big green bar too. Even if you did examine the cert chain, you'd have no way to know if the endpoint switched to a new CA, since any CA can create any cert for any domain, you have to trust ALL of them.
Web security is a laughing stock, and any "black-hat" group that was relying on SSL for any coms is probably just a CIA front, because EVERYONE with any snap has known that shit is not safe since its inception. Would YOU trust a CA to sign certs if they also sell information interception services to governments? Why did you then? We already have accounts and pre-arranged secrets with all the places we need secure so just take your existing HTTP-Auth proof of knowledge hash and feed it to the damn stream cipher and you're done. Well, and remove the basic auth bullshit, that's not needed, since we have cookies and web forms already. Point being: It's trivial to fix the CA system, but they don't do so, thus it's apparent that no government wants this shit to be secure or we wouldn't have the CA system, and they all wouldn't be able to spy on us. If you ask me that's collusion with the enemy against the citizens: Treason.
Often, this is the case for hosts that the intruders want to keep around longer than a few days. Once they've taken good hold of a host, they tend to close off holes that they know about, so others can't get in the same way they did. You often find not just root kits, but also patches rolled out and workarounds to mitigate problems the hackers can't fix without alerting the admin of the box. This doesn't always happen, but most forensics reports I've read and cases I've witnessed myself, hackers tried to close gaps in security of the machines they controlled.
I was promised a flying car. Where is my flying car?
Well, can you spell "plausable deniability"? Makes me question whether the government voluntarily keeps the NSA do what they want, completely or almost completely unsupervised, just to wash its hands if things actually blow up in their face.
"Which CA can be trusted?" (none)
So speaks the man who has never run his own CA. It's not that hard provided you don't want to sign absolutely anyone's certificate (but just ones you know) and provided you're not trying to be trusted by major browsers by default. Not using the PKI to drive commerce and only supporting a few specific clients? You can go entirely private.
"Little does he know, but there is no 'I' in 'Idiot'!"
How about turning it against the NSA?
re: CA changes. Doesn't the EFF have a project with just this purpose in mind?
Perish the very thought. #AmericanExceptionalism
N.S.A.
Spy vs. Spy.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
...is to make crypto such a CLUSTERFUCK that nobody can build a bug-free implementation.
A Blockcipher iN CBC mode (plus a defined last security block, plus a primitive session key exchange) can provide all that SSL/TLS can provide, minus the Public-Key stuff. Which is nice, as it seems more a risk than a benefit.
The same applies to PGP/GPG. I seriously doubt anyone will be able to build a proven secure implementation of this standard. And I bet NSA can get all your keys by simply sending you a GPG message with some nasty exploit inside the data structures.
then i had image of the he haw show
rinse repeat and the word FUCK THEM comes to mind
Criminal vigilante with delusions of grandeur.
This "Steven K." guy ought to get exactly the same sentence as somebody who did that to, say, a bank.