15 ms·

"You've angered the hive"

521 points by acconrad 16y ago

stcredzero 16y ago
People keep on getting hacked. Is it really that hard to prevent that from happening, or is this another case of widespread incompetence and "It won't happen to me" thinking? EDIT: I've commented here before about the scary potential of the /b/ crowd if some of them ever tried to organize and become activists.
- benmathes 16y ago
  The short answer is that it is that hard to fully prevent it from happening. For practical purposes, IT security's job is to make it not worth the effort to break in. And even if you've built a really secure system all it takes is one user with their daughter's name as their password to make it all moot.
  - stcredzero 16y ago
    What if you only have one "user" who only logs in through SSH using port knocking and all of the server's other communication with the rest of the net is through encrypted binary data in UDP packets with fixed-size fields?
    - wmf 16y ago
      Then you're fired because the server doesn't actually work.
      - stcredzero 16y ago
        Then you're fired because the server doesn't actually work. If I were interviewing you, your answer would be considered nonsense and would cause you to not get hired in the first place. I actually need to write such a server for a product I'm working on. All it ever does is encrypted communications with other machines.
        wmf 16y ago
        OK, you're right. You'd only be fired in the other 99.9% of cases, where servers have to support standard protocols and normal users.
        bioh42_2 16y ago
        99.9% of cases, where servers have to support standard protocols and normal user. True. True for all small and big companies' IT. But if you are a security or even just a forensics firm, then you ought to be in the other 0.1%
        Tautologistics 16y ago
        OK, so then forget your "super secure" server. I would instead focus on compromising one of the admin computers that has the "special user" ssh key and the port knock sequence; or maybe I will hit one of the servers communicating with this "secure" computer and see if you remembered to bounds check all the data coming in; maybe even see if you network stack has any exploits in its tcp/udp implementations while I am at it...
        stcredzero 16y ago
        OK, so then forget your "super secure" server. I would instead focus on compromising one of the admin computers that has the "special user" ssh key and the port knock sequence Juicy! [making notes to buy a laptop for the express purpose of logging into the server] maybe I will hit one of the servers communicating with this "secure" computer and see if you remembered to bounds check all the data coming in All fields are fixed length.
        jbri 16y ago
        I have to wonder why you consider port knocking to be a useful security-usability tradeoff. If SSH alone isn't "secure" enough for you, then adding a port knock doesn't actually lift it over that boundary.
        stcredzero 16y ago
    - pavel_lishin 16y ago
      That sounds like a bad balance of usability to security.
      - stcredzero 16y ago
        The entire purpose of the machine is to manage session keys. Yes, this is part of a system that will make money. No, it's not a web app. Warning: answering programming/security questions as if web apps are the whole of computing won't win you points with everyone.
        pavel_lishin 16y ago
        Well, for the highly specialized purpose that I didn't know about before you explained it in this comment, your solution works.
        stcredzero 16y ago
        And for seeing if someone has the knowledge and imagination to come up with such a purpose, I think I've found a good filter.
  - danilocampos 16y ago
    > one user with their daughter's name as their password to make it all moot. I see what you did there.
  - shasta 16y ago
    > And even if you've built a really secure system all it takes is one user with their daughter's name as their password to make it all moot. If your security design allows anyone to SSH in to obtain significant system access using only a user selected password, it isn't "really secure."
    - catshirt 16y ago
      likewise, you could prevent your users from creating such passwords.
- markkat 16y ago
  I think it really is that hard to prevent it from happening. Every organization/system is going to have vulnerabilities from time to time. If you are drawing the ire of those who want in, it's just going to be a matter of time. I really think the best way to secure yourself, is not to piss off folks like Anon.
  - Seth_Kriticos 16y ago
    There is nothing such as a perfectly secured system. There are just less and more secured systems. The effort put in securing the system pretty much defines how much effort and ingenuity is required to penetrate it. Kind of a cat and mouse game or chess.
- de90 16y ago
  Not really the answer to the question, but this was the result of social engineering -> http://pastie.org/1535735 http://pastie.org/1535735 So, even if it was secure, in this case it would have happened..
  - allenp 16y ago
    I think if they required the use of a shibboleth or key phrase in the email they could have avoided this. http://en.wikipedia.org/wiki/Shibboleth http://en.wikipedia.org/wiki/Shibboleth http://en.wikipedia.org/wiki/List_of_shibboleths http://en.wikipedia.org/wiki/List_of_shibboleths
    - JonnieCache 16y ago
      Or, have an agreement that all password resets will be silently ROT13'd against what is requested. So if you say "Can you reset my password to foobar" then your admin knows to actually set it to "sbbone." They can then just send a normal reply saying "ok your password has been set to 'foobar'" and then as long as both parties remember the secret protocol, you are OK. You could then also watch for login attempts using "foobar" to warn you of foul play.
      - artmageddon 16y ago
        That's mostly security by obscurity, in which you're bound to get burned.
        JonnieCache 16y ago
        Could you elaborate?
        jrockway 16y ago
        The security of that system comes from hoping nbobody will guess your key exchange protocol. The security in real key exchange protocols comes from mathematics problems that would take more computer power than the universe has available to solve. So 'your way' is clearly inferior; the attacker guesses (or is told) that ROT13 is what's going on, and you're 0wned and you will never know. Problem.
- tlear 16y ago
  It is difficult. In this case I am sure they knew Anon will come after them and they were SURE they were secure. But when you play with fire you gona get burned
- JoachimSchipper 16y ago
  Unlike benmathes, I'm going with "incompetence". The /b/ crowd hasn't shown much sophistication (yet) - then again, if this kind of straightforward social engineering works, why bother? (Seriously, a security firm that falls for "please drop the firewall and e-mail me the root password"?)
  - metabrew 16y ago
    This is insane and should be cause for extreme suspicion.. As a sysadmin if someone asks you to do this, the correct response is "haha not likely", and at the very least confirm their identity - call them or something. Don't sent the password over email.
    - robryan 16y ago
      It might be that they have never been hacked in this way before, so they don't even consider it. Probably seen older employees do it when they were new giving them the impression that it's just how thing are done.
- phrotoma 16y ago
  I'm reminded of the mitnick/tsutomu tales. I think Anon may be in for some hurt with a guy like Hoglund pissed at them. He's been on the front lines of security research for at least a decade.
  - jinfiesto 16y ago
    I had the same thought. Hoglund is a bamf. It'll be interesting to see what goes down.
JonnieCache 16y ago
"So why can't you sell this information to the FBI like you intended? Because we're going to give it to them for free." As ill advised as messing with the FBI may be, this is a masterstroke. Hats off.
- jayzee 16y ago
  You can't buy stolen stuff. If the FBI wants to use the stuff they may still have to pay for it. Besides deals at that level are all political and given to their buddies. The person who gave the deal to HBGary is going to still fork over the money since what is a few $M between friends esp when they are not your $M.
  - rthomas6 16y ago
    Is it really stolen if people just tell the FBI the information, and it just so happens to be the same information that the security group was going to give?
    - HeyLaughingBoy 16y ago
      Say you and I know this really cute girl. Let's call her Susie. I just won the lottery and I bought a new Mercedes (or whatever the devil it is these kids are driving nowadays...) that I want to give to Susie for Valentine's day. But on Feb 13, I leave the keys in the ignition when the car's in my driveway and you take it and give it to Susie as a present from you to her. You get the love, I get screwed. Is it really stolen if you just give the car to her and it just so happens to be the same car that I was going to give?
      - ddagradi 16y ago
        You wouldn't download a car.
        bloodnok 16y ago
        Fuck you I would.
j_baker 16y ago
> They also vandalized Barr's Twitter and LinkedIn accounts with harsh messages and personal data about Barr, such as his social security number and home address. Ok, I respect what Anonymous is trying to do, but this is a step too far. I'm all for civil disobedience, but this crosses the line in my opinion.
- chc 16y ago
  Given that this is essentially what HBGary was going to do to them, it's actually a kind of poetic justice. Stupid, to be sure, but there's a method to the madness.
  - j_baker 16y ago
    This wasn't justice. It was revenge. There's a difference. Justice accomplishes something. It keeps a bad person from doing bad things. Revenge only makes things worse. I mean, if Barr was going to turn over their information to the FBI before, he sure as hell is going to now. So what dis they accomplish by releasing Barr's personal info? Nothing, morally or practically.
    - AndrewMoffat 16y ago
      > This wasn't justice. It was revenge. There's a difference. Justice accomplishes something. It keeps a bad person from doing bad things. Revenge only makes things worse. I disagree with your definitions. I would say justice is sanctioned legally, while revenge isn't. Aside from that, they're nearly indistinguishable. And given what is and isn't legally sanctioned by countries ("torture" for example), I think the difference is even less.
      - j_baker 16y ago
        Regardless of the semantics, my point was that Anonymous hasn't accomplished anything aside from a feeling of satisfaction. Use whatever language you wish.
catshirt 16y ago
in the pdf anonymous posted of the research [1], several (if not the majority) of the names were unquestionably fake. how does this affect the integrity of the whole document? additionally, how does this whole fiasco impact this agencies possibility of continuing work with the fbi in the future? [1] http://hizost.com/d/zjb http://hizost.com/d/zjb
- chc 16y ago
  Just to emphasize how fake some of the "identities" they uncovered are: The list implicates Guy Fawkes (http://en.wikipedia.org/wiki/Guy_Fawkes http://en.wikipedia.org/wiki/Guy_Fawkes).
  - thomasz 16y ago
    Uhh uhh, bad news for Karl Kot ("Karl Shit") and Daniel Düsentrieb (Gyro Gearloose).
  - catshirt 16y ago
    right. and "Maxx Anu Infobomber", and "Kygon Infraction", and "Buckaroo Bonzai", and "Electromagentic Bomb", and "Wholly Subversive", and "Anonim Espana" (from Spain), and...
    - riffraff 16y ago
      I'm sure you would appreciate "Guido la Vespa" which would sound in english like Guy Wasp, but is also italian for "I drive the Vespa (a kind of scooter)". An approximately 50 year old joke.
steveklabnik 16y ago
First, the satirical: "Anon concedes defeat" http://anonnews.org/?p=press&a=item&i=377 http://anonnews.org/?p=press&a=item&i=377 Then, the 'actual' press release: http://anonnews.org/?p=press&a=item&i=378 http://anonnews.org/?p=press&a=item&i=378 Some choice bits: > The lack of quality in Aaron Barr's undertaken research is worth noting. Aaron Barr missed a great deal of information that has been available online, and in fact failed to identify some of those whose identities were never intended to be hidden. > It is also worth noting that Aaron Barr was also providing this documentation as an example of investigation protocol. This would introduce a systematic flaw to the FBI's investigative woodwork. The risk of institutionalising a flawed procedure exponentiates a problem, and it does so at the taxpayers expense in every sense. Had the FBI indeed bought this information from HBGary Federal, it would have been paid for by taxpayers money, and many innocent people would have been marked as leaders in actions they may not even have been associated with.
kbutler 16y ago
The comments of "It's hard to be really secure, so don't make people mad" are very short-sighted. As society becomes increasingly reliant upon network infrastructure, those who oppose society will increasingly target that infrastructure. When terrorists can cause billions of dollars of losses by hacking the airlines, why bother trying to smuggle weapons on planes? When opposing nations can cripple military and economic infrastructure through computers, why bother developing nuclear weapons? We are rapidly entering a world where our computing infrastructure is both our most critical and our most vulnerable asset. "Speak softly" is completely insufficient without the "carry a big stick" part. kb
- PakG1 16y ago
  Even so, I'd say bombs on a plane still would incite a type of fear that's impossible to instill through cracking secure networks. Of course, lives could be endangered by cracking network infrastructure, especially as we become more reliant on it, but I'd argue that the average person is disconnected enough from the concept to not be emotionally affected or angered by it. At least until there's a really big incident on the level of Chernobyl that causes people to irrationally distrust networks no matter how good network security gets, similar to how some people irrationally distrust nuclear power plants today, no matter how safe they may have become.
  - loewenskind 16y ago
    You think a bomb blowing up a plane is more scary than a plane just randomly deciding to fly into something? I don't. Plane control hacking is vastly more scary than bombs because one break means someone on the other side of the earth can do what ever he/she wants with all of them at the same time.
    - PakG1 16y ago
      I didn't say that. I said the average person would be too disconnected from the topic to to fear it, most likely because they wouldn't be able to intellectually consider it. I did say that it would take a Chernobyl-level incident to wake people up, and if we ever get that, it would cause things to swing to the opposite side from indifference to paranoia (if it were to happen).
jayzee 16y ago
If this is this the website: http://www.hbgary.com/ http://www.hbgary.com/ then it is even funnier.
- solutionyogi 16y ago
  Nope, that's not the company website. Company website is at http://www.hbgaryfederal.com/ http://www.hbgaryfederal.com/ and is currently down.
steveklabnik 16y ago
Oh, and check out this pastie: http://pastie.org/1535735 http://pastie.org/1535735 Social engineering. People are always the weakest link...
- vaksel 16y ago
  not really that wouldn't have worked if they didn't hack the email first
  - steveklabnik 16y ago
    It was simply spoofed, from what I understand.
    - elliottcarlson 16y ago
      Spoofing would be hiding the senders address, but something, either a hacked account or MITM attack, would need to happen to get the responses from the IT person.
      - steveklabnik 16y ago
        Ah, good catch.
      - mikeryan 16y ago
        Couldn't you display the one email and use a separate Reply-To addy to get responses? (and hope no one notices) This is not my forte I'm likely off.
        thaumaturgy 16y ago
        Yes, and depending on the email client on the other end, the other person wouldn't even notice. The only guard against something like this is SPF on the sender's domain and for the recipient's mail server to check (and enforce) SPF rules.
evo_9 16y ago
My admiration for this group just went up another big notch. Very well played.
bgurupra 16y ago
This is like the Fight Club of the internets!
- bgurupra 16y ago
  if I may ask why the downvote?
  - bhousel 16y ago
    Because you're not supposed to talk about it.
  - bgurupra 16y ago
    hahahahaha this is frickin unbelievable, I get downvoted but the guy who says not to talk about the fight club is upvoted like crazy - so THIS is the FIGHT CLUB!
    - bgurupra 16y ago
      and seriously screw you guys downvoting me (sorry for being douchy) - but it is really irritating to get downvoted without being told why
      - BrandonM 16y ago
        Your post had little substance, and using the phrase "the internets" certainly didn't help.
Jun8 16y ago
Although I find the anons a bit creepy, in this case hats off to them. I find this move to be more or less equivalent to Wikileaks, so it's impossible to defend one and vilify the other. I actually think that it's much better for our society than Wikileaks since it exposes the type of clueless people/agencies that FBI pays (our) money to. BTW, I'm a member (since a true anon would never reveal this, that's how you know I'm not one of them).
smbwrs 16y ago
What interests me most about Anonymous is the fact that it's actually two groups: the small group of technically-competent individuals, and the LOIC script-kiddie griefer minions who can be dispatched at will. The griefers get the media attention and do it "for the lulz", while the folks with actual skills penetrate systems and expose private information. If I had to guess, I'd say that HBGary got a little information on a bunch of the griefers, and near nothing on the people who can do real damage. If I were a hacker, Anonymous - that is, the 4chan script-kiddie bunch - would make for incredible front line. They generate an unbelievable amount of noise, and a very particular kind of hacker-ish noise, which I'd imagine is fantastic for redirecting attention and covering tracks as necessary. The recent FBI raids, for example. http://news.yahoo.com/s/afp/20110128/tc_afp/britainarrestwikileaksinternetanonymous http://news.yahoo.com/s/afp/20110128/tc_afp/britainarrestwik...
- wh-uws 16y ago
  I would totally agree with this. They raided a kid at my university and all he was doing was administrating one of the IRC channels
- lsb 16y ago
  So as long as you can convince impressionable young people that some entity is acting against Freedom, you will be able to mobilize them to give you cover for your activities. That seems true in other circumstances also.
  - duairc 16y ago
    How I wish that were true! Most people, young and old, really don't care at all.
    - vacri 16y ago
      "Don't care" in the form of getting out and proactively doing something, yes. "Don't care" in the form of clicking a preorganised button ("sign online petition", "retweet this travesty", "join this voluntary botnet"), plenty of folk care that way. If your engagement in the nominated activity can be fully completed before you finish your beverage of choice, the internet is full of caring individuals...
mkr-hn 16y ago
"So it’s a case where the hackers break in on a non-important system, which is very common in hacking situations, and leveraged lateral movement to get onto systems of interest over time." = "We're too lazy to make sure each level of security is protected from the last."
BrandonM 16y ago
It's kind of gross the admiration people are expressing here. I work for a security firm that does work with all kinds of organizations. At the heart of the matter, we are scientists investigating the truth. If a break-in occurred, who was responsible, and what was compromised? If someone is being charged with distribution of child pornography, did they willfully download and distribute it, or was it part of a wide net that was cast to download a whole bunch of porn at once? This DDoS occurred: who was responsible? You have security in place: is it sufficient to protect the data in an appropriate manner? We are a small firm. Our yearly revenue is probably nearly $1-1.5 million. Including the founder, we have eight people employed: a mother of two, three people who have poured over ten years of their lives into building the company to its current level, a cancer survivor still undergoing treatment, and three others who are doing good work while making ends meet and paying down school loans. Something like this happening to our company, an event that led to $1MM+ in losses, would wipe us out. It would end a company that provides a valuable service to dozens of law firms and other organizations (colleges, hospitals, local political entities, etc.) each year. It would immediately put eight people out of work and negate 50+ man-years of effort. Call me crazy, but I am not patting these guys on the back. It's all fun and games until you're ruining lives.
- JonnieCache 16y ago
  Destroying a company that both takes government security contracts, and also drops the firewall and gives out the root password after an email request is a public service. Such a company is a danger to the safety of every citizen in america and beyond. A lot more than eight lives could be ruined if they had been investigating organised crime or terrorism instead of anon. Harsh but I think true.
  - yters 16y ago
    You people are so socially retarded. How can such speculation justify ruining actual lives in anyway? There is no way you can concretely justify anything you claim there.
    - pkulak 16y ago
freescale 16y ago
The most polite spin I can put on the cheering of these sorts of techniques, is that too many Hacker News members lack sufficient historical awareness to realize that these tactics are reminiscent of the public humiliation and crowd intimidation techniques employed by Italy's blackshirts in the 30s. There are reasons why we have rule of law and courts. There are reasons why it is not acceptable for one group to retaliate against another group, no matter how strongly they may feel they are in the right.
- michaelchisari 16y ago
  the public humiliation and crowd intimidation techniques employed by Italy's blackshirts in the 30s Aren't they just as comparable to the satirical press releases of the Yippies and (more recently) the Yes Men? Your comparison seems to be a case of false equivalency.
- deleted 16y ago
  [deleted]
deleted 16y ago
[deleted]
bueller 16y ago
http://www.youtube.com/watch?v=l6gXhPFHRDo http://www.youtube.com/watch?v=l6gXhPFHRDo
- bueller 16y ago
  how is this link not related to this story...vote me down more jackasses
light3 16y ago
From http://www.thetechherald.com/article.php/201106/6785 http://www.thetechherald.com/article.php/201106/6785 "There was a distinction made that HBGary only owns 15-percent of HBGary Federal, and that attacking both was wrong, as one had nothing to do with the other. The networks shared many common elements, that they are only moderately related was irrelevant to Anonymous." "In addition, there were several calls for Barr to be burned by HBGary, but given that he is a partner, that is unlikely. At this stage, HBGary’s response is unknown. At the time this article was written, aside from the conversations on IRC, there has been no official comment."
pdenya 16y ago
I love the writing as much as the quotes in this article. "It would appear that security experts are not expertly secured," "It's unlikely that Anonymous cares about what Hoglund thinks" I haven't laughed out loud at something I've read like this in a while.
hysterix 16y ago
Well done gentlemen. I don't give a fuck that I'm on that list. I use bounce email addresses and multiple, very difficult to crack passwords for a reason. Good for exposing their 'security' company.
vilya 16y ago
Anonymous begins to remind me of the rabbit from Vernor Vinge's "Rainbows End"...
juiceandjuice 16y ago
Ladies and gentleman, the definition of pwnd.
olalonde 16y ago
Don't these guys have something more productive to do with their time? Seriously, don't tell me 4chan is a freakin' political movement. If it really is, why don't they start by cleaning up the child porn that gets posted on their board daily?[1] The "noble cause" they are supposedly defending is nothing but a pretext to go on their power trips. [1] (NSFW) http://boards.4chan.org/b/ http://boards.4chan.org/b/
- leon_ 16y ago
  yeah, they should start working for the government to build intelligent drones that could hunt down those muslin terrorists around the world!
stuhacking 16y ago
Anon hacks HBGary and all they get is a lot of already public information? Maybe Anon just stuck their hand in the honeypot... Just thinking out loud.

521 points by acconrad 16y ago

People keep on getting hacked. Is it really that hard to prevent that from happening, or is this another case of widespread incompetence and "It won't happen to me" thinking? EDIT: I've commented here before about the scary potential of the /b/ crowd if some of them ever tried to organize and become activists.

benmathes 16y ago
The short answer is that it is that hard to fully prevent it from happening. For practical purposes, IT security's job is to make it not worth the effort to break in. And even if you've built a really secure system all it takes is one user with their daughter's name as their password to make it all moot.
- stcredzero 16y ago
  What if you only have one "user" who only logs in through SSH using port knocking and all of the server's other communication with the rest of the net is through encrypted binary data in UDP packets with fixed-size fields?
  - wmf 16y ago
    Then you're fired because the server doesn't actually work.
    - stcredzero 16y ago
      Then you're fired because the server doesn't actually work. If I were interviewing you, your answer would be considered nonsense and would cause you to not get hired in the first place. I actually need to write such a server for a product I'm working on. All it ever does is encrypted communications with other machines.
      - wmf 16y ago
        OK, you're right. You'd only be fired in the other 99.9% of cases, where servers have to support standard protocols and normal users.
        bioh42_2 16y ago
        99.9% of cases, where servers have to support standard protocols and normal user. True. True for all small and big companies' IT. But if you are a security or even just a forensics firm, then you ought to be in the other 0.1%
      - Tautologistics 16y ago
        OK, so then forget your "super secure" server. I would instead focus on compromising one of the admin computers that has the "special user" ssh key and the port knock sequence; or maybe I will hit one of the servers communicating with this "secure" computer and see if you remembered to bounds check all the data coming in; maybe even see if you network stack has any exploits in its tcp/udp implementations while I am at it...
        stcredzero 16y ago
        OK, so then forget your "super secure" server. I would instead focus on compromising one of the admin computers that has the "special user" ssh key and the port knock sequence Juicy! [making notes to buy a laptop for the express purpose of logging into the server] maybe I will hit one of the servers communicating with this "secure" computer and see if you remembered to bounds check all the data coming in All fields are fixed length.
      - jbri 16y ago
        I have to wonder why you consider port knocking to be a useful security-usability tradeoff. If SSH alone isn't "secure" enough for you, then adding a port knock doesn't actually lift it over that boundary.
        stcredzero 16y ago
  - pavel_lishin 16y ago
    That sounds like a bad balance of usability to security.
    - stcredzero 16y ago
      The entire purpose of the machine is to manage session keys. Yes, this is part of a system that will make money. No, it's not a web app. Warning: answering programming/security questions as if web apps are the whole of computing won't win you points with everyone.
      - pavel_lishin 16y ago
        Well, for the highly specialized purpose that I didn't know about before you explained it in this comment, your solution works.
        stcredzero 16y ago
        And for seeing if someone has the knowledge and imagination to come up with such a purpose, I think I've found a good filter.
- danilocampos 16y ago
  > one user with their daughter's name as their password to make it all moot. I see what you did there.
- shasta 16y ago
  > And even if you've built a really secure system all it takes is one user with their daughter's name as their password to make it all moot. If your security design allows anyone to SSH in to obtain significant system access using only a user selected password, it isn't "really secure."
  - catshirt 16y ago
    likewise, you could prevent your users from creating such passwords.
markkat 16y ago
I think it really is that hard to prevent it from happening. Every organization/system is going to have vulnerabilities from time to time. If you are drawing the ire of those who want in, it's just going to be a matter of time. I really think the best way to secure yourself, is not to piss off folks like Anon.
- Seth_Kriticos 16y ago
  There is nothing such as a perfectly secured system. There are just less and more secured systems. The effort put in securing the system pretty much defines how much effort and ingenuity is required to penetrate it. Kind of a cat and mouse game or chess.
de90 16y ago
Not really the answer to the question, but this was the result of social engineering -> http://pastie.org/1535735 http://pastie.org/1535735 So, even if it was secure, in this case it would have happened..
- allenp 16y ago
  I think if they required the use of a shibboleth or key phrase in the email they could have avoided this. http://en.wikipedia.org/wiki/Shibboleth http://en.wikipedia.org/wiki/Shibboleth http://en.wikipedia.org/wiki/List_of_shibboleths http://en.wikipedia.org/wiki/List_of_shibboleths
  - JonnieCache 16y ago
    Or, have an agreement that all password resets will be silently ROT13'd against what is requested. So if you say "Can you reset my password to foobar" then your admin knows to actually set it to "sbbone." They can then just send a normal reply saying "ok your password has been set to 'foobar'" and then as long as both parties remember the secret protocol, you are OK. You could then also watch for login attempts using "foobar" to warn you of foul play.
    - artmageddon 16y ago
      That's mostly security by obscurity, in which you're bound to get burned.
      - JonnieCache 16y ago
        Could you elaborate?
        jrockway 16y ago
        The security of that system comes from hoping nbobody will guess your key exchange protocol. The security in real key exchange protocols comes from mathematics problems that would take more computer power than the universe has available to solve. So 'your way' is clearly inferior; the attacker guesses (or is told) that ROT13 is what's going on, and you're 0wned and you will never know. Problem.
tlear 16y ago
It is difficult. In this case I am sure they knew Anon will come after them and they were SURE they were secure. But when you play with fire you gona get burned
JoachimSchipper 16y ago
Unlike benmathes, I'm going with "incompetence". The /b/ crowd hasn't shown much sophistication (yet) - then again, if this kind of straightforward social engineering works, why bother? (Seriously, a security firm that falls for "please drop the firewall and e-mail me the root password"?)
- metabrew 16y ago
  This is insane and should be cause for extreme suspicion.. As a sysadmin if someone asks you to do this, the correct response is "haha not likely", and at the very least confirm their identity - call them or something. Don't sent the password over email.
  - robryan 16y ago
    It might be that they have never been hacked in this way before, so they don't even consider it. Probably seen older employees do it when they were new giving them the impression that it's just how thing are done.
phrotoma 16y ago
I'm reminded of the mitnick/tsutomu tales. I think Anon may be in for some hurt with a guy like Hoglund pissed at them. He's been on the front lines of security research for at least a decade.
- jinfiesto 16y ago
  I had the same thought. Hoglund is a bamf. It'll be interesting to see what goes down.

JonnieCache 16y ago

"So why can't you sell this information to the FBI like you intended? Because we're going to give it to them for free." As ill advised as messing with the FBI may be, this is a masterstroke. Hats off.

jayzee 16y ago
You can't buy stolen stuff. If the FBI wants to use the stuff they may still have to pay for it. Besides deals at that level are all political and given to their buddies. The person who gave the deal to HBGary is going to still fork over the money since what is a few $M between friends esp when they are not your $M.
- rthomas6 16y ago
  Is it really stolen if people just tell the FBI the information, and it just so happens to be the same information that the security group was going to give?
  - HeyLaughingBoy 16y ago
    Say you and I know this really cute girl. Let's call her Susie. I just won the lottery and I bought a new Mercedes (or whatever the devil it is these kids are driving nowadays...) that I want to give to Susie for Valentine's day. But on Feb 13, I leave the keys in the ignition when the car's in my driveway and you take it and give it to Susie as a present from you to her. You get the love, I get screwed. Is it really stolen if you just give the car to her and it just so happens to be the same car that I was going to give?
    - ddagradi 16y ago
      You wouldn't download a car.
      - bloodnok 16y ago
        Fuck you I would.

j_baker 16y ago

> They also vandalized Barr's Twitter and LinkedIn accounts with harsh messages and personal data about Barr, such as his social security number and home address. Ok, I respect what Anonymous is trying to do, but this is a step too far. I'm all for civil disobedience, but this crosses the line in my opinion.

chc 16y ago
Given that this is essentially what HBGary was going to do to them, it's actually a kind of poetic justice. Stupid, to be sure, but there's a method to the madness.
- j_baker 16y ago
  This wasn't justice. It was revenge. There's a difference. Justice accomplishes something. It keeps a bad person from doing bad things. Revenge only makes things worse. I mean, if Barr was going to turn over their information to the FBI before, he sure as hell is going to now. So what dis they accomplish by releasing Barr's personal info? Nothing, morally or practically.
  - AndrewMoffat 16y ago
    > This wasn't justice. It was revenge. There's a difference. Justice accomplishes something. It keeps a bad person from doing bad things. Revenge only makes things worse. I disagree with your definitions. I would say justice is sanctioned legally, while revenge isn't. Aside from that, they're nearly indistinguishable. And given what is and isn't legally sanctioned by countries ("torture" for example), I think the difference is even less.
    - j_baker 16y ago
      Regardless of the semantics, my point was that Anonymous hasn't accomplished anything aside from a feeling of satisfaction. Use whatever language you wish.

catshirt 16y ago

in the pdf anonymous posted of the research [1], several (if not the majority) of the names were unquestionably fake. how does this affect the integrity of the whole document? additionally, how does this whole fiasco impact this agencies possibility of continuing work with the fbi in the future? [1] http://hizost.com/d/zjb http://hizost.com/d/zjb

chc 16y ago
Just to emphasize how fake some of the "identities" they uncovered are: The list implicates Guy Fawkes (http://en.wikipedia.org/wiki/Guy_Fawkes http://en.wikipedia.org/wiki/Guy_Fawkes).
- thomasz 16y ago
  Uhh uhh, bad news for Karl Kot ("Karl Shit") and Daniel Düsentrieb (Gyro Gearloose).
- catshirt 16y ago
  right. and "Maxx Anu Infobomber", and "Kygon Infraction", and "Buckaroo Bonzai", and "Electromagentic Bomb", and "Wholly Subversive", and "Anonim Espana" (from Spain), and...
  - riffraff 16y ago
    I'm sure you would appreciate "Guido la Vespa" which would sound in english like Guy Wasp, but is also italian for "I drive the Vespa (a kind of scooter)". An approximately 50 year old joke.

steveklabnik 16y ago

First, the satirical: "Anon concedes defeat" http://anonnews.org/?p=press&a=item&i=377 http://anonnews.org/?p=press&a=item&i=377 Then, the 'actual' press release: http://anonnews.org/?p=press&a=item&i=378 http://anonnews.org/?p=press&a=item&i=378 Some choice bits: > The lack of quality in Aaron Barr's undertaken research is worth noting. Aaron Barr missed a great deal of information that has been available online, and in fact failed to identify some of those whose identities were never intended to be hidden. > It is also worth noting that Aaron Barr was also providing this documentation as an example of investigation protocol. This would introduce a systematic flaw to the FBI's investigative woodwork. The risk of institutionalising a flawed procedure exponentiates a problem, and it does so at the taxpayers expense in every sense. Had the FBI indeed bought this information from HBGary Federal, it would have been paid for by taxpayers money, and many innocent people would have been marked as leaders in actions they may not even have been associated with.

kbutler 16y ago

The comments of "It's hard to be really secure, so don't make people mad" are very short-sighted. As society becomes increasingly reliant upon network infrastructure, those who oppose society will increasingly target that infrastructure. When terrorists can cause billions of dollars of losses by hacking the airlines, why bother trying to smuggle weapons on planes? When opposing nations can cripple military and economic infrastructure through computers, why bother developing nuclear weapons? We are rapidly entering a world where our computing infrastructure is both our most critical and our most vulnerable asset. "Speak softly" is completely insufficient without the "carry a big stick" part. kb

PakG1 16y ago
Even so, I'd say bombs on a plane still would incite a type of fear that's impossible to instill through cracking secure networks. Of course, lives could be endangered by cracking network infrastructure, especially as we become more reliant on it, but I'd argue that the average person is disconnected enough from the concept to not be emotionally affected or angered by it. At least until there's a really big incident on the level of Chernobyl that causes people to irrationally distrust networks no matter how good network security gets, similar to how some people irrationally distrust nuclear power plants today, no matter how safe they may have become.
- loewenskind 16y ago
  You think a bomb blowing up a plane is more scary than a plane just randomly deciding to fly into something? I don't. Plane control hacking is vastly more scary than bombs because one break means someone on the other side of the earth can do what ever he/she wants with all of them at the same time.
  - PakG1 16y ago
    I didn't say that. I said the average person would be too disconnected from the topic to to fear it, most likely because they wouldn't be able to intellectually consider it. I did say that it would take a Chernobyl-level incident to wake people up, and if we ever get that, it would cause things to swing to the opposite side from indifference to paranoia (if it were to happen).

jayzee 16y ago

If this is this the website: http://www.hbgary.com/ http://www.hbgary.com/ then it is even funnier.

solutionyogi 16y ago
Nope, that's not the company website. Company website is at http://www.hbgaryfederal.com/ http://www.hbgaryfederal.com/ and is currently down.

steveklabnik 16y ago

Oh, and check out this pastie: http://pastie.org/1535735 http://pastie.org/1535735 Social engineering. People are always the weakest link...

vaksel 16y ago
not really that wouldn't have worked if they didn't hack the email first
- steveklabnik 16y ago
  It was simply spoofed, from what I understand.
  - elliottcarlson 16y ago
    Spoofing would be hiding the senders address, but something, either a hacked account or MITM attack, would need to happen to get the responses from the IT person.
    - steveklabnik 16y ago
      Ah, good catch.
    - mikeryan 16y ago
      Couldn't you display the one email and use a separate Reply-To addy to get responses? (and hope no one notices) This is not my forte I'm likely off.
      - thaumaturgy 16y ago
        Yes, and depending on the email client on the other end, the other person wouldn't even notice. The only guard against something like this is SPF on the sender's domain and for the recipient's mail server to check (and enforce) SPF rules.

evo_9 16y ago

My admiration for this group just went up another big notch. Very well played.

bgurupra 16y ago

This is like the Fight Club of the internets!

bgurupra 16y ago
if I may ask why the downvote?
- bhousel 16y ago
  Because you're not supposed to talk about it.
- bgurupra 16y ago
  hahahahaha this is frickin unbelievable, I get downvoted but the guy who says not to talk about the fight club is upvoted like crazy - so THIS is the FIGHT CLUB!
  - bgurupra 16y ago
    and seriously screw you guys downvoting me (sorry for being douchy) - but it is really irritating to get downvoted without being told why
    - BrandonM 16y ago
      Your post had little substance, and using the phrase "the internets" certainly didn't help.

Jun8 16y ago

Although I find the anons a bit creepy, in this case hats off to them. I find this move to be more or less equivalent to Wikileaks, so it's impossible to defend one and vilify the other. I actually think that it's much better for our society than Wikileaks since it exposes the type of clueless people/agencies that FBI pays (our) money to. BTW, I'm a member (since a true anon would never reveal this, that's how you know I'm not one of them).

smbwrs 16y ago

What interests me most about Anonymous is the fact that it's actually two groups: the small group of technically-competent individuals, and the LOIC script-kiddie griefer minions who can be dispatched at will. The griefers get the media attention and do it "for the lulz", while the folks with actual skills penetrate systems and expose private information. If I had to guess, I'd say that HBGary got a little information on a bunch of the griefers, and near nothing on the people who can do real damage. If I were a hacker, Anonymous - that is, the 4chan script-kiddie bunch - would make for incredible front line. They generate an unbelievable amount of noise, and a very particular kind of hacker-ish noise, which I'd imagine is fantastic for redirecting attention and covering tracks as necessary. The recent FBI raids, for example. http://news.yahoo.com/s/afp/20110128/tc_afp/britainarrestwikileaksinternetanonymous http://news.yahoo.com/s/afp/20110128/tc_afp/britainarrestwik...

wh-uws 16y ago
I would totally agree with this. They raided a kid at my university and all he was doing was administrating one of the IRC channels
lsb 16y ago
So as long as you can convince impressionable young people that some entity is acting against Freedom, you will be able to mobilize them to give you cover for your activities. That seems true in other circumstances also.
- duairc 16y ago
  How I wish that were true! Most people, young and old, really don't care at all.
  - vacri 16y ago
    "Don't care" in the form of getting out and proactively doing something, yes. "Don't care" in the form of clicking a preorganised button ("sign online petition", "retweet this travesty", "join this voluntary botnet"), plenty of folk care that way. If your engagement in the nominated activity can be fully completed before you finish your beverage of choice, the internet is full of caring individuals...

mkr-hn 16y ago

"So it’s a case where the hackers break in on a non-important system, which is very common in hacking situations, and leveraged lateral movement to get onto systems of interest over time." = "We're too lazy to make sure each level of security is protected from the last."

BrandonM 16y ago

It's kind of gross the admiration people are expressing here. I work for a security firm that does work with all kinds of organizations. At the heart of the matter, we are scientists investigating the truth. If a break-in occurred, who was responsible, and what was compromised? If someone is being charged with distribution of child pornography, did they willfully download and distribute it, or was it part of a wide net that was cast to download a whole bunch of porn at once? This DDoS occurred: who was responsible? You have security in place: is it sufficient to protect the data in an appropriate manner? We are a small firm. Our yearly revenue is probably nearly $1-1.5 million. Including the founder, we have eight people employed: a mother of two, three people who have poured over ten years of their lives into building the company to its current level, a cancer survivor still undergoing treatment, and three others who are doing good work while making ends meet and paying down school loans. Something like this happening to our company, an event that led to $1MM+ in losses, would wipe us out. It would end a company that provides a valuable service to dozens of law firms and other organizations (colleges, hospitals, local political entities, etc.) each year. It would immediately put eight people out of work and negate 50+ man-years of effort. Call me crazy, but I am not patting these guys on the back. It's all fun and games until you're ruining lives.

JonnieCache 16y ago
Destroying a company that both takes government security contracts, and also drops the firewall and gives out the root password after an email request is a public service. Such a company is a danger to the safety of every citizen in america and beyond. A lot more than eight lives could be ruined if they had been investigating organised crime or terrorism instead of anon. Harsh but I think true.
- yters 16y ago
  You people are so socially retarded. How can such speculation justify ruining actual lives in anyway? There is no way you can concretely justify anything you claim there.
  - pkulak 16y ago

freescale 16y ago

The most polite spin I can put on the cheering of these sorts of techniques, is that too many Hacker News members lack sufficient historical awareness to realize that these tactics are reminiscent of the public humiliation and crowd intimidation techniques employed by Italy's blackshirts in the 30s. There are reasons why we have rule of law and courts. There are reasons why it is not acceptable for one group to retaliate against another group, no matter how strongly they may feel they are in the right.

michaelchisari 16y ago
the public humiliation and crowd intimidation techniques employed by Italy's blackshirts in the 30s Aren't they just as comparable to the satirical press releases of the Yippies and (more recently) the Yes Men? Your comparison seems to be a case of false equivalency.
deleted 16y ago
[deleted]

deleted 16y ago

[deleted]

bueller 16y ago

http://www.youtube.com/watch?v=l6gXhPFHRDo http://www.youtube.com/watch?v=l6gXhPFHRDo

bueller 16y ago
how is this link not related to this story...vote me down more jackasses

light3 16y ago

From http://www.thetechherald.com/article.php/201106/6785 http://www.thetechherald.com/article.php/201106/6785 "There was a distinction made that HBGary only owns 15-percent of HBGary Federal, and that attacking both was wrong, as one had nothing to do with the other. The networks shared many common elements, that they are only moderately related was irrelevant to Anonymous." "In addition, there were several calls for Barr to be burned by HBGary, but given that he is a partner, that is unlikely. At this stage, HBGary’s response is unknown. At the time this article was written, aside from the conversations on IRC, there has been no official comment."

pdenya 16y ago

I love the writing as much as the quotes in this article. "It would appear that security experts are not expertly secured," "It's unlikely that Anonymous cares about what Hoglund thinks" I haven't laughed out loud at something I've read like this in a while.

hysterix 16y ago

Well done gentlemen. I don't give a fuck that I'm on that list. I use bounce email addresses and multiple, very difficult to crack passwords for a reason. Good for exposing their 'security' company.

vilya 16y ago

Anonymous begins to remind me of the rabbit from Vernor Vinge's "Rainbows End"...

juiceandjuice 16y ago

Ladies and gentleman, the definition of pwnd.

olalonde 16y ago

Don't these guys have something more productive to do with their time? Seriously, don't tell me 4chan is a freakin' political movement. If it really is, why don't they start by cleaning up the child porn that gets posted on their board daily?[1] The "noble cause" they are supposedly defending is nothing but a pretext to go on their power trips. [1] (NSFW) http://boards.4chan.org/b/ http://boards.4chan.org/b/

leon_ 16y ago
yeah, they should start working for the government to build intelligent drones that could hunt down those muslin terrorists around the world!

stuhacking 16y ago

Anon hacks HBGary and all they get is a lot of already public information? Maybe Anon just stuck their hand in the honeypot... Just thinking out loud.