5 ms·

These attacks are annoying and damaging but in the long run they make our internet stronger. If these didn't happen so often people would care a lot less about

by lwat 15y ago

These attacks are annoying and damaging but in the long run they make our internet stronger. If these didn't happen so often people would care a lot less about security and robustness.

Cushman 15y ago
If these didn't happen so often people wouldn't need to. Why should Random Internet Game care about security aside from dicks like these guys?
- daeken 15y ago
  Because people that actually want your credit card info, game source, etc aren't talking about it on the web. They're just doing it. If you care about the integrity of your data, you damn well better care about your security.
  - btilly 15y ago
    Absolutely true. My credit card number was used from Turkey this week. I have absolutely no idea which website was compromised. And I am pretty sure that whoever was compromised has no idea either.
    - Vivtek 15y ago
      Might not be a website - my wife's and my debit cards were compromised last year within two weeks of one another. The only thing they had in common was that they're at the same bank; she has never even once used her card online. Our conclusion was that Chase Manhattan had been compromised. That's kind of scary, really. They have to be spending serious money on security.
      - jonafato 15y ago
        To clarify, by "they have to", are you stating a fact or making a demand? One would have thought that Citigroup would have had some pretty tight security as well.
        Vivtek 15y ago
        I think I'm accentuating an assumption - and when I saw the Citigroup story, I had precisely the reaction you just expressed here. And yet you know that Chase and Citigroup are spending money on security in copious amounts. My heart breaks to think of all those guys getting paid not to know jack. (Or, just as probably, all those guys getting paid not to be able to shove jack through the corporate process.)
      - btilly 15y ago
        It could have been coincidence and an offline compromise for your wife. There are a lot of skimming operations out there. Plus when you give your card to a waiter at a restaurant, nothing stops the waiter from copying your information. In my case the fact that the purchase was made from Turkey suggests that it was an online compromise.
  - Cushman 15y ago
    That's not what happened here, though. There wasn't any release of server info; from the tweets, this was just a string of DDoS attacks. If my account information or personal details are vulnerable to theft somehow, I want to know about that. But if a server I play games on can be taken down by DDoS, I'd happily go the rest of my life not knowing or caring so long as it doesn't actually happen. It contributes about as much as showing me that that bridge I like to drive over is susceptible to bombing. Not that I play any of these games, mind.
- ineedtosleep 15y ago
  You do understand that lulzsec is deliberately publicizing acts that would usually go untraced, right? Security is security: If you don't have any and you house information, you will eventually be burned. Yes it's getting annoying, but they're doing it for the lulz. You can't say the same about all the other malicious hackers.
cube13 15y ago
The attacks on the Minecraft and EVE servers were DDOS attacks. Nothing sophisticated, and the easy way to avoid them is to just get more servers, which really isn't a good solution for smaller developers. EDIT: I suspect the only reason they didn't succeed getting to Blizzard is because WoW was down for Tuesday maintenance.
- socillion 15y ago
  I suspect the reason is simply because they don't have the resources. EVE maxes out at about 35-40k simultaneous connections, WoW is probably closer to 400-500k per region. edit - # of accounts is 360k vs 12mil.
  - lclarkmichalek 15y ago
    They targeted the EVE login server however, and I doubt that is designed for 35-40k simultaneous connections, as to acomplish those conditions, all users on the server would need to log in at the same time. The same is probabaly true for WoW.
    - alanfalcon 15y ago
      The login server for WoW easily and routinely handles an incredible number of simultaneous connections as huge percentages of the player base attempt to log in at the same time, particularly after a large patch. There used to be incredible issues with the login server, but these days Blizzard is an extremely tightly run ship. They know where their money comes from, and what it takes to protect the cash flow.
der_ketzer 15y ago
Should I rob every house that doesn't have an alarm or leaves the window open? I agree with you it "helps" to care more about security and robustness. But I don't agree in the way. I have a dream that one day my website with minimum security won't be hacked for lulz and will be treated with respect. =)
- daeken 15y ago
  Let's phrase this in another hyperbole, shall we? Should you rob every bank that doesn't have an alarm or leaves the vault open? No. But if a lot of banks had no policies in place to prevent those things from occurring, would you feel more secure that someone was walking into the bank, taking photos of their break-in, and not stealing the money? I don't agree with their means (it's wrong, IMO, to mess with any machine you don't have permission to mess with) but their end goal aligns with mine: make the world more secure. > I have a dream that one day my website with minimum security won't be hacked for lulz and will be treated with respect. =) Would you rather have your site hacked for lulz, or would you rather someone go in and sell your customer's data on the black market?
  - hugh3 15y ago
    But if these are just DDOSes, then (a) there's no way to steal sensitive information that way, and (b) there's no real defence against 'em anyway. So this particular argument is pointless, right? There's an argument for whiteish-hat intrusions, but DDOSes must be intrinsically black-hat, right?
    - daeken 15y ago
      Yea, I'd definitely agree in the case of DDOSes -- they don't seem to make sense with their other attacks, even. Silly and destructive.
    - niels_olson 15y ago
      >DDOSes must be intrinsically black-hat, right? No. While I agree there's no red-team contribution in a DDOS, quite a few people regarded Anonymous DDOSes on Wikileaks detractors (MasterCard, et al) as the digital equivalent of a sit-in. That seems a bit of a stretch to me also, but certainly there's some application of DDOS that's not purely black-hat.
mindstab 15y ago
I suppose a bit like firesheep has cause a lot of sites to start pushing SSL more aggressively and even looking into dealing with some of SSL's quirks that have kept it from gaining more popular usage
deleted 15y ago
[deleted]
hugh3 15y ago
Sure, and I can go around punching people in the face and tell 'em that I'm doing 'em a favour by reminding them to always wear a full-face helmet when out in public. But if nobody except me is a big enough asshole to go round punching people in the face at random...
- fourk 15y ago
  The difference is that one of those people could very well return the favor and give you a proper ass kicking, or determine your identity with relative ease and file a complaint with the police. The disincentives that exist for your example and those that exist for actions similar to those taken by lulzsec are radically different. The conclusion that people should walk around with full-face helmets is ridiculous because of the existing disincentives for assaulting someone. The conclusion that companies should secure their networks, not such an unreasonable expectation.
  - brisance 15y ago
    I don't think it's that easy to identify the hackers. Even if you could, which legal jurisdiction applies? What are the legal remedies? Securing networks is indeed a noble goal, but are we prepared to pay for the infrastructure? The end result does not justify the means, and we all know how the story goes. More legislation to "prevent" hacking, and everyone suffers under the yoke of over-reaction.
  - roel_v 15y ago
    Right, the problem is that 'digital criminals' are a) not likely enough to get caught, and b) not punished enough if/when they are. What we need are stronger punishments against digital vandalism and profit-oriented digital burglary alike, and more and stronger enforcement. (not being sarcastic, in case anyone's wondering)
    - StavrosK 15y ago
      Good thing our politicians are listening and are prepared to clamp down hard on illegal filesharing.
InclinedPlane 15y ago
Maybe they'll raise awareness of security issues and get companies to take it more seriously. Or maybe we'll just see more security theater and companies will use their lobbying powers to put in place draconian laws against any form of "hacking".
mtw 15y ago
you make it sound like we should congratulate lulz for good work

by lwat 15y ago

These attacks are annoying and damaging but in the long run they make our internet stronger. If these didn't happen so often people would care a lot less about security and robustness.

Cushman 15y ago

If these didn't happen so often people wouldn't need to. Why should Random Internet Game care about security aside from dicks like these guys?

daeken 15y ago
Because people that actually want your credit card info, game source, etc aren't talking about it on the web. They're just doing it. If you care about the integrity of your data, you damn well better care about your security.
- btilly 15y ago
  Absolutely true. My credit card number was used from Turkey this week. I have absolutely no idea which website was compromised. And I am pretty sure that whoever was compromised has no idea either.
  - Vivtek 15y ago
    Might not be a website - my wife's and my debit cards were compromised last year within two weeks of one another. The only thing they had in common was that they're at the same bank; she has never even once used her card online. Our conclusion was that Chase Manhattan had been compromised. That's kind of scary, really. They have to be spending serious money on security.
    - jonafato 15y ago
      To clarify, by "they have to", are you stating a fact or making a demand? One would have thought that Citigroup would have had some pretty tight security as well.
      - Vivtek 15y ago
        I think I'm accentuating an assumption - and when I saw the Citigroup story, I had precisely the reaction you just expressed here. And yet you know that Chase and Citigroup are spending money on security in copious amounts. My heart breaks to think of all those guys getting paid not to know jack. (Or, just as probably, all those guys getting paid not to be able to shove jack through the corporate process.)
    - btilly 15y ago
      It could have been coincidence and an offline compromise for your wife. There are a lot of skimming operations out there. Plus when you give your card to a waiter at a restaurant, nothing stops the waiter from copying your information. In my case the fact that the purchase was made from Turkey suggests that it was an online compromise.
- Cushman 15y ago
  That's not what happened here, though. There wasn't any release of server info; from the tweets, this was just a string of DDoS attacks. If my account information or personal details are vulnerable to theft somehow, I want to know about that. But if a server I play games on can be taken down by DDoS, I'd happily go the rest of my life not knowing or caring so long as it doesn't actually happen. It contributes about as much as showing me that that bridge I like to drive over is susceptible to bombing. Not that I play any of these games, mind.
ineedtosleep 15y ago
You do understand that lulzsec is deliberately publicizing acts that would usually go untraced, right? Security is security: If you don't have any and you house information, you will eventually be burned. Yes it's getting annoying, but they're doing it for the lulz. You can't say the same about all the other malicious hackers.

cube13 15y ago

The attacks on the Minecraft and EVE servers were DDOS attacks. Nothing sophisticated, and the easy way to avoid them is to just get more servers, which really isn't a good solution for smaller developers. EDIT: I suspect the only reason they didn't succeed getting to Blizzard is because WoW was down for Tuesday maintenance.

socillion 15y ago
I suspect the reason is simply because they don't have the resources. EVE maxes out at about 35-40k simultaneous connections, WoW is probably closer to 400-500k per region. edit - # of accounts is 360k vs 12mil.
- lclarkmichalek 15y ago
  They targeted the EVE login server however, and I doubt that is designed for 35-40k simultaneous connections, as to acomplish those conditions, all users on the server would need to log in at the same time. The same is probabaly true for WoW.
  - alanfalcon 15y ago
    The login server for WoW easily and routinely handles an incredible number of simultaneous connections as huge percentages of the player base attempt to log in at the same time, particularly after a large patch. There used to be incredible issues with the login server, but these days Blizzard is an extremely tightly run ship. They know where their money comes from, and what it takes to protect the cash flow.

der_ketzer 15y ago

Should I rob every house that doesn't have an alarm or leaves the window open? I agree with you it "helps" to care more about security and robustness. But I don't agree in the way. I have a dream that one day my website with minimum security won't be hacked for lulz and will be treated with respect. =)

daeken 15y ago
Let's phrase this in another hyperbole, shall we? Should you rob every bank that doesn't have an alarm or leaves the vault open? No. But if a lot of banks had no policies in place to prevent those things from occurring, would you feel more secure that someone was walking into the bank, taking photos of their break-in, and not stealing the money? I don't agree with their means (it's wrong, IMO, to mess with any machine you don't have permission to mess with) but their end goal aligns with mine: make the world more secure. > I have a dream that one day my website with minimum security won't be hacked for lulz and will be treated with respect. =) Would you rather have your site hacked for lulz, or would you rather someone go in and sell your customer's data on the black market?
- hugh3 15y ago
  But if these are just DDOSes, then (a) there's no way to steal sensitive information that way, and (b) there's no real defence against 'em anyway. So this particular argument is pointless, right? There's an argument for whiteish-hat intrusions, but DDOSes must be intrinsically black-hat, right?
  - daeken 15y ago
    Yea, I'd definitely agree in the case of DDOSes -- they don't seem to make sense with their other attacks, even. Silly and destructive.
  - niels_olson 15y ago
    >DDOSes must be intrinsically black-hat, right? No. While I agree there's no red-team contribution in a DDOS, quite a few people regarded Anonymous DDOSes on Wikileaks detractors (MasterCard, et al) as the digital equivalent of a sit-in. That seems a bit of a stretch to me also, but certainly there's some application of DDOS that's not purely black-hat.

mindstab 15y ago

I suppose a bit like firesheep has cause a lot of sites to start pushing SSL more aggressively and even looking into dealing with some of SSL's quirks that have kept it from gaining more popular usage

deleted 15y ago

[deleted]

hugh3 15y ago

Sure, and I can go around punching people in the face and tell 'em that I'm doing 'em a favour by reminding them to always wear a full-face helmet when out in public. But if nobody except me is a big enough asshole to go round punching people in the face at random...

fourk 15y ago
The difference is that one of those people could very well return the favor and give you a proper ass kicking, or determine your identity with relative ease and file a complaint with the police. The disincentives that exist for your example and those that exist for actions similar to those taken by lulzsec are radically different. The conclusion that people should walk around with full-face helmets is ridiculous because of the existing disincentives for assaulting someone. The conclusion that companies should secure their networks, not such an unreasonable expectation.
- brisance 15y ago
  I don't think it's that easy to identify the hackers. Even if you could, which legal jurisdiction applies? What are the legal remedies? Securing networks is indeed a noble goal, but are we prepared to pay for the infrastructure? The end result does not justify the means, and we all know how the story goes. More legislation to "prevent" hacking, and everyone suffers under the yoke of over-reaction.
- roel_v 15y ago
  Right, the problem is that 'digital criminals' are a) not likely enough to get caught, and b) not punished enough if/when they are. What we need are stronger punishments against digital vandalism and profit-oriented digital burglary alike, and more and stronger enforcement. (not being sarcastic, in case anyone's wondering)
  - StavrosK 15y ago
    Good thing our politicians are listening and are prepared to clamp down hard on illegal filesharing.

InclinedPlane 15y ago

Maybe they'll raise awareness of security issues and get companies to take it more seriously. Or maybe we'll just see more security theater and companies will use their lobbying powers to put in place draconian laws against any form of "hacking".

mtw 15y ago

you make it sound like we should congratulate lulz for good work