7 ms·

Hahahahahaha. Hahahahahahahahahahahahaha. [breathe in] Haha. Hah. Hahahahaha. Best of luck, Anon! I'm not sure if Anon fully understands the level of infrastr

Hahahahahaha. Hahahahahahahahahahahahaha. [breathe in] Haha. Hah. Hahahahaha. Best of luck, Anon! I'm not sure if Anon fully understands the level of infrastructure and the level of preparation Facebook has... They'll need to come up with something a lot more compelling than a bunch of guys at home with LOIC.

palish 15y ago
Like I said, this is not Anon. Think about it. Anon aren't stupid. And going up against Facebook is stupid.
- inconditus 15y ago
  There is no better example of the No True Scotsman Fallacy.
  - xtal 15y ago
    No, that doesn't apply here at all. There's no (public) definition of who is or isn't Anonymous.
    - Radix 15y ago
      Sure it does. No true scotsman breaks down to a claim that some group has some Trait, then claiming that because some individual does not share the Trait they are by definition out of the group. I guess sometimes it's valid, but not here. Anon hasn't shown itself capable of an attack like this and if you look at the attacks by anon on scientology you'll be left wondering they were able to form a group identitiy with their fringe (core?) As it is. Palish might be right that this doesn't sound like its from any of the main group.
- natesm 15y ago
  Isn't "Anonymous" anyone who claims to be it?
  - samstave 15y ago
    You must work for congress, quick, lets make being anonymous illegal. That'll stop this!
  - samstave 15y ago
    You must work for congress, quick, lets make being anonymous illegal. That'll stop this!
  - atomicdog 15y ago
    Within reason. It's anyone within the Anonymous subculture that claims to be it.
    - cookiecaper 15y ago
      There is no way to tell if someone is credibly "within the Anonymous subculture" and "Anonymous" "releases" conflicting "press releases" with some regularity. There is no organization to "Anonymous", it's just an MSM-manufactured boogeyman to represent any teenager and/or groups of teenagers which knows how to send a lot of requests to a website simultaneously. samstave is also correct that those in power relish this since it gives them a lot of latitude to scare the commoners and get better tracing tools in place.
srl 15y ago
This attack is scheduled to come soon after anon switches from LOIC to a "new cannon" dubbed #RefRef (http://anonops.blogspot.com/2011/08/new-hacking-tools-by-anonymous-new.html http://anonops.blogspot.com/2011/08/new-hacking-tools-by-ano...). They're probably way overconfident in their abilities (#RefRef's description is thoroughly unconvincing), but at least they don't think they're going to DDoS one of the best-prepared sites in the world, AFTER telling them exactly what day the attack will occur on.
- Cushman 15y ago
  So if we assume these people have any idea what they're talking about, it's some kind of SQLi attack... presumably mySQL? I wonder at what point it'll occur to them that Facebook mostly serves data from memcached. Uh... did I get something wrong here? A correction or something would be nice.
  - noodle 15y ago
    i think you're getting downvoted because anonymous has proven many times in the past that at least the people "in charge" (as much as you can call it that) definitely know what they're talking about and are possibly comprised of security experts. if this is in fact anonymous. i'm not convinced, too big a target for them to have so little fanfare/flair.
  - jmtame 15y ago
    "RefRef is a revolutionary DoS java site. Basically, by using an SQL and .js vulnerability, you can send a page request packet from your home computer with embedded .js file, because of the vulnerability in the SQL/Javascript engine on MOST websites, the site actually TEMPs the .js file on its own server. So now the .js is in place on the host of the site. Next since you still have the request, it picks up the .js file, and all of the requesting for packets power happens on the server, not the requestee. I send two packets from my iphone, and everything else happens on the server. Basically eats itself apart, because since both are on the server, its all a local connection." "The tool is very effective, a 17-seconds attack from a single machine resulting in a 42-minute outage on Pastebin yesterday. As expected, the Pastebin admins weren't very happy with their platform being used for such tests and tweeted 'Please do not test your software on us again.'" "The effectiveness of RefRef is due to the fact that it exploits a vulnerability in a widespread SQL service. The flaw is apparently known but not widely patched yet. The tool's creators don't expect their attacks to work on a high-profile target more than a couple of times before being blocked, but they don't believe organizations will rush to patch this flaw en masse before being hit." http://www.thehackernews.com/2011/07/refref-denial-of-service-ddos-tool.html http://www.thehackernews.com/2011/07/refref-denial-of-servic...
johnrob 15y ago
Taking something apart is vastly easier than putting it together. Just because Anon is small doesn't mean they can't find an exploit.
- rpearl 15y ago
  they just haven't even done anything novel. Why should we expect them to now? Facebook is very unlikely to have the usual slough of easy sql injections. I am quite sure that someone good could find attacks against facebook. I am dubious that anonymous can.
  - davedx 15y ago
    Easily said, but do you know what 'attack surface' means in infosec? Facebook's is vast.
    - potatolicious 15y ago
      There are many levels of intrusion. I give Anon enough credit that they might be able to cause some mayhem, maybe even some real harm. Maybe they'll take down Facebook Chat (to the great ambivalence of everyone)... but to 0wn/DDoS the main Facebook site altogether? I dunno... It's like, I may be able to find some way to force all the toilets at CIA Headquarters to back up. That's not the same thing as compromising their spies' identities. Not all exploits are equal.
    - rpearl 15y ago
      I am aware of what "attack surface" means and stand by my claim that anonymous, having done nothing novel so far, will not find attacks against facebook.
conductor 15y ago
Remember remember the fifth of November Gunpowder, treason and plot. I see no reason why gunpowder, treason Should ever be forgot...

palish 15y ago

Like I said, this is not Anon. Think about it. Anon aren't stupid. And going up against Facebook is stupid.

inconditus 15y ago
There is no better example of the No True Scotsman Fallacy.
- xtal 15y ago
  No, that doesn't apply here at all. There's no (public) definition of who is or isn't Anonymous.
  - Radix 15y ago
    Sure it does. No true scotsman breaks down to a claim that some group has some Trait, then claiming that because some individual does not share the Trait they are by definition out of the group. I guess sometimes it's valid, but not here. Anon hasn't shown itself capable of an attack like this and if you look at the attacks by anon on scientology you'll be left wondering they were able to form a group identitiy with their fringe (core?) As it is. Palish might be right that this doesn't sound like its from any of the main group.
natesm 15y ago
Isn't "Anonymous" anyone who claims to be it?
- samstave 15y ago
  You must work for congress, quick, lets make being anonymous illegal. That'll stop this!
- samstave 15y ago
  You must work for congress, quick, lets make being anonymous illegal. That'll stop this!
- atomicdog 15y ago
  Within reason. It's anyone within the Anonymous subculture that claims to be it.
  - cookiecaper 15y ago
    There is no way to tell if someone is credibly "within the Anonymous subculture" and "Anonymous" "releases" conflicting "press releases" with some regularity. There is no organization to "Anonymous", it's just an MSM-manufactured boogeyman to represent any teenager and/or groups of teenagers which knows how to send a lot of requests to a website simultaneously. samstave is also correct that those in power relish this since it gives them a lot of latitude to scare the commoners and get better tracing tools in place.

srl 15y ago

This attack is scheduled to come soon after anon switches from LOIC to a "new cannon" dubbed #RefRef (http://anonops.blogspot.com/2011/08/new-hacking-tools-by-anonymous-new.html http://anonops.blogspot.com/2011/08/new-hacking-tools-by-ano...). They're probably way overconfident in their abilities (#RefRef's description is thoroughly unconvincing), but at least they don't think they're going to DDoS one of the best-prepared sites in the world, AFTER telling them exactly what day the attack will occur on.

Cushman 15y ago
So if we assume these people have any idea what they're talking about, it's some kind of SQLi attack... presumably mySQL? I wonder at what point it'll occur to them that Facebook mostly serves data from memcached. Uh... did I get something wrong here? A correction or something would be nice.
- noodle 15y ago
  i think you're getting downvoted because anonymous has proven many times in the past that at least the people "in charge" (as much as you can call it that) definitely know what they're talking about and are possibly comprised of security experts. if this is in fact anonymous. i'm not convinced, too big a target for them to have so little fanfare/flair.
- jmtame 15y ago
  "RefRef is a revolutionary DoS java site. Basically, by using an SQL and .js vulnerability, you can send a page request packet from your home computer with embedded .js file, because of the vulnerability in the SQL/Javascript engine on MOST websites, the site actually TEMPs the .js file on its own server. So now the .js is in place on the host of the site. Next since you still have the request, it picks up the .js file, and all of the requesting for packets power happens on the server, not the requestee. I send two packets from my iphone, and everything else happens on the server. Basically eats itself apart, because since both are on the server, its all a local connection." "The tool is very effective, a 17-seconds attack from a single machine resulting in a 42-minute outage on Pastebin yesterday. As expected, the Pastebin admins weren't very happy with their platform being used for such tests and tweeted 'Please do not test your software on us again.'" "The effectiveness of RefRef is due to the fact that it exploits a vulnerability in a widespread SQL service. The flaw is apparently known but not widely patched yet. The tool's creators don't expect their attacks to work on a high-profile target more than a couple of times before being blocked, but they don't believe organizations will rush to patch this flaw en masse before being hit." http://www.thehackernews.com/2011/07/refref-denial-of-service-ddos-tool.html http://www.thehackernews.com/2011/07/refref-denial-of-servic...

johnrob 15y ago

Taking something apart is vastly easier than putting it together. Just because Anon is small doesn't mean they can't find an exploit.

rpearl 15y ago
they just haven't even done anything novel. Why should we expect them to now? Facebook is very unlikely to have the usual slough of easy sql injections. I am quite sure that someone good could find attacks against facebook. I am dubious that anonymous can.
- davedx 15y ago
  Easily said, but do you know what 'attack surface' means in infosec? Facebook's is vast.
  - potatolicious 15y ago
    There are many levels of intrusion. I give Anon enough credit that they might be able to cause some mayhem, maybe even some real harm. Maybe they'll take down Facebook Chat (to the great ambivalence of everyone)... but to 0wn/DDoS the main Facebook site altogether? I dunno... It's like, I may be able to find some way to force all the toilets at CIA Headquarters to back up. That's not the same thing as compromising their spies' identities. Not all exploits are equal.
  - rpearl 15y ago
    I am aware of what "attack surface" means and stand by my claim that anonymous, having done nothing novel so far, will not find attacks against facebook.

conductor 15y ago

Remember remember the fifth of November Gunpowder, treason and plot. I see no reason why gunpowder, treason Should ever be forgot...