14 ms·
Specialforces.com Site Hacked
- burgerbrain 15y agoGood to see them making use of Tor hidden services.
- cookiecaper 15y agoI agree, much nicer and smoother than constantly getting removed from various upload sites and traversing through acres of dead links before you finally find a valid mirror, and a lot safer than something like BitTorrent.
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- smackfu 15y agoI'm sure people with their CC leaked will now be against SOPA.
- elbac 15y agoCan someone clarify exactly what and from whom was stolen?
- mschonfeld 15y agoI haven't downloaded the dump files yet, but from what I can tell, their entire db was stolen. Meaning, customers' names, emails, addys, credit cards, etc. But most importantly, they were able to decrypt the customers' passwords back into plain text, too...
- sycr 15y agoHopefully specialforces.com will do a full disclosure to their customers immediately. Every second counts at this point...
- sneak 15y agoJudging by all the bitcoin-exchange-related spam I received after the MtGox database was stolen, my guess is that even if they don't bother to, their competitors will happily notify their customers via email for them.
- dsl 15y agoThis was just a hack of a random e-commerce site. They (like thousands of similar small businesses) sell equipment to police and weekend warriors. The title is a bit misleading, the site had a "Secured by GoDaddy" logo on it, because the site had purchased its SSL certificate from GoDaddy and they throw the security logo thing in for free. EDIT: My bad. They also paid the $4.99/month for the "Hacker Safe" logo.
- mschonfeld 15y agoNotice how they have 2 godaddy badges. The one of the right is the SSL one, as you're describing. The one on the left however, actually reads: "Hacker Proof... Scanned by...".
- mike-cardwell 15y agoNever a good idea to publicly announce that your service is hacker proof.
- mschonfeld 15y agoRight. It really is just asking for trouble. Especially when your "guarantor" is a well known script kiddie...
- jarin 15y agoNever a good idea, unless you want people to give you money via credit card. From my experience, having one of those badges on your checkout form results in a measurable increase in conversions, even if it doesn't mean anything to people who understand security.
- drivebyacct2 15y agoIs this true even when using a third party payment provider like Stripe or Paypal?
- biturd 15y agoI would love to see an A/B comparison of this. For me, if I see those badges, I assume the site doesn't know what they are doing, as they should know, any GoDaddy automated scanner is not worth the wasted disk space from the hits in your httpd logs. Any programmer that aspires to show those logos is dangerous and that site will not get my personal information.
- mike-cardwell 15y agoI doubt that this is the case. I'd expect to see it on a lot more sites were it true. I'm guessing some other factor created your measurable increase. Willing to be proven otherwise though.
- mschonfeld 15y agoTo what extent do you think GoDaddy should be held liable for?
- click170 15y agoI don't think this is so much a question of liability as it is one of customer perception. If 'GoDaddy Secured' sites aren't really secure and start getting hacked, then 'secured by GoDaddy' signs will mean no more than "hackable in 10 minutes or it's free". We'll see how GoDaddy squirms when that happens.
- mschonfeld 15y agoI think that beyond customer perception, there is an actual question of legal liability here. If GoDaddy is purporting to be an expert in security and selling a service, that is supposed to ensure security, then they should be found liable for some degree malpractice. I'd love to get a real lawyer's opinion on this...
- drivingmenuts 15y agoDepends on which part GoDaddy is responsible for. Hacking a server is a very specific act, different from hacking a website. One exploits weaknesses in the underlying OS - the other exploits weaknesses in the publicly exposed software running on the server. To the end viewer, there may be no difference, but the "how they got in" would determine the liability. If anon breached the OS, then common sense would say GoDaddy is somewhat responsible. Otherwise, it pretty much falls on the client. All the hardening in the world can't patch for stupid.
- cookiecaper 15y agoThe "Hacker Proof" badges are supposed to verify your web application as well, but this attack could have been entirely non-technical social engineering to get access to the cart admin account or MySQL username/password. We don't have any details right now at all as far as I know and I tend to doubt they will be forthcoming. In fact, I doubt that specialforces.com will even inform users of this breach. They don't seem to be especially security-savvy and the initial reaction of secuirty-naive businesses is to keep something like this under wraps so it doesn't hurt their reputation. Of course, this is just idle speculation and they could have already informed users. I have no malintent. That's just how I read the situation and the likelihoods involved.
- scythe 15y agoLet's be honest here. Has any "Secured by X company" certification ever actually meant a damn thing? I swear I hear reports about sites like this getting broken into every week. Those banners are basically the equivalent of painting a target on your back.
- funkah 15y agoI agree with you, these certifications are generally crap. My company signed up for Hacker Proof a few years ago (badges and shields look secure, ya know), and it found one SQL injection vuln we had in some old Classic ASP stuff that nobody used but was still out there. That was good, of course, but I'm sure it was the equivalent of running an off-the-shelf fuzzing app.
- liquidityprov 15y agoIsn't it trivial without the need to use something commercial?
- astrodust 15y agoIt means you know where to look for unencrypted credit-card data. That could come in handy!
- shabble 15y agoI can't find a source just now, but I recall reading somewhere that user testing showed a much higher signup/purchase rate when using those sorts of 'certified hacker-proof' badges, with very little difference between 'legitimate' (from recognisable anti-virus/whatever brand name organisations) certificates and completely arbitrary ones. I guess it's mostly about the perception of authority / security theatre.
- tansey 15y agoAs I'm currently in the middle of a research project on password security, I downloaded the passwords and had a look. I'm beginning to believe that you should just assume that if your site does not have any password creation rules, it will be hacked soon. The specialforces password dataset contains passwords like "post"-- four lowercase letters found in any English dictionary, and even matches part of the email (@post.ca.gov) for the user. If a site lets you choose this as your password do not give your credit card info to that site, simple as that. A site that is built by someone who is so unaware of the basics of password security is likely following other insecure practices as well, like storing your data in plaintext and not properly sanitizing user input. All the major recent attacks (phpbb, singles.org, rockyou, battlefield heroes beta, faithwriters, and now specialforces) have had this same glaring issue in common. In reality, if these sites are letting users choose any password then for the majority of users you might as well just store them in plaintext. Most users (70-90%), if left to their own discretion will choose a 6 or 7 character password with all lowercase letters, meaning it will be trivial to crack even if it's hashed and salted.
- gommm 15y agoWhile I agree with you, adding special restrictions on passwords is a way to lose some customers (who can't be bothered or never remember their passwords). So while I know about basic security practices and will always store passwords with bcrypt, sanitize user input and not store any purely private data in plaintext, I'm not going to make a decision about password security that might mean losing customers. EDIT: To answer the questions below. Of course, I would not allow people with administrative access to use weak passwords. But if a user uses a weak password and someone gets access to his account, he can't do all that much (save for changing the plan the user pays, which can be easily reversed)... I'm not responsible for users choosing weak password, however I'm responsible for making sure that no user data/passwords and so on is leaked due to security breach. And that's why I use bcrypt to encrypt password, that's also why I outsource the storing of credit card numbers to authorize.net or other companies that are more competent than me, why I secure as much as possible the website. All of this is a matter of trade offs. Currently, the only websites that I manage that have credit card numbers on files for some users sell virtual/digital goods. So, it would be very easy for me to refund a transaction if it was fraudulent (and in my interest to do so to avoid chargebacks anyway). I might have a different view point in different circumstances.
- biturd 15y agoI have found this is a useful service after every one of these lulz has happened: https://shouldichangemypassword.com/ https://shouldichangemypassword.com/
- nawariata 15y agoNot saying it is, but this could be ingenious way to harvest valid email addresses. Social engineering at its finest.
- pavel_lishin 15y agoIt's probably cheaper to just buy them in batch than it is to pay for the hosting.
- dutchbrit 15y agoWhile I find it's awesome that people like this bring these security issues to attention, at least leave the CC & password details out. Sure, you got them, whoopty-doo, we believe you. Still isn't moral to share them.
- mattdeboard 15y agoDifferent set of morals. Just by virtue of buying tactical gear through specialforces.com -- which a LOT of people do, not necessarily cops or military, btw, and most of those people are good honest citizens. Most of the LEO/mil folks who do are good honest citizens. But to them it is just as moral to leak credit card info because of guilt-by-association as certain cops think it's moral to hose down a 62-year-old man with pepper spray until he's dead. Equally morally bankrupt positions.
- dutchbrit 15y agoIf they really want to make a ding, they should hack GoDaddy.com :)
- nhangen 15y agoFormer Soldier, the type that would have purchased things from sites like this before venturing overseas, and I'm highly annoyed by the childish nature of this hack. Some of these products keep people alive, and it's juvenile to blame SpecialForces.com for pepper spray during a protest. If they were really intending on improving the security of these websites, they wouldn't hand out the data. Sadly, I fear that the worst of this type of behavior has yet to come.