12 ms·

“NASDAQ is owned.” Five men charged in largest financial hack ever

• dba7dba 13y ago
  No, criminals, you are Owned. Pity no internet/computers are allowed in jails...
• minimax 13y ago
  I've seen this story (NASDAQ being hacked) reported in a couple of places, but it isn't clear to me what damage was done. It's not really possible for them to have messed with the actual trading without anyone noticing. Everyone connecting to an exchange is reconciling the orders they send in against the trade confirmations they receive. You basically design your technology assuming the exchange is going to fuck something up eventually. I'd really like to hear more details about what was going on here.
  • mcphilip 13y ago
    From the linked US DOJ press release: >It is not alleged that the NASDAQ hack affected its trading platform. http://www.justice.gov/opa/pr/2013/July/13-crm-842.html http://www.justice.gov/opa/pr/2013/July/13-crm-842.html
  • nonchalance 13y ago
    The matching engine and the ring of servers around it are not accessible via internet. You can only connect to them if you have a server collocated in Carteret, and even then the NASDAQ machines only expose the ports relevant to order entry and feed data. They could have hacked a customer (say, citigroup) and entered that way, but all they really could do is incur losses for the customer.
    • jbert 13y ago
      > but all they really could do is incur losses for the customer. If they could inject "incorrect" trades, could they put themselves on the other side of those trades via normal means and so benefit from such losses?
      • gohrt 13y ago
        Surely.
        • DannyBee 13y ago
          But how would this be noticeable from the regular fraud that occurs?
  • im3w1l 13y ago
    You couldn't create or delete orders for other people without them noticing, but frontrunning could maybe stay under the radar.
• sarreph 13y ago
  Was most of this done by SQL injection?
  • ripter 13y ago
    Looks like they used SQL injection to get passwords and then used those passwords to access the servers.
    • rodolphoarruda 13y ago
      Yeah, and that's from the application layer down to the DB layer. I wonder how they were able to pass through the other layers of the stack. I heck of a work, no wonder they'd spent "months" on it.
      • sarreph 13y ago
        ...crazy.
    • acv 13y ago
      The article says that they used the injection to get hashed login credentials. Did they then use a rainbow table to reverse the hashing?
      • dgroves 13y ago
        Precisely why hash(salt+password) is no longer sufficient. An HSM is require with keys known to nobody (backup HSM's locked in a safe) but the password hashing machine. In a nutshell it should be more like this: Hash(hsm_keys+salt+password) Of course all the usual things about entropy still apply, that string should be at least 256 bytes (256 bits of entropy is 32 bytes, so I am advocating much, much more), and that will likely only keep you safe until the next generation of ASIC computers are released.
      • meowface 13y ago
        There are a wide myriad of ways that plaintext can be derived from password hashes. Rainbow tables are an option if they're not salted; otherwise the attackers likely had access to fairly significant computing power (considering the amount of money they were raking in) to perform typical dictionary + bruteforce attacks on them.
• k_bx 13y ago
  > SQL-injection > NASDAQ
  • tracker1 13y ago
    That was my first note as well.. imho, they deserved to get hacked.
  • sirsar 13y ago
    Sanitizing your inputs is apparently even harder than salting and hashing your passwords, something even the big-name companies tend to mess up. Sigh.
    • PlaneSploit 13y ago
      Little Bobby Tables, we call him.
      • dpatru 13y ago
        http://xkcd.com/327/ http://xkcd.com/327/
    • deleted 13y ago
      [deleted]
    • k_bx 13y ago
      You don't even need to sanitize them, actually.
      • sirsar 13y ago
        That's true. For example in Python, you declare the query as "Select * from a where b=? and c=d" and then put a tuple (z,) to specify b. It's something the NYSE should get "hip" to.
• KumarAseem 13y ago
  Their actions might have been illegal but they for sure are good at breaking things and their skills should be used instead of throwing them in jail for 20 years. Counsel them and give them a change to reform themselves.
  • jokoon 13y ago
    There are still too many computer illiterate people, it's a matter of how people view things. Blaming the existing systems instead of blaming the hackers, it's like being an astronomer in the middle age. Deciders and business owners will scream and tell their systems are fine, and that the ones who think differently and prove otherwise are at fault.
    • anigbrowl 13y ago
      No it isn't. These people weren't publishing white papers about the lack of security at Nasdaq and other companies, they were using their knowledge to steal money, and the costs were passed back to you, the (presumably) law-abiding customer/credit card user. Suppose you went out and came home to find your window smashed and your most valuable possessions gone. Would you be happy to have received an unscheduled visit from a private security consultant who decided to pay himself a handsome fee in the form of your stuff? No, you'd call the police to report a burglary. Just because these guys were using computers and you also use computers does not mean they're basically the same as you and would be your good friends if only those mean old suits would get out of the way and let you run everything.
      • jokoon 13y ago
        If those people were not "publishing white papers", maybe it's because computer security sucks everywhere, maybe because there is no true incentive to make things better at all. I was answering to the question "why were those guys using their skills for criminal activity instead of working on protecting against those crimes ?". The thing is, I doubt company deciders really care about real computer security at all, and even if they do, the security market is very slim. OSes are not really designed with security first in mind, while they should be the first ones to do research on it, and apply it steadily. I can find many reasons why the computer security market is still weak: there are not that many crimes because we don't use computers for many important things (even if it's on the rise), intelligence agencies prefer to let those vulnerabilities in place so they can have the upper hand to investigate or spy other countries (not talking about PRISM), and programmers are still a rare supply, and I don't really see any open discussion in university about computer security theory, it's mostly black hats/white hats folks, it's not really productive. If those guys committed those crimes, either they are not good enough, but that also means nasdaq systems were weak, or that they were actually good enough, but the computer security job market did not propose them enough money, which is why they risked 20 year prison sentences, because it paid more. You could compare it with the drug market. Right now those substances are illegal, which allows criminals to make huge amounts of money, but the DEA people will also make money, and are often found to work with criminals. That's an example why most of the time, crime pays, while it would be wiser to make those substance legal, and try to help drug users instead. For computer security, it could be a good idea to stimulate the security market by asking universities to create degrees, and maybe make some government programs to work on computer security, instead of letting it rot like that.
• startupfounder 13y ago
  You would think that a way to stop these kinds of attacks for pennies on the dollar would be to have the security companies, banks, retail stores and others involved on the receiving side of these attacks fund hackathons or startup accelerators in every country, like a startup weekend, to give these "kids" a chance at legal startups and to get paid for finding bugs.
  • samstave 13y ago
    We spend how many hundreds of billions on the NSA so they can slurp all the worlds data? Why not force them to secure all networks?
    • gknoy 13y ago
      I do not think that we would want the result of that.
      • samstave 13y ago
        HA the jokes on you! We already HAVE the result of that. In all serious though, just be thankful you're still alive you unappreciative uppity citizen; at least you haven't been killed by a terrorist yet.
        • readysetgo 13y ago
          People don't often die from terrorism. He is much more likley to die from diabities, heart disease, cars or a gun shot. More toddlers with guns have killed Americans this year than terrorist have. If we are trying to save lives, worrying about terrorism is a waste of money.
          • luminiferous 13y ago
            I'm fairly certain he was being facetious.
• austenallred 13y ago
  I honestly believe eastern Europe and possibly Israel are years ahead of the United States when it comes to the Internet - not with regard to adaptivity, but with regard to raw hacking ability. I have yet to understand why and I only have anecdotal evidence (including living in Ukraine), but there's something to those places that make them breed hackers.
  • staunch 13y ago
    They can't easily get jobs that pay them well, the way most programmers in the West can. People really good at security in the US just get a job making a great salary.
    • dmazin 13y ago
      This is a very believable explanation.
    • skolor 13y ago
      Its also more dangerous in the US. Since the majority of major web apps are hosted in the US, if you're in the US it is easy for the app's owners to go after you legally. It gets much more complicated if you're in another country. For example, if weev had been in eastern Europe, it would make it much more difficult for ATT to go after him.
    • bluedino 13y ago
      You don't even have to be 'good at security' to get a job making great salary - just a clearance and maybe a certification or two.
  • INTPenis 13y ago
    Raw hacking ability I believe is defined loosely by a very strict early mathmetical education. I'm slavic but I was raised in Sweden, visits with family in the balkans always leave me surprised at the strict education children go through. Of course, my only perspective is from small country villages, not cities.
  • notphilatall 13y ago
• screwt 13y ago
  Sites are susceptible when user input is ... incorrectly filtered for characters used in database commands ... If you're trying to protect yourself from SQLi by filtering & then running user input, you're doing it wrong. If a supposedly tech-literate site like Ars can't get that right, what hope do we have? (Let alone the banks themselves...)
  • skolor 13y ago
    That's exactly what defines SQLi. Incorrect filtering of user data is precisely the reason why SQLi is a vulnerability.
    • 0x0 13y ago
      The better way to defend against SQLi would be to use proper quoting/prepared statements, instead of trying to play whack-a-mole by filtering and limiting the content of the input strings.
      • skolor 13y ago
        Correct, but that doesn't make the statement of the causes for SQLi any different.
    • duncans 13y ago
      Incorrect handling I'd say. If you're filtering apostrophes from your user input you're doing it wrong.
      • undoware 13y ago
        This is a semantic quibble. Your point could be restated as, "if you're not filtering potentially dangerous data out of your SQL queries (i.e. you're not using a fixed vocabulary of properly-quoted phrases) then you are vulnerable to SQLi." think of it this way: no matter how you slice it, there are Bad Things you need to keep out of your SQL, and an easy layperson term for doing so is 'filtering'. Recall that 'filter' != regexp.
• dclowd9901 13y ago
  > According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10. This is truly dumbfounding to me. They had normalized, searchable access to millions of credit cards. They presumably had systematic ways of siphoning off money on high balance cards in a way that no one would've ever noticed. And yet, their grand scheme was to hock the numbers piecemeal for 50 a pop? How are such smart people so bad at business.
  • driverdan 13y ago
    They had millions of credit cards. It's far easier and safer to sell the cards than try to come up with a scheme that will make an equivalent amount of money using them. Plus with that many they had far more than they could ever use. That's like saying anyone who runs a SaaS that helps other businesses make money for $50/m is bad at business.
  • ErikHuisman 13y ago
    Because low risk, little effort, high volume. Easy (if you're smart).
  • mathattack 13y ago
    If they used them all at once to make purchases, it would have triggered fraud protection software. If they were distributed, less likely to be caught.
  • shitlord 13y ago
    It's easy to farm credit cards and accounts once you have your infrastructure in place, but it's not so easy to actually profit from them. It's time-consuming and a big liability. So you do the next best thing: you dump them.
• peterwwillis 13y ago
  "According to one indictment, European credit card numbers sold for as much as $50, while US ones fetched about $10." Where are they getting their numbers from? Last I heard (a year or two ago), carders charged about 10 cent for foreign cards and a dollar per US card. Any actual carding researchers care to weigh in?
  • driverdan 13y ago
    I'm not sure where you got your info from but non-US cards have always had higher value due to limited supply. The value also depends on the type of info. For example, magnetic stripe data (dumps) is worth more than basic card info (which isn't worth much).
    • peterwwillis 13y ago
      The botnet carding numbers were what I was quoting, not mag stripe dumps. And I was told it was the other way around, that US cards either had higher limits or the banks were more lenient with the credit? Seeing as Americans use credit cards way more than most countries, a multitude of charges would be more easily overlooked. But i'm pretty sure $50 per card is not a realistic rate, even if they're worth more than US cards.
• AsymetricCom 13y ago
  Doesn't NASDAQ have some responsibility for this hack? Doesn't NASDAQ have serious security reputation issues now?
  • driverdan 13y ago
    Blaming the victim? Nice.
    • jonah 13y ago
      If indeed it was a basic SQLi attack and NASDAQ failed to prevent it, then to some degree, yes, they're responsible. As a high-value target it's incumbent on them to secure their systems. Here on HN we often say "security through obscurity is no security." Relying on the fact that it is "illegal" for someone to hack your system to prevent them from doing so is similarly flawed logic.
      • alexhawdon 13y ago
        Yep. And depending on where the attackers are from, it might only be illegal in US jurisdiction anyway. So it's just plain negligence not to do your best. That said, it is a huge attack surface and it sounds like they had a lot of time and resources; they can afford to just wait to get lucky. NASDAQ had to be lucky ALL the time. /devils advocate - obviously someone f'd-up.
    • NegativeK 13y ago
      The victim isn't NASDAQ. The victims are the people who trusted NASDAQ. Parent is asking whether NASDAQ was negligent. That path has dangers all around (though, financial regulations try somewhat, don't they?) but it's a different discussion than victim blaming.
    • apalmer 13y ago
      This isnt a mugging or an assault. This is a company charged with processing financial information that apparently didnt sufficiently protect the data.
    • 13y ago
• driverdan 13y ago
  > Court documents allege that as a result of the scheme, financial institutions, credit card companies and consumers suffered hundreds of millions in losses, including more than $300 million in losses ... BULLSHIT. I want to see hard evidence that there were real losses totaling more than $300 million. The justice dept loves inflating loss figures based on sentencing guidelines which mandates minimum losses for stolen info even if they were never used to commit a crime.
  • antiterra 13y ago
    Why does this call for an all-caps "bullshit?" It's really not that much money per card for just the Heartland breach alone, even if you assume only a fraction of cards were actually being used. The Heartland breach was discovered after card companies found a pattern of chargebacks over a number of months. If the cards hadn't been used, the breach likely would have been undiscovered, for years, if at all. It took Heartland months of investigation to find internal evidence they had been breached. The attackers had long since left and attempted to erase their tracks.
• kevin818 13y ago
  How would one even go about doing this? Do you just keep trying difference ssh key values? I never understood how people can just magically "gain access" to servers.
  • alexjeffrey 13y ago
    in this case it was supposedly done using SQL injections: http://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters http://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filte...
  • wiml 13y ago
    It can be pretty enlightening to read the few postmortems of big hacks that do get published. Another seemingly common scenario (aside from a direct attack on the server) is to spear-phish someone else inside the company, not necessarily an admin or anyone technical, into clicking on some flash applet or trojan'd excel doc or something that owns their machine, then install keyloggers, proxies, etc., and work from there until you snag a credential that lets you into the server you actually want.
  • deleted 13y ago
    [deleted]
• kevinalexbrown 13y ago
  Is anyone aware of a) whether other security auditors or services could have identified these vulnerabilities and b) what it takes to sell to these exploited firms? My understanding of security is fairly small, but it seems to me that there's a market to be had here ... If the expertise exists to dramatically reduce exposure, it's a question of sales or ease of use. If the expertise doesn't exist yet, someone smart might make a lot of money.
  • tptacek 13y ago
    There is a market here.
    • larrys 13y ago
      Someone who does security work for me on the side (for about 12 years works now) manages a team that does this at a large consulting company. I can't remember exactly, but he told me what they bill him out for and it sounded like NY senior attorney level rates. He travels overseas regularly on longer term assignments. I told him he should go out on his own but he's not entrepreneurial. He also said that a few of the "sales guys" at the firm already did that with some of the other security people last year.
      • tptacek 13y ago
        I think starting a security consultancy is a business idea that just might work.
        • janzer 13y ago
          I admit by the time I made it through this comment thread, I wasn't quite laughing out loud, but I was having a good chuckle.
          • larrys 13y ago
            When I was maybe 5 years old I asked my parents why they couldn't just cut cancer out? Everybody is a newbie at one point.
• alexjeffrey 13y ago
  the idea that NASDAQ might've been hacked using an SQL injection is pretty scary, as it's a pretty trivial attack to protect against in most cases (mysql_real_escape_string?) - is security in stock exchanges really so lax?
  • thesis 13y ago
    mysql_real_escape_string isn't secure. AT ALL.
    • NegativeK 13y ago
      This would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.
      • jordanthoms 13y ago
        Anyone not using prepared statements in 2013 is just being stupid - there is no reason to ever be vulnerable to a SQL injection, barring a bug in the database or driver you are using. It's totally unacceptable.
        • dgroves 13y ago
          to be fair of the hundreds of comments I have read, you are the only person who has the correct advice for mitigating the risk of SQL injection. Everybody else should read the [OWASP SQL Injection cheat sheet](https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet https://www.owasp.org/index.php/SQL_Injection_Prevention_Che...) before giving advice. ;-)
    • phoboslab 13y ago
      How so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all params in quotes (or much better: use prepared statements to begin with).
    • 13y ago
• readysetgo 13y ago
  Stealing money from global financial institutions is only allowed when you are a banker.
• gnufied 13y ago
  An interesting trivia is - one of the guys being charged is "Dmitry Smilianets", CEO of Moscow 5. A rather very prestigious esports organization that has/had good teams in League, Dota2 and Counter strike. The arrest itself happened an year ago and was widely reported on gaming websites (http://www.joindota.com/en/news/3537-moscow-5-ceo-arrested-in-amsterdam http://www.joindota.com/en/news/3537-moscow-5-ceo-arrested-i...).
• thomasbk 13y ago
  The actual indictment is here, it's a fairly interesting read: http://www.justice.gov/iso/opa/resources/5182013725111217608630.pdf http://www.justice.gov/iso/opa/resources/5182013725111217608...
• txutxu 13y ago
  Upvoted, did make me enjoy the read. 6 months since the first SQLi to the "Nasqad is owned". 6 months... Sometimes I've play Neo from a pub connection with recycled hardware (not buy with my card number) but at most one week to the same target. I wish I could have the skills of those people. Not that I want to make money stoled from unknown people... I just would like to have their skills.
  • icpmacdo 13y ago
    "Sometimes I've play Neo from a pub connection with recycled hardware (not buy with my card number) but at most one week to the same target." Could you explain what you are saying here?
    • txutxu 13y ago
      Yes, I see my sentence was not clear at all. There I was saying, that even if I have make some security research, from a internet connection not related with me, with hardware not related with me, I've never work on it more than 1 week. This people was 6 months against the same target (owning it) without being detected.
• lifeisstillgood 13y ago
  Is there a summary of the techniques used, the escalations take ? Does it compare to OWASP ?
• itsallbs 13y ago
  'SQL-injection vulnerabilities in the victim companies' websites' /facepalm
• coldcode 13y ago
  Amazing people are still ignorant of how to properly code a web application. Not to mention all the companies that likely still store passwords using a reversible algorithm and fail to separate and encrypt credit card information. What is this, 1994?
  • bdamm 13y ago
    It's not that people don't know how to properly code a web application. It's that coding a web application with a strong and secure perimeter is more expensive, more effort, and difficult to QA (the perimeter) than building one without. "Ship it."
    • chrismarlow9 13y ago
      I love the "ship it" here. Deadlines kill security. When you're under the gun to finish something as a dev, the first thing to go is the security mindset. The next thing to go is the "beautiful code" mindset, which leads to even more security issues. The problem is that by definition projects that have a critical deadline will usually be used by thousands of people or handle very important information. It's a weird issue of "I need it now because it's important" and "I need it working well because it's important". Good, fast, cheap. Pick two. Thanks for supporting my confirmation bias.
• jingo 13y ago
  I'll get downvoted for this, but I think SQL admins should in some way be held accountable for successful injection attacks. Falling victim to this type of exploit which is as old as the hills should be inexcusable. How difficult is it to learn how a UNIX shell works, inside and out? For what these guys get paid and what they are tasked with securing, they should be experts on escaping and quoting and every possible thing one can do with the shell. All the boring stuff. Because that's probably the knowledge these "hackers" leveraged. If I'm wrong here, if there's more to it, feel free to correct me. I want to be empathetic with the people who set up these SQL databases, but I really cannot understand why anyone can still in 20xx get a shell via SQL statements, at a financial institution no less, after so many years of seeing others fall victim.
  • meowface 13y ago
    Generally, the DBAs have very little role in knowing whether any part of their application is vulnerable to SQL injection, and on top of that they can't mitigate very well against it. They can do the basic things: don't use the root MySQL user, restrict privileges on each MySQL user, use AppArmor or SELinux to isolate the mysqld process, etc. This does prevent an attacker, in most cases, from instantly uploading a shell as soon as they find any sort of injection vector. But it does not stop an attacker from reading arbitrary values from any table in any of the databases the MySQL user has read-permissions to (which in many cases is every database on the server). And if an attacker can effectively dump your database, generally it's a matter of cracking admin password hashes and using those to login and escalate their access. DBAs really play no part in any of that; it is the developers of the application who must be blamed here. It's their job to use good hashing mechanisms, and to prevent admin accounts from being able to escalate privileges and upload a shell to the server. And above all, to code securely and prevent SQL injection in the first place. Also, this isn't reddit, please don't say "I know I'll get downvoted for this."
    • jingo 13y ago
      Question: Can/do they do "fuzzing" on their database applications? Has anyone built a fuzzer for this purpose that tries an assortment of possible vectors as well as random strings? I still do not understand why the injection vectors cannot be preempted to begin with. It seems to me as if the folks securing the database are unable to predict possible ways someone could exploit what their application considers "valid" queries. If so, why? Also, I don't follow reddit, so I didn't know they say that.
• ereckers 13y ago
  I just think its funny that a hacksaw is now the international symbol for hacking.
• trotsky 13y ago
  Wow, the US Attorney is really going out of his way to fill this one up with bullshit. I knew something was very wrong when goodin claims hundreds of millions in losses on a carding ring and it didn't take long to find it. The only people that would pay $50 for anything having anything to do with credit cards would be fbi investigators. Hell they're the only ones that would pay one tenth that.
• christianh 13y ago
  Well maybe there's some light at the end of the tunnel: If hackers had an easier way to gain recognition and being rewarded when they discover vulnerabilities, I'm certain most would choose to disclose their findings rather than try selling them on the black market. I'm working on a startup right now, www.crowdcurity.com, where we want to let any site easily create a bug bounty program (similar to Google, Mozilla, Paypal, etc.) and thereby leverage testers around the world to find vulnerabilities; hopefully initiatives like this will strengthen the security of web apps and websites around the world.