6 ms·

Imageshack hacked

27 points by arihelgason 17y ago

noamsml 17y ago
The article makes those guys' cause sound waaay more legitimate than it really is. If their homepage and articles are to be believed, it seems like their real cause is to stop exploit publication so that only the "real" hackers will know how to breach machines. They're basically children that are whining because someone took away their favorite toy. Paying them any attention does us a disservice. Also, the analogy is faulty. Trying to stop exploit publication so that we won't need to buy security products is like trying to stop us from knowing about germs so we won't need to buy antibiotics.
- tsally 17y ago
  I agree with most of what you say, but it's important to remember that antibiotics actually work. Antivirus is pretty much on the same level as leaches and bleeding, if we want to keep going with the medical analogy. In fact, I don't think anti-sec is angry about the fact that AV exists, just that they think talentless people make millions off of selling a bad product (via fear and misinformation). John Viega (worked on McAfee's AV for many years) has written plenty about why AV is so bad. His most recent book, The Myths of Security is a decent read, but probably not work paying more than $10 dollars for.
  - noamsml 17y ago
    They also rail against firewalls, though, which do work. Also, antivirii may be a poor solution, but they don't do nothing; the antibiotic analogy is apt because they are not a preventative solution, and because they don't work on everything (you can't, for example, use antibiotics against the flu), BUT they can help every once in awhile.
    - tsally 17y ago
      Personal firewalls actually don't work, and the reason is usability. iTunes has 6-12 different executables with different names that require approval. How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Existing solutions do not address this problem. Also, users get asked to approve applications so much that they start to ignore the popups. One possible solution to this problem is to crowd source program analysis. The firewall popup would contain a rating system and user comments, and the user could make a decision from there. Security companies are making too much money off of crappy solutions at the moment to switch to this though.
      - sid 17y ago
        Even firewalls in the enterprise corporate environment have the same problem. Network architects (well the bad ones anyway) know what they need to do to the firewall to achieve connectivity but dont know what security side effects those changes have thus rendering the firewall put in place to have no effect at all. This equates to 1000's upon 1000's of dollars spent simply to be rendered useless by silly decisions. I guess having said this the fault is more heavily placed on the user and not the equipment in this case. I think if you look at the plight of anti-sec the equipment and the software is as much to blame as the user controlling them in many of the cases
      - derefr 17y ago
        > How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Personally, I think the OS should stop asking the user to authorize programs, and start asking to authorize companies (i.e. master per-company application signing certificates). You would get asked once that "Apple Corp." or "Adobe Inc." or "The GNU Foundation" would like to install something on your computer, and then it would be okay from then on. It would be alright to accept further products from the same company without confirmation because, if you stopped trusting the company, you'd stop trusting all their programs, and would thus uninstall everything by that company (i.e. under that signing cert) at once.
    - SwellJoe 17y ago
- Periodic 17y ago
  Hacker "wars" have been going on for a long time. Within that community there is a lot of status and class battles going on. Anti-sec is just another one of these. It's a group that's trying to look cool with high-profile hacks, and veil themselves in secrecy so as to elevate themselves above others. They're probably little different other than their defacement banners.
omail 17y ago
Earlier discussion on this event: http://news.ycombinator.com/item?id=698744 http://news.ycombinator.com/item?id=698744
tylermenezes 17y ago
"posted within the last 8 or 9 hours, some with instructions on how to hack ImageShack" WHAT?
- noamsml 17y ago
  I know, doesn't that sort of defeat the point?
- Kadin 17y ago
  So, let me get this straight; "anti-sec" is an anti-full-disclosure group, who practice ... full disclosure. Got it.
mindslight 17y ago
If the anti-sec group is for keeping exploits private, won't this _increase_ demand for add-on security band-aids like firewalls and virus scanners? More undisclosed vulnerabilities means one should increase the layers of security solutions for less chance of all of them being privately exploitable at any given time. .. Or are they implying that script kiddies are the only problem, and the el8 crackers can never be stopped, so don't even try? (but don't worry, they have 'ethics' !) (side note: "And who knows what new crimes the hackers will dream up next?". The actual question is what new crimes will the government will dream up next! Silly lawlyers.)
Bjoern 17y ago
More information about Anti-sec: http://romeo.copyandpaste.info/ http://romeo.copyandpaste.info/
deleted 17y ago
[deleted]
cookiecaper 17y ago
The weird thing is that full disclosure is not really a money grab. It's about compelling vendors to patch their products so that we don't have millions and millions of machines with an exploitable vulnerability.

27 points by arihelgason 17y ago

The article makes those guys' cause sound waaay more legitimate than it really is. If their homepage and articles are to be believed, it seems like their real cause is to stop exploit publication so that only the "real" hackers will know how to breach machines. They're basically children that are whining because someone took away their favorite toy. Paying them any attention does us a disservice. Also, the analogy is faulty. Trying to stop exploit publication so that we won't need to buy security products is like trying to stop us from knowing about germs so we won't need to buy antibiotics.

tsally 17y ago
I agree with most of what you say, but it's important to remember that antibiotics actually work. Antivirus is pretty much on the same level as leaches and bleeding, if we want to keep going with the medical analogy. In fact, I don't think anti-sec is angry about the fact that AV exists, just that they think talentless people make millions off of selling a bad product (via fear and misinformation). John Viega (worked on McAfee's AV for many years) has written plenty about why AV is so bad. His most recent book, The Myths of Security is a decent read, but probably not work paying more than $10 dollars for.
- noamsml 17y ago
  They also rail against firewalls, though, which do work. Also, antivirii may be a poor solution, but they don't do nothing; the antibiotic analogy is apt because they are not a preventative solution, and because they don't work on everything (you can't, for example, use antibiotics against the flu), BUT they can help every once in awhile.
  - tsally 17y ago
    Personal firewalls actually don't work, and the reason is usability. iTunes has 6-12 different executables with different names that require approval. How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Existing solutions do not address this problem. Also, users get asked to approve applications so much that they start to ignore the popups. One possible solution to this problem is to crowd source program analysis. The firewall popup would contain a rating system and user comments, and the user could make a decision from there. Security companies are making too much money off of crappy solutions at the moment to switch to this though.
    - sid 17y ago
      Even firewalls in the enterprise corporate environment have the same problem. Network architects (well the bad ones anyway) know what they need to do to the firewall to achieve connectivity but dont know what security side effects those changes have thus rendering the firewall put in place to have no effect at all. This equates to 1000's upon 1000's of dollars spent simply to be rendered useless by silly decisions. I guess having said this the fault is more heavily placed on the user and not the equipment in this case. I think if you look at the plight of anti-sec the equipment and the software is as much to blame as the user controlling them in many of the cases
    - derefr 17y ago
      > How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Personally, I think the OS should stop asking the user to authorize programs, and start asking to authorize companies (i.e. master per-company application signing certificates). You would get asked once that "Apple Corp." or "Adobe Inc." or "The GNU Foundation" would like to install something on your computer, and then it would be okay from then on. It would be alright to accept further products from the same company without confirmation because, if you stopped trusting the company, you'd stop trusting all their programs, and would thus uninstall everything by that company (i.e. under that signing cert) at once.
  - SwellJoe 17y ago
Periodic 17y ago
Hacker "wars" have been going on for a long time. Within that community there is a lot of status and class battles going on. Anti-sec is just another one of these. It's a group that's trying to look cool with high-profile hacks, and veil themselves in secrecy so as to elevate themselves above others. They're probably little different other than their defacement banners.

omail 17y ago

Earlier discussion on this event: http://news.ycombinator.com/item?id=698744 http://news.ycombinator.com/item?id=698744

tylermenezes 17y ago

"posted within the last 8 or 9 hours, some with instructions on how to hack ImageShack" WHAT?

noamsml 17y ago
I know, doesn't that sort of defeat the point?
Kadin 17y ago
So, let me get this straight; "anti-sec" is an anti-full-disclosure group, who practice ... full disclosure. Got it.

mindslight 17y ago

If the anti-sec group is for keeping exploits private, won't this _increase_ demand for add-on security band-aids like firewalls and virus scanners? More undisclosed vulnerabilities means one should increase the layers of security solutions for less chance of all of them being privately exploitable at any given time. .. Or are they implying that script kiddies are the only problem, and the el8 crackers can never be stopped, so don't even try? (but don't worry, they have 'ethics' !) (side note: "And who knows what new crimes the hackers will dream up next?". The actual question is what new crimes will the government will dream up next! Silly lawlyers.)

Bjoern 17y ago

More information about Anti-sec: http://romeo.copyandpaste.info/ http://romeo.copyandpaste.info/

deleted 17y ago

[deleted]

cookiecaper 17y ago

The weird thing is that full disclosure is not really a money grab. It's about compelling vendors to patch their products so that we don't have millions and millions of machines with an exploitable vulnerability.