HACKS & INCIDENTS — THE HEADLINES
2001/11/14
Trojan horse 'Limpninja' preparing DDoS
2001/10/19
Pro-Taliban defacement of US site — ultimatum
2001/10/01
"Hacker" claims Bin Laden info found in Sudan bank
2001/9/18
FBI calls for 'Increased Cyber Awareness'
2001/9/17
No Cyber-Actions, please!
HACKS & INCIDENTS — THE LINKS
There are 2 links to external Web sites for this category.
The file was last modified on: Tuesday; 2001/05/29, 16.13 MEST
Submit a link:
HACKS & INCIDENTS — THE NEWS
2001/11/14
14:50 +0100
[Hacks & Incidents] Security watchers are speculating that hackers familiar with the ways of the ninja may be attempting to construct a distributed denial of service (DDos) network on compromised Secure Shell Hosts (SSHs), VNUnet has learned. Threads on security newsgroups have suggested that hackers may be breaking into Linux boxes running the SSH1 protocol, using a known vulnerability in the SSH CRC32 (cyclic redundancy checksum) that was published late last month.
Writing on the BugTraq security mailing list yesterday William Salusky, of security firm DMZS, said: "It appears that someone may be building up a network of [potential] DDos hosts." He explained that he had discovered a compromised Red Hat box that was being used as a central host for other 'zombie' machines, although it is not yet clear how the central server communicates with the zombies. Apparently the attacker manually installed an IRC server, which was communicating with more than 120 other host machines.
The communication channel was called 'kujikiri', a method of esoteric teaching used by the ninja, and the channel key was tagged 'ninehandscutting', an ancient ninjitsu hand movement. Apparently all hosts communicating with the central server were logging on using identification names prefixed with 'ninja'.
According to experts, the Trojan program installed in the attack does not match any signatures identified so far and, if it is new, Salusky has already christened it 'Limpninja'. A CERT/CC warning about the SSH1 vulnerability, which allows a remote attacker to execute arbitrary code with the privileges of the SSH daemon (typically root), can be found in the CERT's knowledge base under Vulnerability Note VU#945216. // c.f. SecuritySpace
::
[dre].
Comments (0)
2001/10/19
10:21 +0100
[Hacks & Incidents] Pakistani hacking group "GForce" has defaced a Web server operated by the US government and threatened to hit American and British military sites unless its demands are met, writes NewsBytes. A Linux Web server operated by the National Oceanic & Atmospheric Administration (NOAA) was attacked according to records at Alldas, a Web site defacement archive.
Alldas records also show that the same group had hacked another NOAA Linux server on August, 31., 2000 over the course of the Pakistan/India Kashmir conflict. NOAA was reportedly hacked 15 times within the last 2 years, which includes Windows servers, Linux and one IRIX machine.
GForce claimed to have "some very high confidential US data" that it would hand over to officials of Al-Qaeda unless the US met several demands. The group's confusing ultimatum included the removal of US troops from Saudi Arabia, the cessation of bombing in Afghanistan, and the production of "evidence," among other demands. The server, which was unreachable this morning, was running the Linux operating system and had open file transfer protocol and telnet ports, according to a scan performed by Alldas.
The message from the attackers said GForce Pakistan condemns the terrorist attacks on the US but also supports Al-Qaeda and blames the US for supporting the Israeli government, which, as they say, "murders innocent mulims in palestine." // c.f. CyberCrime-Alerts
::
[dre].
Comments (0)
2001/10/01
14:49 +0100
[Hacks & Incidents] NewsBytes reported the claims of highly disputed German "hacker" and Internet millionaire Kim Schmitz, that a group of UK-based hackers has cracked computers at the AlShamal Islamic Bank in Sudan and collected data on the accounts of the Al Qaeda terrorist organization and its leader Osama bin Laden.
Schmitz, who has a reputation of publicity stunts, has offered a $10 million reward for the capture of bin Laden, and told Newsbytes that the information has been turned over to the FBI. Newsbytes could not confirm Schmitz's claim. An FBI spokesman in Washington declined to confirm or deny the story, saying that the agency's policy is not to comment on information and leads it is receiving.
Schmitz, 27, a former teen hacking prodigy who spent time behind bars before tarting a successful data security business, and dubbed as "Katie Price of the New Economy sort-of" says his recent strong anti-terrorism pronouncements are not a PR prank, but stem from his strong desire to wipe out terrorism. He says he has received death threats from the Middle East.
The bank Schmitz claimed was hacked was mentioned Wednesday by Sen. Carl Levin, D-Mich. during a Senate Banking Committee hearing. According to CNN, Levin referred to a 1996 State Department report that said bin Laden had provided the AlShamal Islamic Bank with $50 million in start-up capital.
Schmitz told Newsbytes that he could not provide details about what his group of 23 cyber-desperados pseudo-intelligently called YIHAT ("Young Intelligent Hackers Against Terror") found in AlShamal Islamic Bank's computers or about the hackers themselves. "I am the spokesperson of the group," he said. "They don't want to be involved with the press. What they do is illegal, unless we find a government that legalizes our activities." // c.f. infowar.de
::
[dre].
Comments (0)
2001/9/18
11:19 +0100
[Hacks & Incidents] The FBI's National Infrastructure Protection Center (NIPC) expects to see an upswing in incidents as a result of the tragic events of September 11, 2001 and issued the according advisory 01-020 on September 14. Increased hacking attacks are likely to have two motivations:
[1] Political hacktivism by self-described "patriot" hackers targeted at those perceived to be responsible for the terrorist attacks. NIPC has already received reports of individuals encouraging vigilante hacking activity.
[2] Virus propagation in which old viruses are renamed to appear related to recent events. One such incident has already been reported in which a new version of the life_stages.txt.shs virus was renamed wtc.txt.vbs to appear to be related to the World Trade Center.
The NIPC reiterates that the above conduct is illegal and punishable as a felony, with penalties extending to five years in prison. Those individuals who believe they are doing a service to this nation by engaging in acts of vigilantism should know that they are actually doing a disservice to the country.
In yesterday's subsequent advisory 01-021, the NIPC warns of an increase in Distributed Denial of Service (DDoS) attacks: On September 12, 2001, a group of hackers named "the Dispatchers" claimed they had already begun network operations against information infrastructure components such as routers. The Dispatchers stated they were targeting the communications and finance infrastructures. They also predicted that they would be prepared for increased operations on or about Tuesday, September 18, 2001.
The NIPC has made available the "Find DDoS" tool to determine if your computer has been infected by the most common DDoS agents. Additionally, a list of best practices is available from the CERT/CC website. Recipients of this advisory are encouraged to report computer intrusions to their local FBI office or the NIPC, and to the other appropriate authorities. Incidents may be reported online, the NIPC Watch and Warning Unit can be reached at 1-202-323-3204/3205/3206 or [email protected].
::
[dre].
Comments (0)
2001/9/17
09:59 +0100
[Hacks & Incidents] In times like this, teenagers and others often are left feeling helpless. They want, like the rest of us, to strike out at those that have attacked our nation. AntiOnline in the US and the Chaos Computer Club (CCC) in Germany have gotten dozens of e-mails from people that are trying to start "hack Afghanistan, Iraq, etc." movements.
AntiOnline's founder John Vrasenevich has been explicitly asked by the authorities to urge each of you not to partake in such actions. This will do nothing to help those that have been lost, or to punish those that are responsible.
Our duty as civilian citizens of whatever country is to let the proper authorities handle this matter. Any actions that you take on your own, may simply hinder their ability to do the jobs that they need to be doing now.
If you want to show your support, donate blood, make a financial donation to the red cross [see the subsequent article publ. later today], hang a flag, or spend some time to comfort those in your community that may have suffered a loss. // c.f. AntiOnline
::
[dre].
Comments (0)
|