Application Security // Database Security
12/13/2012
02:30 AM
50%
50%

The Biggest Hacker Busts Of 2012

No love for Lulz as cops crack down on cybercrooks

It's easy enough to focus on the major breaches of 2012 and feel a certain hopelessness. But this year was a banner one for busting black hat bad guys. Several major international operations reaped a harvest of hackers, from big-shot Russian gangsters to bored British teens. This was the year they locked up the world's biggest pirate in Sweden. And the gangly Anonymous guy who probably should have worn the mask but didn't. The thoughtful cybercriminal should be sure to consider some questions in the year ahead. Who can you trust? How long can you run? Is bragging really worth it? And, of course, when a hacker's girl displays her breasts, is she showing more than she knows?

[Which applications and vendor dominated the vulnerability and exploit headlines in 2012? See The Vulnerability 'Usual Suspects' Of 2012.]

Sabu's Lulzsec Pals: Ryan Ackroyd, Jake Davis, Darren Martyn, Jeremy Hammond, and Donncha O'Cearrbhail
Thanks, in large part, to the cooperation of hacker Hector Xavier Monsegur, better known as Sabu, who was arrested last year for his escapades as an Anonymous hacker, authorities in the U.S. and Europe arrested five of his compatriots in an international sting that shook up Lulzsec and Anonymous in both the U.S. and the U.K. The sweep caught up a disparate group of cybercriminals from O'Cerrbhail and his attacks against the Irish government, to Hammond, the self-proclaimed "anarchist-communist" who launched a devastating attack against Stratfor, to large-scale collaborative efforts targeting companies and nation states.

Sony's Revenge: Raynaldo Rivera
After the arrest last year of Rivera's Lulzsec partner in crime, Cody Kretsinger, it was only a matter of time before the law caught up with Rivera. He surrendered to the FBI following an indictment by a grand jury for hacking Sony Pictures using a proxy server to carry out a SQL injection attack in May 2011 that lead to the release of unencrypted passwords of more than 1 million Sony customers. In October Rivera pleaded guilty to the crime and will learn his sentencing in the spring. Originally up for 15 years in jail, he'll be recommended for a reduced sentence in exchange for his guilty plea.

The Hacker Formerly Known As ACK!3STX
Between January and March 2012, an unnamed 15-year-old boy burned the midnight oil in order to hack a remarkable 259 websites both in his home country of Austria and abroad, authorities said. Unlike financially or politically motivated attackers, the boy took a shotgun approach, breaching databases and defacing websites seemingly at random. His industriousness outran his thoroughness and Austrian police were able to take him into custody. His exact identity has been protected due to his age and the fact that Europol has launched a more detailed investigation.

The Higinio O.Ochoa Hacker "Bust"
Is exhibitionism a driving force behind hactivism? After hacking a number of U.S. law enforcement websites, a man calling himself W0rmer and professing an affiliate association with Anonymous posted a racy photo of his girlfriend wearing a sign taunting authorities in l337 speak. The FBI was able to take the image of the woman's scantily clad breasts, examine the (ahem) EXIF data of the photo, and follow GPS coordinates to Australia. From there, the trail lead back to 30-year-old Texas Linux admin Higinio Ochoa. The alleged CabinCr3w hacker was sentenced to 27 months in prison and ordered to pay $14,000 in restitution. No charges were pressed against the girlfriend, later identified as Kyle Gardner.

Pirate Bay Founder Arrg-rested: Gottfrid Svartholm
No stranger to legal dilemmas, Pirate Bay co-founder Gottfrid Svartholm found himself in even deeper waters this year. Swede Svartholm was convicted of a number of different copyright law violations in 2008, but left the country and has been threatened with jail time for failing to appear at hearings. The pressure on Svartholm increased when Swedish prosecutors announced this year that the fugitive is suspected to have participated in a hack against Logica, an IT company that works with the Swedish government. The allegations of "aggravated fraud" lead to Svartholm's arrest in his riverside apartment in Phnom Penh, Cambodia.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?