Attacks/Breaches
10/30/2012
11:51 AM
50%
50%

Hackers Trade Tips On DDoS, SQL Injection

Study of hacker bulletin boards reveals focus on attack techniques, tips for beginning hackers, buying and selling of fake social network endorsements.

What do hackers talk about amongst themselves?

These days, the two hottest topics -- comprising 19% of all discussions -- involve distributed denial of service (DDoS) attacks and SQL injection attacks.

Those findings come via a new report released by data security firm Imperva, which reviewed the chatter on 18 underground forums -- including one with 250,000 members -- to see what participants discussed. Beyond DDoS and SQL injection, the other top topics, based on a keyword analysis, were shell code (16% of all discussions), spam (14%), cross-site scripting (12%), and brute-force techniques (11%).

[ What do we know about the U.S. bank hackers? Read Who Is Hacking U.S. Banks? 8 Facts. ]

Imperva also found that the majority of forum threads were devoted to beginner hacking, hacking tools and programs, and website and forum hacking. Other information security topics, such as wireless hacking and cryptography, were also discussed, but with much less frequency.

Beyond tutorials and education, hacking forums also serve as a place for people to buy and sell their goods or services. "The pages are filled not only with job offers, but with advertisements for paid services, buy/sell, ads, and trading goods," read the Imperva report. "Goods in the cyber world can be anything from Facebook 'likes,' hacking tools, and e-books to botnets and pornographic material. Some simple tools are shared for free, just to increase the status of the developer. Transactions are usually made in ways that allow anonymity, like Bitcoins, Liberty Reserve, or even PayPal."

One area of increasing interest on hacking forums involves so-called "e-whoring" attacks. E-whoring, according to the Imperva report, is "a practice of selling pornographic content, while pretending to be the person, usually girl, photographed." The report continued, "It is considered a form of social engineering, when the victim is misled to believe he is interacting with a girl who is sending him nude photos and video clips of herself." To facilitate such attacks, hackers -- or more precisely, social engineers -- actively share, if not buy and sell, "e-whoring packages," which typically include photographs and videos. An attacker then lurks in adult chat rooms, using the photos and videos to pretend to be the pictured woman, to try and lure buyers into paying to see more racy material.

While these types of social-engineering ruses may be popular, some of the most devastating exploits being launched today involve DDoS attacks, aided in part by a number of free but effective DDoS tools. DDoS attacks involve flooding a network with fake packets, to make it effectively unreachable. Such attacks have recently been used to disrupt the websites of major U.S. banks.

The most common type of hack attack seen these days, however, involves SQL injection. Attackers -- including hacktivists -- favor SQL injection attacks because they allow attackers to "inject" their own commands into databases. When databases aren't configured to properly screen inputs for signs of attack, attackers have an easy-to-use, remote technique for obtaining any information stored by the database.

According to Imperva, SQL injection attacks are the most common type of attack launched against websites -- and more often than not are the favored attack type for stealing sensitive data. For example, numerous security experts suspect that SQL injection attacks were used in the online attack against South Carolina state systems announced Friday by state officials. All told, the breach involved the social security numbers of some 3.6 million state residents, as well as 387,000 credit and debit card numbers. Unfortunately, the social security numbers, along with about 16,000 card numbers, weren't stored in encrypted format.

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security. In our report, Using Google To Find Vulnerabilities In Your IT Environment, we outline methods for using search engines such as Google and Bing to identify vulnerabilities in your applications, systems and services--and to fix them before they can be exploited. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
matcohen
50%
50%
matcohen,
User Rank: Apprentice
11/1/2012 | 10:50:48 PM
re: Hackers Trade Tips On DDoS, SQL Injection
Why do thieves rob banks? Because that's where the money is.

SQL Injection is the quickest and easiest way to maximize the return on your hacking hours if you are a hacker. After 10 years of web application security efforts, enterprises are still vulnerable to the most obvious and dangerous attack.

Building a website without security is like building a car with no safety features.

Best,

Matthew Cohen
www.ntobjectives.com
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.