Attacks/Breaches
7/5/2011
12:59 PM
Connect Directly
RSS
E-Mail
50%
50%

LulzSec's Top 3 Hacking Tools Deconstructed

Analysis suggests LulzSec was most effective using a relatively unknown vulnerability to launch large-scale, botnet-driven attacks against everyone from Sony to the Senate.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
In its 50-day hacking spree, how did the hacking group known as LulzSec manage to break into so many websites?

All told, the group appears to have relied heavily on three attack techniques: using remote file include (RFI), SQL injections, and cross-site scripting. That's according to an analysis conducted by data security vendor Imperva, which studied the leaked LulzSec IRC chat logs recently published by the Guardian.

Interestingly, according to the Open Web Application Security Project's list of the top 10 biggest application security risks, injection attacks and cross-site scripting, respectively, placed first and second. These vulnerabilities, furthermore, have been extensively analyzed and detailed by security experts.

But RFI--a "not widely discussed" type of attack, according to Imperva--is a different story. According to the leaked chat logs, LulzSec member Kayla said that he or she "used to load about 8,000 RFI with usp flooder crushed most server."

"Remember that [it's] Kayla who brought a bot army to Lulsec's toolbox," said Rob Rachwald, director of security strategy at Imperva, in a blog post. "In other words, Lulzsec used an often overlooked vulnerability to help ambush their targets."

What's an RFI attack? "An RFI attack inserts some nasty code into a Web application server," he said. "What does the code do? Usually, RFI is used to take over the Web application and steal data. In the case of Lulzsec, they used it to conduct DDoS attacks."

Based on the chat logs, Kayla had 8,000 infected servers at his or her disposal. "That's pretty sizable," said Rachwald. Furthermore, just one infected server, given its relatively large throughput, can equal about 3,000 bot-infected PCs, meaning that Kayla's botnet could have equaled the power of one with about 24 million PCs. Notably, this was the botnet used to launch the DDoS attack against the CIA's public website.

Regardless of the techniques used by LulzSec, the companies and organizations it hacked--ranging from Sony to the U.S. Senate--faced a similar end result. Namely, LulzSec gained access to their servers, then published sensitive information. But had those organizations taken better security precautions, LulzSec may have moved on to easier pickings.

Last month, a message on the official LulzSec Twitter feed announced that after a 50-day hacking spree, its members were moving on. But understanding how its attacks succeeded is useful information for avoiding similar attacks in the future.

Notably, the #AntiSec effort to publish sensitive business and government secrets, launched by the Anonymous hacking collective and LulzSec (which sprang from Anonymous), has carried on. In fact, #AntiSec recently claimed responsibility for publishing information it obtained in separate attacks against Viacom, Vivendi SA's Universal Music Group, as well as the Arizona Department of Public Safety.

Security monitoring, incident response, and forensics are essential, even in the cloud. But the cloud by definition implies relinquishing at least some control, which can make these practices problematic. In this report, we identify the challenges of detecting and responding to security issues in the cloud and discuss the most effective ways to address them. Download our report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RWISELY520
50%
50%
RWISELY520,
User Rank: Apprentice
3/17/2012 | 2:37:47 PM
re: LulzSec's Top 3 Hacking Tools Deconstructed
So true. More hacking tools: www.ubers.org
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1556
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.

CVE-2014-2008
Published: 2014-09-12
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

CVE-2014-2009
Published: 2014-09-12
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

CVE-2014-4735
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php.

CVE-2014-5259
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant