Attacks/Breaches
7/5/2011
12:59 PM
50%
50%

LulzSec's Top 3 Hacking Tools Deconstructed

Analysis suggests LulzSec was most effective using a relatively unknown vulnerability to launch large-scale, botnet-driven attacks against everyone from Sony to the Senate.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
In its 50-day hacking spree, how did the hacking group known as LulzSec manage to break into so many websites?

All told, the group appears to have relied heavily on three attack techniques: using remote file include (RFI), SQL injections, and cross-site scripting. That's according to an analysis conducted by data security vendor Imperva, which studied the leaked LulzSec IRC chat logs recently published by the Guardian.

Interestingly, according to the Open Web Application Security Project's list of the top 10 biggest application security risks, injection attacks and cross-site scripting, respectively, placed first and second. These vulnerabilities, furthermore, have been extensively analyzed and detailed by security experts.

But RFI--a "not widely discussed" type of attack, according to Imperva--is a different story. According to the leaked chat logs, LulzSec member Kayla said that he or she "used to load about 8,000 RFI with usp flooder crushed most server."

"Remember that [it's] Kayla who brought a bot army to Lulsec's toolbox," said Rob Rachwald, director of security strategy at Imperva, in a blog post. "In other words, Lulzsec used an often overlooked vulnerability to help ambush their targets."

What's an RFI attack? "An RFI attack inserts some nasty code into a Web application server," he said. "What does the code do? Usually, RFI is used to take over the Web application and steal data. In the case of Lulzsec, they used it to conduct DDoS attacks."

Based on the chat logs, Kayla had 8,000 infected servers at his or her disposal. "That's pretty sizable," said Rachwald. Furthermore, just one infected server, given its relatively large throughput, can equal about 3,000 bot-infected PCs, meaning that Kayla's botnet could have equaled the power of one with about 24 million PCs. Notably, this was the botnet used to launch the DDoS attack against the CIA's public website.

Regardless of the techniques used by LulzSec, the companies and organizations it hacked--ranging from Sony to the U.S. Senate--faced a similar end result. Namely, LulzSec gained access to their servers, then published sensitive information. But had those organizations taken better security precautions, LulzSec may have moved on to easier pickings.

Last month, a message on the official LulzSec Twitter feed announced that after a 50-day hacking spree, its members were moving on. But understanding how its attacks succeeded is useful information for avoiding similar attacks in the future.

Notably, the #AntiSec effort to publish sensitive business and government secrets, launched by the Anonymous hacking collective and LulzSec (which sprang from Anonymous), has carried on. In fact, #AntiSec recently claimed responsibility for publishing information it obtained in separate attacks against Viacom, Vivendi SA's Universal Music Group, as well as the Arizona Department of Public Safety.

Security monitoring, incident response, and forensics are essential, even in the cloud. But the cloud by definition implies relinquishing at least some control, which can make these practices problematic. In this report, we identify the challenges of detecting and responding to security issues in the cloud and discuss the most effective ways to address them. Download our report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RWISELY520
50%
50%
RWISELY520,
User Rank: Apprentice
3/17/2012 | 2:37:47 PM
re: LulzSec's Top 3 Hacking Tools Deconstructed
So true. More hacking tools: www.ubers.org
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Things Every Business Executive Should Know About Cybersecurity
Don't get lost in security's technical minutiae - a clearer picture of what's at stake can help align business imperatives with technology execution.
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.