Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

LulzSec's Top 3 Hacking Tools Deconstructed

Analysis suggests LulzSec was most effective using a relatively unknown vulnerability to launch large-scale, botnet-driven attacks against everyone from Sony to the Senate.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
In its 50-day hacking spree, how did the hacking group known as LulzSec manage to break into so many websites?

All told, the group appears to have relied heavily on three attack techniques: using remote file include (RFI), SQL injections, and cross-site scripting. That's according to an analysis conducted by data security vendor Imperva, which studied the leaked LulzSec IRC chat logs recently published by the Guardian.

Interestingly, according to the Open Web Application Security Project's list of the top 10 biggest application security risks, injection attacks and cross-site scripting, respectively, placed first and second. These vulnerabilities, furthermore, have been extensively analyzed and detailed by security experts.

But RFI--a "not widely discussed" type of attack, according to Imperva--is a different story. According to the leaked chat logs, LulzSec member Kayla said that he or she "used to load about 8,000 RFI with usp flooder crushed most server."

"Remember that [it's] Kayla who brought a bot army to Lulsec's toolbox," said Rob Rachwald, director of security strategy at Imperva, in a blog post. "In other words, Lulzsec used an often overlooked vulnerability to help ambush their targets."

What's an RFI attack? "An RFI attack inserts some nasty code into a Web application server," he said. "What does the code do? Usually, RFI is used to take over the Web application and steal data. In the case of Lulzsec, they used it to conduct DDoS attacks."

Based on the chat logs, Kayla had 8,000 infected servers at his or her disposal. "That's pretty sizable," said Rachwald. Furthermore, just one infected server, given its relatively large throughput, can equal about 3,000 bot-infected PCs, meaning that Kayla's botnet could have equaled the power of one with about 24 million PCs. Notably, this was the botnet used to launch the DDoS attack against the CIA's public website.

Regardless of the techniques used by LulzSec, the companies and organizations it hacked--ranging from Sony to the U.S. Senate--faced a similar end result. Namely, LulzSec gained access to their servers, then published sensitive information. But had those organizations taken better security precautions, LulzSec may have moved on to easier pickings.

Last month, a message on the official LulzSec Twitter feed announced that after a 50-day hacking spree, its members were moving on. But understanding how its attacks succeeded is useful information for avoiding similar attacks in the future.

Notably, the #AntiSec effort to publish sensitive business and government secrets, launched by the Anonymous hacking collective and LulzSec (which sprang from Anonymous), has carried on. In fact, #AntiSec recently claimed responsibility for publishing information it obtained in separate attacks against Viacom, Vivendi SA's Universal Music Group, as well as the Arizona Department of Public Safety.

Security monitoring, incident response, and forensics are essential, even in the cloud. But the cloud by definition implies relinquishing at least some control, which can make these practices problematic. In this report, we identify the challenges of detecting and responding to security issues in the cloud and discuss the most effective ways to address them. Download our report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RWISELY520
50%
50%
RWISELY520,
User Rank: Apprentice
3/17/2012 | 2:37:47 PM
re: LulzSec's Top 3 Hacking Tools Deconstructed
So true. More hacking tools: www.ubers.org
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.