Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Researchers: There's Gold in Them Thar Hacks

Black Hat presentation shows some simple methods hackers have used to get rich or die trying

LAS VEGAS – Black Hat 2008 – Wondering how you can make a few bucks -- or a few hundred thousand -- hacking the Web? Researchers from WhiteHat Security yesterday offered up a few ideas.

In a session entitled, "Get Rich or Die Tryin' -- Making Money on the Web, the Black Hat Way," WhiteHat CTO and founder Jeremiah Grossman and Trey Ford, director of software solutions at the research firm, gave some entertaining examples of simple ways to hack the Web -- and make money at it. (See Hacking Without Exploits.)

"We're hoping this session will be fun -- and maybe make some of you question your ethics," quipped Grossman.

The researchers started out by describing a simple script that allows the attacker to manipulate the results of online polls conducted by local newspapers and community groups. Grossman showed how renowned researcher Robert Hansen (a.k.a. RSnake) used this method to help a chihuahua win a no-prize "best dog" contest in a local newspaper -- and was subsequently pwned by another attacker who hacked the same contest on behalf of a different dog.

Ford demonstrated a method whereby an attacker can create "artificial scarcity" of tickets or other assets online, essentially creating a denial-of-service attack that denies all but the attacker access to the desired seats or tickets. "This is a method that is worth something to scalpers who want to drive the prices of their tickets up," he said.

Grossman described ways in which attackers can simply and quickly solve the CAPTCHAs that are used to ensure that a user's response is not generated by a computer. In a dynamic, underground economy, he showed how attackers can buy resolved CAPTCHAs at a price as low as $2 per 1,000.

But simple hacks can also be used to generate a lot more than a couple of dollars, the researchers said. Ford described how one hacker wrote a script that automated the purchase of items using e-coupons to the tune of $50,000, then had them mailed to a non-existent address, where they were intercepted by a conspiring mail carrier.

Grossman recalled the recent case in which a 22-year-old man set up some 58,000 brokerage accounts using a variety of false names and addresses, in order to harvest the micro deposits made to open the accounts. (See Man Arraigned for Setting Up 58,000 Brokerage Accounts.)

He also outlined several attacks against banks, including methods of spoofing the bank's application service provider and some simple ways to fool an online banking system by using negative numbers during a funds transfer.

Ford recounted a recent case at the QVC shopping channel, in which a woman discovered that if she started an order, and then canceled at the right moment during the transaction, she could receive items without being billed for them. "She then did the capitalistic thing: She sold them all on eBay and profited about $412,000."

The two researchers also described methods for scamming "affiliate networks," which pay computer users for posting online ads or links on their home pages or blogs. One attacker made more than $900,000 in two months using well known cookie-stuffing techniques, Grossman said.

In another case, hackers in Ukraine found a method for accessing press releases on the popular Businesswire service before they were issued to the public. The hackers made more than $300,000 by placing sell orders on the stocks of the involved companies before the releases were published, Grossman stated.

All of these exploits proved viable, and some of them proved to be legal, though law enforcement often found ways to nab the victims, the researchers noted. The bottom line: Businesses should be wary of leaving these simple vulnerabilities in their systems.

"Business logic flaws outnumber the more well publicized flaws, such as cross-site scripting and SQL injection -- you just don't hear about them as often," Grossman stated. "The key is to test often, and test everywhere. Not all vulnerabilities can be identified in the design phase, by analyzing code, or even during the [quality assurance] process. You need to do some profiling to look for these kinds of flaws."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
'Box Shield' Brings New Security Controls
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-08-23
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.
PUBLISHED: 2019-08-23
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.
PUBLISHED: 2019-08-22
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the ...
PUBLISHED: 2019-08-22
In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not.
PUBLISHED: 2019-08-22
The import-users-from-csv-with-meta plugin before for WordPress has directory traversal.