Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Researchers: There's Gold in Them Thar Hacks

Black Hat presentation shows some simple methods hackers have used to get rich or die trying

LAS VEGAS – Black Hat 2008 – Wondering how you can make a few bucks -- or a few hundred thousand -- hacking the Web? Researchers from WhiteHat Security yesterday offered up a few ideas.

In a session entitled, "Get Rich or Die Tryin' -- Making Money on the Web, the Black Hat Way," WhiteHat CTO and founder Jeremiah Grossman and Trey Ford, director of software solutions at the research firm, gave some entertaining examples of simple ways to hack the Web -- and make money at it. (See Hacking Without Exploits.)

"We're hoping this session will be fun -- and maybe make some of you question your ethics," quipped Grossman.

The researchers started out by describing a simple script that allows the attacker to manipulate the results of online polls conducted by local newspapers and community groups. Grossman showed how renowned researcher Robert Hansen (a.k.a. RSnake) used this method to help a chihuahua win a no-prize "best dog" contest in a local newspaper -- and was subsequently pwned by another attacker who hacked the same contest on behalf of a different dog.

Ford demonstrated a method whereby an attacker can create "artificial scarcity" of tickets or other assets online, essentially creating a denial-of-service attack that denies all but the attacker access to the desired seats or tickets. "This is a method that is worth something to scalpers who want to drive the prices of their tickets up," he said.

Grossman described ways in which attackers can simply and quickly solve the CAPTCHAs that are used to ensure that a user's response is not generated by a computer. In a dynamic, underground economy, he showed how attackers can buy resolved CAPTCHAs at a price as low as $2 per 1,000.

But simple hacks can also be used to generate a lot more than a couple of dollars, the researchers said. Ford described how one hacker wrote a script that automated the purchase of items using e-coupons to the tune of $50,000, then had them mailed to a non-existent address, where they were intercepted by a conspiring mail carrier.

Grossman recalled the recent case in which a 22-year-old man set up some 58,000 brokerage accounts using a variety of false names and addresses, in order to harvest the micro deposits made to open the accounts. (See Man Arraigned for Setting Up 58,000 Brokerage Accounts.)

He also outlined several attacks against banks, including methods of spoofing the bank's application service provider and some simple ways to fool an online banking system by using negative numbers during a funds transfer.

Ford recounted a recent case at the QVC shopping channel, in which a woman discovered that if she started an order, and then canceled at the right moment during the transaction, she could receive items without being billed for them. "She then did the capitalistic thing: She sold them all on eBay and profited about $412,000."

The two researchers also described methods for scamming "affiliate networks," which pay computer users for posting online ads or links on their home pages or blogs. One attacker made more than $900,000 in two months using well known cookie-stuffing techniques, Grossman said.

In another case, hackers in Ukraine found a method for accessing press releases on the popular Businesswire service before they were issued to the public. The hackers made more than $300,000 by placing sell orders on the stocks of the involved companies before the releases were published, Grossman stated.

All of these exploits proved viable, and some of them proved to be legal, though law enforcement often found ways to nab the victims, the researchers noted. The bottom line: Businesses should be wary of leaving these simple vulnerabilities in their systems.

"Business logic flaws outnumber the more well publicized flaws, such as cross-site scripting and SQL injection -- you just don't hear about them as often," Grossman stated. "The key is to test often, and test everywhere. Not all vulnerabilities can be identified in the design phase, by analyzing code, or even during the [quality assurance] process. You need to do some profiling to look for these kinds of flaws."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-19
OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security restrictions and perform unauthorized actions.
PUBLISHED: 2020-02-19
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
PUBLISHED: 2020-02-19
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
PUBLISHED: 2020-02-19
Hitron CODA-4582U devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
PUBLISHED: 2020-02-19
Western Digital WesternDigitalSSDDashboardSetup.exe before allows DLL Hijacking.