Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Researchers: There's Gold in Them Thar Hacks

Black Hat presentation shows some simple methods hackers have used to get rich or die trying

LAS VEGAS – Black Hat 2008 – Wondering how you can make a few bucks -- or a few hundred thousand -- hacking the Web? Researchers from WhiteHat Security yesterday offered up a few ideas.

In a session entitled, "Get Rich or Die Tryin' -- Making Money on the Web, the Black Hat Way," WhiteHat CTO and founder Jeremiah Grossman and Trey Ford, director of software solutions at the research firm, gave some entertaining examples of simple ways to hack the Web -- and make money at it. (See Hacking Without Exploits.)

"We're hoping this session will be fun -- and maybe make some of you question your ethics," quipped Grossman.

The researchers started out by describing a simple script that allows the attacker to manipulate the results of online polls conducted by local newspapers and community groups. Grossman showed how renowned researcher Robert Hansen (a.k.a. RSnake) used this method to help a chihuahua win a no-prize "best dog" contest in a local newspaper -- and was subsequently pwned by another attacker who hacked the same contest on behalf of a different dog.

Ford demonstrated a method whereby an attacker can create "artificial scarcity" of tickets or other assets online, essentially creating a denial-of-service attack that denies all but the attacker access to the desired seats or tickets. "This is a method that is worth something to scalpers who want to drive the prices of their tickets up," he said.

Grossman described ways in which attackers can simply and quickly solve the CAPTCHAs that are used to ensure that a user's response is not generated by a computer. In a dynamic, underground economy, he showed how attackers can buy resolved CAPTCHAs at a price as low as $2 per 1,000.

But simple hacks can also be used to generate a lot more than a couple of dollars, the researchers said. Ford described how one hacker wrote a script that automated the purchase of items using e-coupons to the tune of $50,000, then had them mailed to a non-existent address, where they were intercepted by a conspiring mail carrier.

Grossman recalled the recent case in which a 22-year-old man set up some 58,000 brokerage accounts using a variety of false names and addresses, in order to harvest the micro deposits made to open the accounts. (See Man Arraigned for Setting Up 58,000 Brokerage Accounts.)

He also outlined several attacks against banks, including methods of spoofing the bank's application service provider and some simple ways to fool an online banking system by using negative numbers during a funds transfer.

Ford recounted a recent case at the QVC shopping channel, in which a woman discovered that if she started an order, and then canceled at the right moment during the transaction, she could receive items without being billed for them. "She then did the capitalistic thing: She sold them all on eBay and profited about $412,000."

The two researchers also described methods for scamming "affiliate networks," which pay computer users for posting online ads or links on their home pages or blogs. One attacker made more than $900,000 in two months using well known cookie-stuffing techniques, Grossman said.

In another case, hackers in Ukraine found a method for accessing press releases on the popular Businesswire service before they were issued to the public. The hackers made more than $300,000 by placing sell orders on the stocks of the involved companies before the releases were published, Grossman stated.

All of these exploits proved viable, and some of them proved to be legal, though law enforcement often found ways to nab the victims, the researchers noted. The bottom line: Businesses should be wary of leaving these simple vulnerabilities in their systems.

"Business logic flaws outnumber the more well publicized flaws, such as cross-site scripting and SQL injection -- you just don't hear about them as often," Grossman stated. "The key is to test often, and test everywhere. Not all vulnerabilities can be identified in the design phase, by analyzing code, or even during the [quality assurance] process. You need to do some profiling to look for these kinds of flaws."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google Maps is taking "interactive" to a whole new level!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-17
Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.