Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Researchers: There's Gold in Them Thar Hacks

Black Hat presentation shows some simple methods hackers have used to get rich or die trying

LAS VEGAS – Black Hat 2008 – Wondering how you can make a few bucks -- or a few hundred thousand -- hacking the Web? Researchers from WhiteHat Security yesterday offered up a few ideas.

In a session entitled, "Get Rich or Die Tryin' -- Making Money on the Web, the Black Hat Way," WhiteHat CTO and founder Jeremiah Grossman and Trey Ford, director of software solutions at the research firm, gave some entertaining examples of simple ways to hack the Web -- and make money at it. (See Hacking Without Exploits.)

"We're hoping this session will be fun -- and maybe make some of you question your ethics," quipped Grossman.

The researchers started out by describing a simple script that allows the attacker to manipulate the results of online polls conducted by local newspapers and community groups. Grossman showed how renowned researcher Robert Hansen (a.k.a. RSnake) used this method to help a chihuahua win a no-prize "best dog" contest in a local newspaper -- and was subsequently pwned by another attacker who hacked the same contest on behalf of a different dog.

Ford demonstrated a method whereby an attacker can create "artificial scarcity" of tickets or other assets online, essentially creating a denial-of-service attack that denies all but the attacker access to the desired seats or tickets. "This is a method that is worth something to scalpers who want to drive the prices of their tickets up," he said.

Grossman described ways in which attackers can simply and quickly solve the CAPTCHAs that are used to ensure that a user's response is not generated by a computer. In a dynamic, underground economy, he showed how attackers can buy resolved CAPTCHAs at a price as low as $2 per 1,000.

But simple hacks can also be used to generate a lot more than a couple of dollars, the researchers said. Ford described how one hacker wrote a script that automated the purchase of items using e-coupons to the tune of $50,000, then had them mailed to a non-existent address, where they were intercepted by a conspiring mail carrier.

Grossman recalled the recent case in which a 22-year-old man set up some 58,000 brokerage accounts using a variety of false names and addresses, in order to harvest the micro deposits made to open the accounts. (See Man Arraigned for Setting Up 58,000 Brokerage Accounts.)

He also outlined several attacks against banks, including methods of spoofing the bank's application service provider and some simple ways to fool an online banking system by using negative numbers during a funds transfer.

Ford recounted a recent case at the QVC shopping channel, in which a woman discovered that if she started an order, and then canceled at the right moment during the transaction, she could receive items without being billed for them. "She then did the capitalistic thing: She sold them all on eBay and profited about $412,000."

The two researchers also described methods for scamming "affiliate networks," which pay computer users for posting online ads or links on their home pages or blogs. One attacker made more than $900,000 in two months using well known cookie-stuffing techniques, Grossman said.

In another case, hackers in Ukraine found a method for accessing press releases on the popular Businesswire service before they were issued to the public. The hackers made more than $300,000 by placing sell orders on the stocks of the involved companies before the releases were published, Grossman stated.

All of these exploits proved viable, and some of them proved to be legal, though law enforcement often found ways to nab the victims, the researchers noted. The bottom line: Businesses should be wary of leaving these simple vulnerabilities in their systems.

"Business logic flaws outnumber the more well publicized flaws, such as cross-site scripting and SQL injection -- you just don't hear about them as often," Grossman stated. "The key is to test often, and test everywhere. Not all vulnerabilities can be identified in the design phase, by analyzing code, or even during the [quality assurance] process. You need to do some profiling to look for these kinds of flaws."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-12
Octeth Oempro 4.7 allows SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.
PUBLISHED: 2019-12-12
make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type.
PUBLISHED: 2019-12-12
The Work Time Calendar app before 4.7.1 for Jira allows XSS.
PUBLISHED: 2019-12-12
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
PUBLISHED: 2019-12-12
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from th...