HBGary Hack In Depth 65
Udo Schmitz writes "Heise's UK site has the English translation of an article from the latest issue of their magazine c't about Anonymous's HBGary hack. It shows that there was much more involved than just social engineering to get passwords, and how anonymous evolved following OpTunisia and OpEgypt."
Re: (Score:3, Funny)
Re: (Score:1)
"Why do you feel that Python is so bad? What do you find wrong with it?"
If you had not AC'ed that I would have modded it funny.
Lots of Security Holes (Score:5, Funny)
Re: (Score:2, Insightful)
Interestingly, HBGary Federal never won any actual government contracts.
Re: (Score:3, Insightful)
Duhh..... Well, I think all the data Anonymous "de-"classified would contain any hint to that if that was the case!
We're not talking about all the things they "left unclassified" here; someone force-declassified everything!
Well that was a load of crap (Score:5, Insightful)
Re: (Score:2)
link?
Re:Well that was a load of crap (Score:5, Informative)
It's here, in the Slashdot story that was already posted about 3 weeks ago:
http://it.slashdot.org/story/11/02/17/0041208/Anatomy-of-the-HBGary-Hack [slashdot.org]
Re:Well that was a load of crap (Score:4, Informative)
It's here, in the Slashdot story that was already posted about 3 weeks ago:
http://it.slashdot.org/story/11/02/17/0041208/Anatomy-of-the-HBGary-Hack [slashdot.org]
I missed that. Well ... what would /. be without dupes ...
Another one:
http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-tracked-anonymousand-paid-a-heavy-price.ars [arstechnica.com]
Re: (Score:1)
The ArsTechnica article was far superior IMHO. Much more technical detail about how they went about it.
The interesting thing is that a single solid security measure could've blocked (or at least limited) the scope of the hack, but they managed to chain enough exploits and hacks together to be able to spoof an identity, which resulted in the final hack that allowed them access to the email data.
Re: (Score:2)
That they were able to chain so many together says loads about their security practices and policies. One SQL injection attack is a mistake. But on a home-grown internet-facing execs-only CMS server? Who architected their setup? Who did security reviews? Who set up their password policies? Hell, there's no evidence at all of a security policy. At a security company.
It's good for them that Barr stepped down, but they have a lot to fix before the rest of their clients jump ship.
Re: (Score:2)
Here's the link: http://arstechnica.com/tech-policy/news/2011/02/anonymous-vs-hbgary-the-aftermath.ars [arstechnica.com]
Re:Well that was a load of crap (Score:4, Insightful)
Isn't this essential the Ars Technica's article translated to german, and then translated back to english?
Re: (Score:3)
Re: (Score:2)
I got that same sensation, tho it could be because of the same source material. The brief mention of a conversation with two "members" i do not recall showing up in any of the Arstechnica stuff.
Re: (Score:2)
http://developers.slashdot.org/story/11/03/06/2142233/Disarm-Internet-Trolls-Gently [slashdot.org]
Why did you think that this article was a load of crap? Perhaps there's some good in both stories.
Meh, this system sucks.
Re: (Score:2)
Why do you feel that Python is so bad? What do you find wrong with it?
Emergent behavior at its best (Score:1)
I just wonder if Skynet can be powered by human brain cells.
Also a lot of other sci-fi stuff comes to mind, including Azimov's Foundation.
Re: (Score:1)
Re:Anonymous (Score:5, Insightful)
They're not a Hydra, which is a monolithic monster with no single termination point and self-repair to incremental attacks.
They're a stand-alone complex, which is not even a single entity to begin with.
Which makes them even harder to kill, and, to established powers they oppose, even more fearsome. (OTOH, to the extent they can be developed and manipulated to suit one's ends, they're a most powerful weapon. You can bet the shadowier sides of governments have any number of would-be Kazundo Gouda types analyzing the phenomenon.)
Re: (Score:2)
New villain (Score:4, Funny)
Re: (Score:2)
Re: (Score:1)
Why do I get the feeling HBGary is just filling the void left by SCO as Slashdot's "villain to post about in the absence of real news"?
I was really hoping Oracle with their attack on Android would fill that void... HBGary is just the comic relief.
We Can All Be Anonymous (Score:3, Interesting)
We can all be anonymous. It helps to really know what you're doing, it helps to have no "skeletons" in the closet, it helps to have some passion about what's happening in the world and to want to do something about it. Who's in control? Does that matter? We all can be anonymous.
---Jack O
Re:We Can All Be Anonymous (Score:5, Funny)
The first step of being anonymous would be to not sign your name at the end of a post...
Re: (Score:1)
Ha! you got pwned. My name is really Jim O.
Re: (Score:2)
Re: (Score:1)
And my axe.
What a waste of time (Score:5, Interesting)
Don't bother reading this article, it's horribly written and not particularly correct. They make it sound like HBGary Federal was some giant security company when in reality is was a small-time 4 person company. Oh my god you broke into a 4 person company's email and the idiot manager's twitter account!
So tired of seeing this "hack" replayed on Slashdot.
Re:What a waste of time (Score:5, Informative)
Actually, you overplay your attempt to downplay HBGary Federal. While they never actually won any government contracts, they did have credibility with the US government, they did have access to a lot of "insider" stuff, and they were in negotiations with other contractors to provide some rather big-time stuff. They enjoyed the backing of their parent company, a major figure in the corporate world.
Note that I do NOT claim that thier credibility was justified, nor do I claim that their wares were anything more than vaporware - but they were much, much more than some upstart company operating on less than a shoestring in someone's garage with only 4 employees.
Re: (Score:2, Interesting)
Greg Hoglund is quite a major figure, after his work on rootkit.com and lectures at Blackhat Briefings.
Old news (Score:1)
hbgary was foolish. hbgary got punked.
we all laughed.
NEXT!
Old news (Score:2, Offtopic)
Seriously, Taco, just turn the site into an RSS portal with a comments section. The horrid summaries, old news and dupes are not helping.
Slashdot was ahead of the game 12 years ago, but now it's a dying horse. Time to try something new.
Re: (Score:2)
Re: (Score:1)
1337 (Score:1)