hacker
Latest
The true story of a hacker's brief tenure as a fed at the FTC
The Federal Trade Commission managed to turn a few heads by hiring anti-DRM advocate Ed Felten as it's first Chief Technologist earlier this month, but it turns out the agency made an even more surprising hire last year -- one that didn't last very long. As Forbes reports, the FTC hired 29-year-old hacker Chris Soghoian in 2009, along with a handful of other technologists tasked with investigating corporations suspected of violating consumers' privacy. While that name might not ring a bell, Soghoian did gain some notoriety in 2006 by building a tool that was able to print out fake boarding passes for Northwest Airlines (in an effort to expose a security flaw), and he's since engaged in number of other activities that could either be considered hacks or pranks depending on your point of view. So how did his tenure at the FTC work out? Well, he nearly quit after being forced to submit to a fingerprint scan on his first day, and last December he sparked a controversy by posting audio he secretly recorded at an industry-only security conference on his personal blog -- although that did seemingly end up influencing a Justice Department report on phone record searches. Perhaps not surprisingly, that didn't exactly lead to a long career as a fed, and the FTC chose not to renew Soghoian's contract this year, stating only that he "provided valuable service to the agency."
Kinect does hacker's bidding, but not for fortune or fame (update: more video)
Yes, Microsoft's Kinect has already been cracked, as you'll see on video after the break -- the motion-sensing depth camera now nods its head on command and displays real-time accelerometer data on one lucky hacker's PC. We tracked down the son-of-a-gun who did it -- as it happens, the same NUI Group member who hacked the PlayStation Eye in 2008 -- and found to our disappointment that he doesn't necessarily intend to unleash his new exploit on the world. The $2,000 prize Adafruit is presently offering for open-source Kinect drivers isn't his aim, though he does have big personal plans for the device, as he hopes to integrate it into his company's commercial visualization suite CL Studio Live. It seems that work is progressing fast, as he's already gotten video streams from both cameras to output to his computer, and he plans to upload a far more convincing video soon. Here's hoping he has a change of heart about sharing his rapid accomplishments. Update: Second video after the break! [Thanks to everyone who sent this in]
PayPal app has huge security flaw, update rushed to Apple
You'd think by now we'd all be wary of open WiFi networks, and luckily that's the only way this could affect you, but if you use the PayPal app on an open network the Wall Street Journal is reporting a hacker could potentially nab your user account. According to the story, the app doesn't verify your security certificate (which is kind of the point of the certificate, no?) and goes along its merry way, transmitting your data to PayPal in a way that a fortuitous ne'er do well could intercept. Still, as the WSJ points out, a hacker would have to be poised and ready to take advantage of this exploit. I doubt you're sitting around in that app for hours while sipping your latte at Starbucks, right? The app in the store shows the last update was October 26, but the WSJ reports a fixed version has been sent to Apple. We've reached out to PayPal to see if the updated app is available yet, but haven't heard back. For now, if you must use this app in public, turn off WiFi to avoid the exploit. This issue does not affect users of the PayPal Android app or visitors to the website. Update: Looks like version 3.0.1 arrived shortly after we posted this. PayPal away in relative security, everyone!
Computer controlled Bayan from 1988 makes us want to go back to the past
Back in 1988, Russian engineer Vladimir Demin combined a bunch of solenoids (loops of copper wire) and a Bayan (a Russian accordian), to create a self-playable instrument controlled by his awesome, self-built computer. Yes, we're impressed, and you will be too, if you take a look at the video below.
Rockstar offering Red Dead cheaters a chance at Redemption
Next Tuesday, Rockstar San Diego will swing low its terrible banhammer, winking players with hacked Red Dead Redemption game saves out of existence. If you're one of these miscreants, but you'd rather not have your Gamertag/PSN ID permabanned from the Wild Western's multiplayer component, you still have an out: Delete your hacked game saves. Yep, your single-player saves, too. It's harsh, we know -- but maybe you should have thought of that before adopting your life of petty crime. For more info on how to avoid the Harvest of the Cheaters™, check out Rockstar Games' official blog.
GPUs democratize brute force password hacking
It seems that the availability of increasingly powerful GPUs, when combined with brute-force password cracking tools, is making it increasingly easy to crack passwords -- even if they're extremely well thought out, with symbols and quirky capitalization and all that. How short is too short? According to computer scientists at the Georgia Tech Research Institute, "a seven-character password is hopelessly inadequate, and as GPU power continues to go up every year, the threat will increase." A better alternative, he suggested, would be a 12-character combination of upper and lower case letters, symbols and digits. Of course, processors are only getting more powerful and hardware less expensive -- soon even seven-plus character passwords may become the digital equivalent of unlocked doors. And if that weren't bad enough, a recent study by an Internet security company called BitDefender has determined that some 250,000 user names, email addresses, and passwords used for social networking sites are freely available online -- and seventy-five percent of these folks use the same password for their email and social networking. So, when dreaming up fancy new twelve character passwords, make sure you're creating unique passwords for all your various accounts. It would be a shame if your Starsky & Hutch FanFicForum account left you vulnerable to identity theft.
Breakfast Topic: Hacked off by hackers
This Breakfast Topic has been brought to you by Seed, the Aol guest writer program that brings your words to WoW.com. Hacked! It is not fun, and it happens more than anyone would like to admit. Gear, gold and pride, all pilfered by some stranger. It starts with a simple email from Blizzard. Hmmm, it's my first-ever email from Blizzard that causes immediate concern. It says that my account has been "banned and deleted" for buying or selling in-game gold for profit. I am stare at it in shock for a minute ... Is this a joke? My heart starts racing. I run back to my office computer to figure out what to do, and my head starts spinning in confusion. My immediate emotional response catches me off guard ... My head starts to pound. All that work, all that time, all the friends ... just gone ... And then the high-level anger sets in, as logic begins to prevail. Wait, I never bought gold. I never even considered it! What is going on? I jump online and write an appeal with blazing speed, fueled by my troll rage. In retrospect, this was not exactly the smartest move and probably served to delay my account restoration. I recall that it read something like this ...
Hacker intercepts phone calls with homebuilt $1,500 IMSI catcher, claims GSM is beyond repair
In 2009, Chris Paget showed the world the vulnerabilities of RFID by downloading the contents of US passports from the safety of his automobile. This year, he's doing the same for mobile phones. Demonstrating at DefCon 2010, the white hat hacker fooled 17 nearby GSM phones into believing his $1,500 kit (including a laptop and two RF antennas) was a legitimate cell phone base station, and proceeded to intercept and record audience calls. "As far as your cell phones are concerned, I'm now indistinguishable from AT&T," he told the crowd. The purpose of the demonstration was highlight a major flaw in the 2G GSM system, which directs phones to connect to the tower with the strongest signal regardless of origin -- in this case, Paget's phony tower. The hacker did caveat that his system could only intercept outbound calls, and that caller ID could tip off the owner of a handset to what's what, but he says professional IMSI catchers used by law enforcement don't suffer from such flaws and amateur parity would only be a matter of time. "GSM is broken," Paget said, "The primary solution is to turn it off altogether." That's a tall order for a world still very dependent on the technology for mobile connectivity, but we suppose AT&T and T-Mobile could show the way. Then again, we imagine much of that same world is still using WEP and WPA1 to "secure" their WiFi.
Some Windows CE-based ATMs especially generous (and vulnerable to hackers)
Speaking at the Black Hat conference in Las Vegas, a fellow named Barnaby Jack (really!) used custom software to hack Windows CE-based ATMs on stage. After using an industry standard key to gain entry to the machines (apparently many ATM owners are too lazy to install new locks) Jack was able to load a rootkit on the device using a USB thumb drive. From that point, it was just a matter of running another program that caused all the cash therein to shoot out in a comical manner. The machines used in the presentation were manufactured by Trannax and Triton, both of which have have had a chance to send a security patch to customers prior to the demonstration. However, there are four different machines in common use that are still vulnerable. And no, he won't tell us which ones.
100 million Facebook pages leaked to a torrent site, creating the world's least exciting torrent
Hacker Ron Bowes from Skull Security has created a 2.8GB torrent file which contains the Facebook account details of roughly 100 million users. That's about 1 in 5 of the half billion accounts the social networking site has, and the torrent contains URLs for each account, with other personal details contained in the profiles such as phone numbers and email addresses. Bowes created a crawler to troll Facebook's open access directory, where all the information is kept. There's nothing illegal about any of this, of course -- we put our information out there into the public forum that Facebook is, after all -- but there's still something creepy about the idea of someone torrenting our profile. Then again, we have some pretty amazing shots from the Bronx Zoo in there, so we can't really blame them.
Wireless presentation controllers prove juicy targets for hackers
Wireless presentation controllers have changed corporate life forever. Instead of businessmen and women staying tethered to their keyboards while delivering boring PowerPoint presentations, they can wander about the room, gesticulating authoritatively with an ego-boosting gadget in-hand... while delivering that same boring presentation. Now a security researcher by the name of Nields Teusink is showing that those wild gesticulations open the door to crazy hacks, with most wireless presenters being recognized as full keyboards -- some even as keyboards and mice. With no encryption provided it's a (reasonably) simple task for an attacker to replicate the signal, escape the presentation, and completely compromise the machine. Teusink uses an Arduino board for his work here, impressing us while sending a chill into the hearts of slide gurus everywhere.
Hacker group responds to AT&T, leader held by FBI
You'll remember that the not-at-all-ridiculously-named Goatse Security (GS) announced its discovery of an exploit on AT&T's website last week. They used it to get a list of email addresses belonging to iPad 3G customers. One hundred and fourteen thousand of them, in fact. AT&T representatives said that they were made aware of the hole and had it patched within a day, and explained their side of the story in the New York Times. Dorothy Attwood, a senior vice president and chief privacy officer at AT&T, said "...unauthorized computer 'hackers' maliciously exploited a function designed to make your iPad log-in process faster." The folks at GS took umbrage at being called "malicious," and posted their own response, citing still-unpatched vulnerabilities in Mobile Safari on the iPad as evidence that Apple and AT&T are not addressing the real issues. "When we disclosed this," wrote Escher Auernheimer, "we did it as a service to our nation. We love America and the idea of the Russians or Chinese being able to subvert American infrastructure is a nightmare...The fact remains that there was not a hint of maliciousness in our disclosure." The FBI agrees with Auernheimer's assertion that this exploit is of national interest. So much so, CNET reports, that they raided Andrew Auernheimer's home on a warrant (we assume "Escher" is a pseudonym). They found "illicit drugs," and Auernheimer is now being held on felony charges. Let this be a lesson to you. If you plan on serving your country, get rid of the drugs first. [via Engadget]
AT&T hacker's home raided, drugs found, dude detained (update)
Man, one day you have the whole world's ear to talk about slack network security, and the next you're in the joint. Andrew Auernheimer, Goatse Security's hacker-in-chief and a key player in the unearthing of a major security flaw exposing iPads surfing AT&T's airwaves, is today facing felony charges for possession of a variety of potent drugs. That wouldn't be such intriguing news by itself, but the discovery was made by local law enforcers who were in the process of executing an FBI search warrant. Hey, wasn't the FBI going to look into this security breach? Yes indeedy. While nobody is yet willing to identify the reasons behind this warrant, it's not illogical to surmise that Andrew's crew and their online exploits were the cause for the raid. So there you have it folks, it's the first bit of advice any publicist will give you: if you're gonna step out into the glaring light of public life, you'd better clean out your closet first. Update: Before y'all get in an uproar about "white hacker this" and "Police State that," let's keep in mind that this Andrew Auernheimer character (a.k.a. "Weev") is one unsavory dude (not to mention a raving anti-Semite): check out this New York Times piece on Internet Trolls if you don't believe us. After all, it's not really a stretch that law enforcement might be after someone who's in possession of ecstasy, cocaine, LSD, and various other pharmaceuticals.
Mortal Online busting out tremendous banhammer on hackers
Hackers beware. The team at Star Vault have their eyes on you, and it's time to stop any and all shenanigans you've got going on in Mortal Online. Or else, you say? Or else the banhammer awaits you -- and according to their most recent update, it means an instant, permanent ban that could leave you staring at the login screen in frustration. According to a post by Maerlyn on the Mortal Online forums, there is currently no set date on when software monitoring will come into play, or even what method they'll use to monitor for third-party applications or changes in the game files that are being reported. A follow-up posting by Tazaterra in the same thread indicates that anyone who has modified game files needs to stop at this time. With the game still being tweaked pending release, we're glad to see the team at Star Vault is taking a proactive stance on this before the floodgates officially open. In a game where PvP is everything, players need to know that anyone using exploits, hacks, bots or the like to tip the game balance will be dealt with swiftly and before it causes game imbalances. [via TTH]
Symantec names Shaoxing, China as world's malware capital
It's not the sort of title any city's looking for, but Symantec has now given Shaoxing, China the dubious honor of being the world's malware capital, saying that it accounts for more targeted attacks than any other city. In fact, the company found that while close to 30 percent of all malicious attacks came from China (making it the number one country), 21.3 percent came just from Shaoxing. It was followed by Taipei at 16.5 percent, and London at 14.8 percent. Following China in the country rankings is Romania with 21.1 percent of attempted attacks (most of those are said to be commercial fraud), and the United States at 13.8 percent. That's actually just part of a larger report by Symantec's MessageLabs division, which details everything from the most common types of email attachments (.XLS and .DOC are neck and neck for the lead) to the percentage of emails that contain a virus of phishing attack (one in 358.3 and one in 513.7, respectively). Dive into the PDF linked below for the complete details.
Microsoft's Major Nelson Gamercard cracked by hacker [update]
Microsoft podcaster and Xbox spokesperson Larry "Major Nelson" Hryb's Gamercard has fallen victim to a hacker (or hackers) sometime this evening. A quick check on Xbox.com reveals the account is still being affected right now (though we have to imagine someone over in Redmond is hard at work on a fix) has been fixed. Hryb's account info was altered to reflect some ... rather offensive pejoratives, and images from Kotaku reveal an odd spam statement ("ANY ACCOUNT $100 PAYPAL!!!!!!!!"). A website by the name of "LiGHTzz" has a video that proclaims responsibility for the hacking and even offers up a YouTube video advertising his services to others -- the name Yasiel Rodriguez, a resident of Miami, Fl., is registered to the domain name in question. We've contacted Microsoft regarding the matter and will keep you updated on a response (discussed a bit by Xbox's Stephen Toulouse on Twitter, in the meantime). Proceed with caution after the break to see the NSFW image if you wish -- we'd suggest against it.
iPhone SMS database hacked in 20 seconds, news at 11
It's a story tailor-made for the fear-mongering subset of news media. This week, a pair of gentlemen lured an unsuspecting virgin iPhone to a malicious website and -- with no other input from the user -- stole the phone's entire database of sent, received and even deleted text messages in under 20 seconds, boasting that they could easily lift personal contacts, emails and your naughty, naughty photos as well. Thankfully for us level-headed souls, those gentlemen were Vincenzo Iozzo and Ralf-Philipp Weinmann, security researchers performing for the 2010 Pwn2Own hacking contest, and their $15,000 first prize ensures that the winning formula will go to Apple (and only Apple) for further study. Last year, smartphones emerged from Pwn2Own unscathed even as their desktop counterparts took a beating, but this makes the third year in a row that Safari's gotten its host machines pwned. That said, there's no need for fear -- just a healthy reminder that the Apple logo doesn't give you free license to click links in those oh-so-tempting "beta-test the new iPad!" emails.
Charlie Miller to reveal 20 zero day security holes in Mac OS X
Say, Charles -- it's been awhile! But we're pleased as punch to see that you're back to your old ways, poking around within OS X's mainframe just looking for ways to remotely control the system, snag credit card data and download a few interoffice love letters that are carefully stashed 15 folders down within 'Documents.' The famed Apple security expert is planning yet another slam on OS X at CanSecWest, where he'll reveal no fewer than 20 zero day security holes within OS X. According to Miller, "OS X has a large attack surface consisting of open source components, closed source third-party components and closed source Apple components; bugs in any of these types of components can lead to remote compromise." He also goes on to reemphasize something he's been screaming for years: "Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town." In other words, Apple users are "safer" (due to the lack of work that goes into hacking them), "but less secure." So, is this a weird way of applying for a security job in Cupertino, or what?
Disgruntled auto salesman bricks cars with remote kill-switch
Over the years, a number of optional technologies have allowed new auto buyers to remotely disable and / or recover their vehicles after purchase, but these devices aren't always optional, and it might not even be the buyer who activates them. According to Threat Level, a man has been charged in Austin, Texas for allegedly hacking into the computer of his employer, Texas Auto Center, and activating WebTeck remote horn triggers and kill devices installed in over 100 cars owned by the company's customers -- all from the comfort of home. After Texas Auto Center reset the offending software's passwords and figured out what's what, the Austin High Tech Crime Unit quickly traced access back to one Omar Ramos-Lopez and made an arrest -- but for many, the damage (in terms of missed work, school and tow-truck calls) had already been done. Care to form an opinion? Read more about the crime, and WebTeck, at our source links.
Why Blizzard can't (and won't) sell gold
In any discussion concerning botting, farming, hacking, or gold-buying, someone inevitably makes the argument that Blizzard should cut out the middlemen and sell gold to players themselves. I wanted to use this article to explain why this would not necessarily be a good idea. We don't need to get into the legal situation, or examine why assigning a real-world price to in-game currency edges us closer to a world where in-game property can be taxed. All I have to do is tell you a story from the not-too-distant past that involves: Prices that would make Zimbabwe look like a model of inflationary restraint, and: What happens when money -- in this case, gold -- loses meaning.
