Internet insecurity

Anonymous is legion.

"Anonymous, a hacker collective that has gained global notoriety for penetrating the networks of credit-card companies and other organisations"

This is incorrect - certainly, Anonymous as a whole never gained access to any credit card networks, they merely launced a DDoS attack, slowing down their website and transaction traffic. Any claims otherwise were unfounded boasting and scaremongering, as such a feat would be impossible to accomplish by the vast majority of Anonymous, who are regular computer users, merely running DoS programs designed by more knowledgable members.

This break in a security platform represents the ongoing challenges we as security professionals face. Security is an ever changing and adjusting technology for whereby organizations, standards and technology need to change as the threat model increases. As we see with many breaks of a security model, our enemies are mounted in force with the sole intention of capturing information, data and records for financial gain, political strength or espionage. It’s almost sounds like a Hollywood movie, but, the real world is seeing the battles moving to the network vs. the battlefield.
Standards have emerged to allow international peers to do a security review of a solution that can be more resilient and have a broad interest in preventing the most damaging threats. In the case in point, such organizations as the Trusted Computing Group (TCG), have developed security standards that have now been enabled in devices such as Trusted Platform Modules (TPM’s), Secure Encrypted Drives (SED’s) products. The distribution and availability is broad and deep, and these products have the security algorithms imbedded in hardware which creates a 1 to 1 attack profile vs. a broad secret model as we see in this report. Meaning, I as a hacker need the machine in my possession and then I need to crack the silicon chip and steal its secrets which if successful, highly unlikely, will only allow me the hacker to learn information on that single machine.
As a previously wise decision, layering security has always been a good idea, and now it’s a “Best Practice”. Using the TPM as the root of trust with appropriate software as a solution is what is needed this allows management of a user’s machine, their credentials and data access as rooted in hardware vs. software. The result is; only known users and machines can access the network, data and user privacy. Yes, we should look for new way and use the 500 million TPM’s, several million SED’s and move away from old security paradigms.

@Resolving Unfair Business I find it interesting that so many are attacking the "hackers" and not commenting on the bigger problem. Systems that are insecure.

Granted that a lot of companies do a terrible job on security of their software. But this sounds like you are focusing on blaming the victim.

It is as if you fault me for being mugged, just because I made the mistake of carrying some money with me. Granted, it might have been a poor decision on my part. But that doesn't excuse the mugger of his crime.

chinaeagle:

Out of all my post, you ignore everything but one phrase, and you distort what I meant by that. This smells like a desperate attempt to change the subject.

As to the phrase you replied to: I never said that "the rest of the world" was only the US and Europe. I said that the rest of the world was too smart to fall for your propaganda. You replied by listing countries were you didn't think I knew what was going on. Does that make them children? Easily deceived? Easy prey for manipulation? I don't think so.

@ John Eh:

"If some bored teen in LA is caught hacking into Walmart's credit system, why not blow LA off the continent with a dozen or so ICBMs? "

Misplaced sarcasm, it is. Several generations of Western youth are raised assured by the lefty liberals who hijacked the childcare and education areas that there is no responsibility for whatever - in their boredom - it occurs to them to do, short of murder. The mantra of educationalists (likes of the ex-terrorist and presidential buddy Bill Ayers) is that crime it's society's, not perpetrator's guilt.

But it's a lie; a bored teen from LA hacking into Walmart's credit system is committing felony - he should go to the stir for several years; surely he'd be less bored there.

@ Resolving Unfair Business:

"There is no way the fact companies and governments are using, and continuing to use, insecure systems is the fault of the hackers. Companies and governments have made the choice to not put the necessary resources into securing their systems."

You're talking porkies mate. If someone chooses not to lock his door, he's a fool, but this doesn't make an opportunist who stole his stuff less criminal. So I say jail the brats who think it's funny to creep into people's life and pinch their property.

Not to nitpick but Sony Pictures is more or less an American company, despite its Japanese parent.

@Realities:

Quite so. I hear those LulzSec folks are actually backed by a longtime nemesis of Anonoymous -- those shady characters from Ebaumsworld.

Are we allowed to post URLs? There's a rather succinct review of the PSN hack that's been floating around, copy of English translation (Warning: Contents not entirely respectful of Sony Products):
http://www.notcliche.com/lbw/whole-sony-vs-anon-psn-issue-explained-in-4...

Sometimes I wonder if hackers are not in the payroll of the anti-virus & web security providers?? Keeps them in business & a very lucrative & grqwing one at that. Hmmm..

@ zerge

"And discovering the identity of this hacker is nearly impossible."

I don't buy it. Especially with the technology that Pentagon and NSA, let alone Google, have at their disposal.

That is, assuming they want to get these guys! And more importantly they can DO something about it.

Either these are just a bunch of amateurs with nothing else to do in which case it's embarassing for Google but DoD has better things to do. Or these are pros who are either very well connected within the system or have been hired by official agencies. In which case I'd think DoD can't touch them. I mean we are not talking about a bunch of goat herders in South Waziristan! Of course they can "get back" in other ways.

Allow me to explain how it works:

1.- China has millions of computers using bootleg software. This software, being illegally obtained, hardly ever gets updated.

2.- As time passes, vulnerabilities are found in software. If the software is not updated ("patched"), it becomes easy to hack.

3.- A hacker sitting anywhere in the world hacks a Chinese server with unpatched bootlegged software and takes control of that server.

4.- The hacker, who again, can be anywhere in the world connected remotely to the Chinese server, launches all sorts of attachs from that Chinese server with a Chinese IP.

5.- The victim sees the attack coming from a Chinese IP, and assumes, wrongly so, that the attacker is Chinese.

This doesn't mean that China doesn't do cyberattacks. what it means is that the geographical origin of an IP tells us absolutely NOTHING about the nationality of the hacker. And discovering the identity of this hacker is nearly impossible.

anonymous FTW!

The 'notion' that the Pentagon floats about the internet and acts of war is just bizzare. Why, simply, do we put sensitive data on the internet, when it is impossible to police the internet, because internet protocol keeps changing all the time? A time will come, when internet protocol will be able to be changed at unbelievably short periods of time. Trust the capitalists to want to make their businesses more easy to run, to make more profits, on the information super-highway.

Internet is inherently unsafe! Never expect intenet become safe. If you use webmails (such as gmails, hotmails, etc.) and cloud service, and expect safe and privacy, you are an idiot! In Internet, there is no such thing. Use with discretion.

You have not mentioned the little guy at home whose computer becomes inundated with tracking cookie sand other infestations such as trojans and worms.

On each of two successive scans my Internet security suite found over 50 tracking cookies. The manufacturer now has updated their product and SO FAR it seems fine.

Even downloading innocuous software is a hazardous undertaking.

I use my machine for serious research and reading.

Those who visit porn sites should be warned and have only themselves to blame

When I send a e-mail to several, I receive a notification of "This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

ceshixinxiang2@hotmail.com

"
But this address in not in my mail list. I think that this is an intrusion by some "hacker" or inteligence office. Is this related to China?. I dont know. Mi activity is to write political notes on finance crisis, and economic theory. Very hard. Internet is transparent for inteligence services. , now I write my e-mails conscient of intrusión for inteligence units in USA, UK, France, China, Israel, Libya, and Haiti

Most data breaches originate inside the same companies.

When? How?

Companies outsource everthing: payroll, accounting, marketing, and... above all... collection of accounts receivable. Contractors are routinely given entire databases of employees, customers, suppliers, etc. And it's not rare that a contractor's clerk copies the database and sells it around.

In addition, many companies routinely sell their databases to advertisers. That's how they make money these days.

So, if you want names, emails, phones and credit card numbers of Sony Playstation users, you don't need to infiltrate Sony's web site. Istead, you go buy the database from any of Sony's trusted partners.

Hacking is just for people who insist in taking the long road.

#2H6JyFJkHX:

I know an Anonymous member(I won't tell his account name as it should remain Anonymous) and he has told me that this "LulzSec" is no subdivision of Anonymous. In fact, he condemned their release of personal information for the million Sony Music users. He also told me that Anonymous and "LulzSec" actually hate each other.

We should just try to end the attacks on Sony and bring "LulzSec" to justice.

@rewt66

"For that matter, the rest of the world is also too smart to believe it."

I often find that Westerners seem to have very little knowledge about the term "WORLD". When you say "the rest of the world", does it include Russia, Brazil, Pakistan, North Korea, Myanmar, Cambodia, Iran, Nigeria, Thailand, Kazakhstan, Turkmenistan, Turkey, and many other countries? I just want to let you know a simple face: there are many countries in the world. The U.S. is not a "world", neither is the U.K. or Europe.