EwtNet

Tag: Hacking

  • Mitchell Frost Explains his Motivation as a Hacker

    Mitchell Frost Explains his Motivation as a Hacker

    IDG NEWS SERVICE – In 2006, Mitchell Frost, then a 19-year-old college student at the University of Akron, used the school’s computer network to control the botnets he had created. Authorities say between August 2006 and March 2007, Frost launched a series of denial of service (DDOS) attacks against several conservative websites, including Billoreilly.com, Anncoulter.com and Rudy Giuliani’s campaign site, Joinrudy2008.com. He is accused of taking down the O’Reilly site five times, as well as disrupting the University of Akron’s network during a DDOS attack Frost allegedly launched on a gaming server hosted by the university.

    Frost’s dorm room at the university was raided in March 2007. What followed, according to Frost, was a long, complicated legal battle that ultimately lead to him spending over two years behind bars and owing thousands of dollars in legal and restitution fees for his crimes. Frost was released from prison in 2012 and is now serving probation.

    Frost took the time to talk to CSO about his experience and delves into the reasons why he did it, his thoughts on the punishment he received and his plans for the future.

    Tell us about your background. How did you become so knowledgeable about computers and when did hacking become something that interested you?

    I started on computers around a young age and I have always had a mind that wants to keep exploring and learning. Hacking didn’t start overnight, it all started by networking really. First I wanted to be able to have music without paying for it, so I joined some chat rooms on IRC (Internet Relay Chat). IRC is not used much, it’s typically used only by smaller groups of hackers and gamers. When I was younger I would spend many hours in a row on the computer, and when I woke up or had free time, just continue on with what I was working on. You build skills and make connections with others and keep moving up until you have background in hacking. Let’s just say I built my way up over the years 2000-2007.

    What inspired you to do the kind of hacking you did in 2006 and 2007 to those conservative websites? What were you hoping to accomplish by hacking those particular sites? How did you choose your targets and why?

    In 2006, I was young and, even at that age, I could see there was a lot of corruption and media propaganda going on in newspapers and on television. At that time, I had a rather large and complicated botnet. With the botnet, I was able to use the compromised computers for almost anything; key strokes, DDOS, servers, passwords, pranks. I had several botnets over the years from a few to thousands and didn’t do a whole lot of DDOS on servers because I had no need to.

    I decided that I had to do something about what I was seeing in the world around me, so I knocked a couple of websites offline at the time thinking it will prevent the hate and conflict and fear mongering from being seen by people.

    When it became clear you were going to face punishment for the attacks, did you think it would mean jail time?

    They raided me in March of 2007 right after spring break. They took some computer stuff and took my roommate’s stuff and had three agencies do the raid (FBI, Secret Service, Homeland Security) all with guns pointed right at my head. They brought me into a room and said “if you help yourself now it will be easier at sentencing.” I didn’t answer any questions. They released me and didn’t say much. I was scared shitless after that. I didn’t know what to do. I remember now going to a class after the raid to take a math test and was shaking so bad.

    About one day later, they expelled me from the school, even though I was not charged with anything yet. I moved back home and then contacted the Federal Public Defenders office in Cleveland and was assigned a lawyer. He said cases like mine take time and to stay out of trouble and he would get back to me.

    I moved back home and got a job working as a carpet-cleaning technician. From 2007 and on, I tried to live a normal life but had that fear that something was coming. I ended up meeting my wife. We fell in love and she got pregnant in December of 2009.

    Around May of 2010, my lawyer said I randomly received a judge and that it didn’t look good because of her previous sentencing history. I was hoping for maybe a small amount of time or probation, considering I did not get arrested at the time of the raid in March 2007 and had not yet. I was living in fear for almost 4 years, not going to friends or out to parties and all that.

    The judge ended up giving me 30 months and tried to place me under arrest right at the sentencing hearing. When she did this, it took the prosecutor and my lawyer to walk up to the bench and say I am not a flight risk with a newborn on the way and I knew about these potential charges for three years, so why couldn’t I self-report? She finally agreed to let me self-report so I can tie up some things with my family before my time.

    There was some debate after your sentencing about whether or not the penalty was too harsh. Do you think it was too extreme?

    Way too extreme. Who was the victim? Yes, a couple of people had their servers down for a small period of time, but the jacked-up estimates of the damages were over inflated. Example: they said it took $10,000 for them to press one button on one switch to get access back to the network. The reasoning for the sentence has to do with amount of money lost, etc. Bill O’Reilly said he needed to spend $300,000 to upgrade his systems. My lawyer did not fight or really look into their claims of money loss.

    I think they should of come to some plea with me within a year of the initial raid so I could of dealt with this problem and moved on with my life. Maybe do 3-4 months in some low-security prison and some intensive probation would have been the same. Now it will end up costing me about 10 years of my life—2006 started it and by the time I’m off probation it will be 2016. All for taking some servers offline. You tell me: is that fair?

    What has this experience taught you?

    The experience is not over yet and is far from. I have learned to keep to myself when I see something unjust or unfair or unbalanced all I can do is stay clear of it and talk to people I know or influence and explain my point of view without any damages, physical or monetary.

    Last year, there was a lot of sadness and discussion around the suicide of Reddit co-founder Aaron Schwartz. As you know, Schwartz was facing a trial after being arrested on allegations of breaching a computer network to download millions of pages of documents kept at MIT. Many feel he was being too harshly prosecuted for the crime and it drove him to suicide. What are your thoughts on that, having faced a sentence yourself?

    I am very familar with Aaron Schwartz. Did you know he chose to take his case to trial because he was not guilty? He was murdered and it was made to look like a suicide. Who would ignore a plea deal with no jail time, wait for trial and then commit suicide? All he did was download some stuff from the MIT library—most of it was like 30 years old. He was prosecuted because of his ties to a grassroots movement for Internet freedom.

    What’s next for you? What are you plans for the future?

    I am rebuilding my life the best I can for having limited resources. I was released Election Day 2012. I was stuck living in a halfway house in the slums of Toledo, Ohio. Then I had to go up the chain of the BOP and the halfway house to get released to home detention. That took about 2.5 months.

    I started probation on March 8, 2013. I work at a small store in a town where my wife’s parents let us live in a rental, so we pay them what we can. I pretty much cannot go to school because I owe so much to U of Akron and I have $50,000 in fines and restitution. They take a percentage of my pay each check to give to Bill O’Reilly. I guess when you’re worth $50 million, why not ruin some guy’s life and future and suck every check he makes?

    I guess my life is not going anywhere until I am off probation. I would like to be a wireless network security consultant, or a real news reporter for the independent media. I will continue to try and make my son and wife’s life the best I can for the position I am in.

  • Skype’s social media accounts hijacked by Syrian Electronic Army

    Skype’s social media accounts hijacked by Syrian Electronic Army

    Skype said its social media properties were targeted, with a group styling itself as the Syrian Electronic Army appearing to claim credit for the hacks.

    ”You may have noticed our social media properties were targeted today,” Skype said in a Twitter message late Wednesday. “No user info was compromised. We’re sorry for the inconvenience.”


    Skype’s Twitter account, blog and Facebook page appeared to have been attacked by the SEA, a group that supports the Syrian government, according to reports. The Skype blog was still inaccessible late Wednesday and redirected users to the Skype homepage.

    The SEA reproduced in a Twitter message a copy of what appeared to be its message using the Skype account on Twitter. The message read: “Don’t use Microsoft emails(hotmail,outlook),They are monitoring your accounts and selling the data to the governments.More details soon #SEA.” It did not figure by late Wednesday on Skype’s Twitter feed.

    SEA later posted on Twitter contact information purportedly of Microsoft CEO Steve Ballmer, stating: “You can thank Microsoft for monitoring your accounts/emails using this details.”

    The attack on Skype’s social media accounts appears to be linked to disclosures through newspapers by former U.S. National Security Agency contractor Edward Snowden that Internet companies allegedly provide the agency real-time access to content on their servers for surveillance purposes.

    The SEA has targeted previously many high-profile websites and Twitter accounts. In August, an attack purportedly by SEA on Melbourne IT, an Australian domain registrar, affected the websites of The New York Times, Twitter and other top companies.

  • Anonymous stumbles, but hackers still hazardous

    Anonymous stumbles, but hackers still hazardous

    It hasn’t been the best of months for Anonymous, the loose hacktivist collective that likes to view itself as the most potent threat on the Web to big government, big business, and those who do not share its views on pretty much anything — law enforcement, the environment, internet freedom, copyright laws, politics etc. Several of its recent claims have been exposed as not just inflated, but outright fabrications.

    FBI hack refuted

    Earlier this month, AntiSec, an offshoot of Anonymous, posted more than 1 million Apple Unique Device Identifiers (UDID) to Pastebin, and claimed it had stolen more than 12 million of them from an FBI agent’s laptop in March.

    The group claimed to have personal mailing addresses and phone numbers besides the UDIDs, plus device tokens for the Apple Push Notification Service (APNS) for numerous types of Apple devices such as iPhones, iPads and iPod Touches.
    The FBI immediately denied that any of its computers had been compromised. Apple said it had never provided UDIDs to the FBI. And, as Michael Mimoso noted on the Kaspersky Labs blog Threatpost, David Schuetz, a senior consultant with Intrepidus Group, found that the real source of the breach was BlueToad, a Florida based technology provider for digital publishers.
    “[Schuetz] found a password dump online for BlueToad dated March 14, the same week AntiSec said it had breached the FBI computer. Any hesitancy Schuetz had regarding BlueToad’s connection to the breach was evaporating,” Mimoso wrote.
    Earlier this week, BlueToad CEO Paul DeHart publicly confirmed via the company’s blog that it was the source of the breach, that it had contacted law enforcement and was cooperating in the investigation.

    GoDaddy’s outage claimed

    There was also the recent boast by Twitter user @AnonymousOwn3r that he had shut down the website provider and domain name registrar GoDaddy on Sunday with a distributed denial-of-service (DDoS) attack.
    Wrong again, said GoDaddy interim CEO Scott Wagner, who explained on the company website that the problem was a “service outage due to a series of internal network events that corrupted router data tables.”
    [Slide show: Anonymous and LulzSec – 10 greatest hits]

    Then there was the claim last month that Anonymous was looking to break into the communication system between NASA and the Mars rover Curiosity.
    That didn’t even pass the laugh test for most security professionals, who viewed it as a bad joke or a weak attempt at trolling.
    Last March, LulzSec, which operated under the Anonymous umbrella, after the FBI arrested and then flipped its leader, Hector Xavier Monsegur, who went by the hacker name of “Sabu.”
    Does all this mean that the Anonymous brand has been undermined? Do its boasts and threats have any credibility in the security community?

    Anonymous uneven

    Yes and no, say those who track its exploits. Most agree with Cole Stryker, an author who has researched Anonymous and who The New York Times quoted describing it as “a handful of geniuses surrounded by a legion of idiots.”
    Those idiots, say experts, are going to make a host of errors and laughable claims. But that does not mean there is no danger from the core group.

    “What we have here is a bunch of kids, largely in UK and here and dozens of other places such as Brazil, Turkey, Iran, China, Ukraine, Romania and lesser numbers in other places across the planet — a bunch of really bored kids who want to be a part of something, but have no clue,” said Kevin McAleavey, cofounder of the KNOS Project and a malware and hacking expert.

    “How seriously do I take Anonymous’s claims? About as seriously as I take ‘The Daily Show,’” he said. “Yes, there are a handful of really dangerous people who those kids admire and who occasionally feed them a breath mint. One or two of them have already been apprehended. The rest have gone back to collecting exploits and writing malware, and selling them to criminals and government spooks for real cash. They won’t touch Anonymous any more because the heat is too high.”
    Nick Selby, a Texas police officer and information security consultant who runs a police-led intelligence blog, noted at the time of the LulzSec bust that there is essentially no barrier to claim membership in Anonymous. “It doesn’t require massive technical skills — just reasonable knowledge and a willingness to break the law,” he said.
    But Aaron Cohen, founder of the Hacker Academy, said he thinks it would be foolish to discount the group’s skill and power. He said he has a hard time talking about Anonymous, “because we don’t know who they are. People are out there doing things under the name of Anonymous, but you don’t really know if that’s true.”
    Cohen said the whole idea of an Anonymous brand misses the point. “They’re not looking for branding,” he said. “They’re doing it under a pseudo name. There is no call to arms to get somebody. But if one person says they’re going to get a company, then everybody tends to rally around that person.”
    But Cohen adds that he thinks Anonymous has been “pretty reliable so far,” in both its claims and its threats. And he said whether it is Anonymous or some other group, good hackers are proof that “if people want to break into something badly enough, they can.”
    “So if you’re a target, it’s best to tighten up,” he said.

  • How to Protect Your Social Network Accounts from Hackers

    How to Protect Your Social Network Accounts from Hackers

    A tech journalist learned a tough lesson recently. But using two-factor log-ons help guard your Google, Facebook, and Twitter accounts from being hijacked. If you haven’t read about Wired reporter Mat Honan’s ordeal at the hands of malicious hackers, take some time and read it now. (I’ll wait.) His story about how a passel of juvenile hackers managed to get into his Apple account and wipe all the data off his iPhone, iPad, and Mac— as well as hijack his Google, Twitter, and Amazon accounts – should be required reading for anyone who uses those services, and especially those of us who’ve blithely linked our social media accounts together using the same e-mail address. Honan didn’t do anything to tick those hackers off. He was targeted simply because they coveted his @mat Twitter handle. Which means that the same thing could happen to you or me just as easily, and we wouldn’t know we’d been jobbed until far too late.
    One thing Honan notes with regret is his failure to turn on two-factor authentication for his Gmail account. If he’d done that, anyone who tried to access his e-mail would have also had to enter a six-digit PIN, which is randomly generated and sent via text message to his phone.
    So your first order of business for today: Setting up two-factor authentication for Google. To do that, you’ll need to go into your Gmail Settings (it’s the icon that looks like a little gear in the upper right corner of your inbox). From there:

    1. Select Settings, then Accounts and Import.
    2. Under Change account settings select “Other Google Account settings”.
    3. That will take you to a Web page for your Accounts. Select Security from the left-hand menu. You may be prompted for your password again.
    4. Under “2-step verification” you’ll see “Status: OFF.” Click the Edit button next to that. That will take you to a Web page wizard that will walk you through the process of having a six-digit verification code sent to you via text or a robo-call.


    Enter the code into the appropriate box, and you’re all set – for that device, anyway.
    Admittedly, this is not as easy as simply using a password. You’ll have to do this for every device and every application that uses your Gmail logon, and every device and application doesn’t work exactly the same way. For example, I was able to log on to Gmail using a PIN on my desktop, laptop, and iPad, but not my Android tablet or Windows smartphone. For those, I had to set up separate one-time-use “subtokens” that look something like this: fztz dgpm oxfi uthb.
    You’ll need to go back to the Accounts Security page and select the Edit button next to “Authorizing Applications and sites” to set up disposable passwords for each device and app. You can also use this tool to manage your list of trusted devices and applications, and revoke access to them at any time.
    So that covers Google. What about Facebook? Here, too, you can beef up your security settings with two-factor authentication. This will prompt you to enter a similar SMS code whenever you log onto Facebook from a new device. The drill is remarkably similar:

    1. Go to your Facebook Account Settings page (found under the down arrow next to the Home tab).
    2. Select Security from the menu on the left.
    3. Under “Login Approvals” click edit and put a check in the box that appears (see below). You may have to adjust your browser settings to accommodate the cookie that Facebook wants to deposit.
    1. In the dialog box that appears, click “Set up now.” You may be prompted again for your Facebook password and to add your mobile phone number if you haven’t provided one already.
    2. Click Continue. If you’ve done this correctly you should receive a six-character PIN. Enter that and the name of your device into the dialog boxes that appear.

    Like Google, this won’t work with every device or application Facebook supports (like the Xbox or Skype). So again you’ll have to generate a disposable app password, which you can do via the same Security Settings dialog box. If you have an android device, you can download a free Code Generator app that can produce usable passcodes without having to send you a text.
    Twitter does not offer two-factor authentication at this time. But you can make it harder for attackers to reset your password by changing a setting in your profile that requires you to provide additional info, such as an e-mail address or phone number, when requesting a new password.
    From your Twitter profile page, click Edit your profile. Then go into your Account settings, scroll to the bottom, and put a checkmark in the box next to “Require personal information to reset my password.”

    The flaw in all of these schemes: If the attackers manage to get hold of your phone as well as your log-ons. Then, my friend, you’re totally screwed.
    Credits:
    For more computing news, visit ITworld. Story copyright © 2011 ITworld Inc. All rights reserved.