Tag Info

Hot answers tagged

28

My 2cents here: While not technically illegal these companies have managed to develop malware and exploits, without anyone bugging them, because they sell them to governments, law enforcement agencies, secret services, organizations and, in case of some of the companies, to anyone else interested. Such companies include: VUpen Paladion More information ...


27

I can't comment on the actual job scene, but I do know a bit about the statistics of cybercrime. In terms of financial gain, the stats are quite interesting. In terms of profit, the top three are as follows: Pay-per-click advertising fraud - Wasn't so much of a profit-maker until recently, but blackhats seem to have focused on this method more intensely ...


25

Here is one method of purchasing a domain name pretty close to anonymously. Use Tor. Understand its weaknesses Buy a prepaid credit card in cash, specifically one not requiring activation or signature. Randomly generate a full alias to use during online registration. Register an account at a domain registrar. Use the prepaid credit card to buy a domain. ...


13

$2500 is all it takes to get a black-hat operation started In 2009, it was reported that US banks lost more than $140M from Internet heists, as quickly as $10M in one 24-hour period. I believe it is possible to start a criminal operation with as little as 2500 US dollars. Cloud servers: 300 US dollars for 3 months LAMP stack: 0 US dollars Malware that ...


13

One option not mentioned here is espionage. Patriotism or corporate funding could be part of the reason you might end up in espionage. Corporate As a espionage contract worker you could charge a pretty high fee for doing any of a number of different black hat operations. Stealing, corporate information (design plans, blackmail, corrupting data, stealing ...


11

C6C server are often servers that got hacked, not servers rented by the attacker. Security support contracts For public organisations there are often CERTs (computer emergency response team) responsible for them. For example there is the DFN Cert for all Germany universities. Large companies tend to have support contracts with companies specialized in ...


7

There is a handy tool called prey that allows you to track your devices (laptops, tablets and smartphones) and reports back to you. If your device becomes missing you tell prey and it jumps into action. The device begins trying to 'phone home' and will report its IP and geolocation information. In the case of smartphones or laptops with built-in gps it ...


7

I don't know for certain how Lulzsec bought their domain but some domain suppliers will accept bitcoins as payment. Bitcoins are an anonymous payment method used by many websites. I know it is also possible to purchase domains anonymously even through well known hosting providers such as Go-Daddy. The way it works is that the registrar will put their ...


7

Yes, a lot of these sites are so badly configured that they store the passwords in plain-text. Or, when passwords are stored as encrypted hashes, the hackers are releasing easily decrypted passwords. Actually, only in the case of the NewsCorp hack did Anonymous decrypt the passwords, other than that, they've simply been publishing the password hashes: the ...


7

Because it's easy. And accessible. Firesheep didn't create any new technology, and noone claims it did. But the point is, it has now become extremely easy to view and spoof others identities, and it is very accessible to almost any user (well, any user that can download and install Firefox and Firesheep plugin...) It's really just a question of ...


6

I'm afraid shopping questions are offtopic for here, however some advice: A keylogger is not a locator - what you want to google for is a locator/phone home/remote control/remote wipe application The application itself will not have gps - you need a physical gps receiver to do that - but if it can report its IP address that may help, and some can hook into ...


6

Like NlightNFotis's answer, there are a number of companies writing legal malware for governments, which are vendors at the ISS World Training. I documented them here: http://0xdabbad00.com/2011/12/10/legal-malware/


6

I would imagine most of the money would be in organized crime rings, operating botnets to distribute malware. From there they can attack individual bank customers to steal money or setup mule accounts. They could also rent out their botnets to others do to distributing computing. Probably a lot of spyware is still out there, maybe you inject your affiliate ...


5

They can gain access to such information through a combination of techniques. First of all, they can easily do online searches about a person. You will be surprised how much information can be glimpsed about a person just from his Facebook, Twitter or other social networking sites. Google, and other dedicated "people-finder" search engines like Pipl can ...


4

In addition to what Eric has said, there is another money generating field out there - coding custom malware. An example is of this guy - Tataye - author of the famous Beast Trojan. He is now selling his work for monnies at http://www.spytector.com/. Another example is this guy - http://www.nuclearwintercrew.com/Buy-Princeali/ Sky is only the limit if you ...


4

Let's suppose, just for a minute, that the Anonymous folks are connecting to Twitter through a VPN based in a jurisdiction that doesn't cooperate with US law enforcement, a chain of open proxies in different countries and an anonymous tunnel through Tor. What information do you think Twitter can give the FBI that will be of any use to them?


4

As I understand it, the majority of the compromises from LulzSec, Anonymous, etc. are SQL injection. HBGary, Sony, Apple... they all fell because of SQL injection flaws in their web apps. http://www.google.com/search?q=anonymous+sql+injection Sometimes the passwords are plaintext, sometimes they are hashes that are pre-cracked by the group, and sometimes ...


4

Now that we've all agreed we're all speculating... There has been a small but significant trend in which whitehat intrusion into or onto clearly malicious infrastructure has been treated as permissible, necessarily expedient, or - uh - "look-the-other-way-able". We saw it several months ago when the US government took control of various domain names. I am ...


4

Interestingly, based on the team I ran for the last couple of years, a million could happily fund a reasonably successful attack on any major corporate entity, government department or agency. The $10M heist that atdre referenced cost the attackers around $180k, based on some reasonable assumptions on the payoffs to the team including techies, mules, grunts ...


4

Partially anecdotally - it does look like barring a handful of exceptions, the only big winners in this business are the organised crime gangs, who are in a position to use skilled exploit writers, hackers, social engineers etc to create money makers. While some of these exploit coders get paid reasonably well (for example the blackhat exploit market pays 5 ...


4

As I recall cyberlaw is pretty up in the air as it is a newer issue. The biggest issue, at least in the US, is proving that it actually was that person behind the keyboard. IPs can be spoofed, pseudonyms are just that pseudonyms, and intellectual property law is fairly unrefined as well. Also the hacker needs to be an adult or have committed a crime on a ...


3

The following papers gives a good insight on how blackhats protect themselves from their adversaries. How to cover your tracks - The Hackers Choice Phrackerz: Two Tales - Antipeace & The Analog Kid Enjoy the reading :)


3

The official statement says, "McAfee has gained access to one specific Command & Control server used by the intruders." It would seem extremely likely that they were brought into the picture for analysis by someone with access to the C&C server considering the implications the alternative (McAfee turning black hat) would have to their company. If ...


3

So there is nothing you can do about his activity, except to ignore it as the comments suggest. What you can do, is to re-evaluate your security practices, and make sure your house is in order in case he decides he wants to try to do some digital damage, to ensure you're as well protected as can be. This means: Choose strong passwords. Don't reuse ...


2

To be honest with you... one does not need to be a "hacker" to find those things out. I guess what most people, including PIs, do is simply look up publicly available data, call landlords, etc. And the problem is, although you can try to lock down your social network data etc. you never will be able to control the data that you gave away. They might call ...


2

Domain registration requires payment and for this by far the most common payment method used is credit card, which will pass through the name and address of the owner of the card. But there are a number of other payment options available which enable an anonymous payment, including the humble money order. There are registrars which specialise in taking money ...


2

I don't know of any law journals on this matter, as I am not a lawyer, but it appears that this involves all the procedures related to evidence in a civil lawsuit. The sorts of resources that would be applicable would depend on the venue. For example, let us say that I file a civil lawsuit via Federal diversity jurisdiction. Then, 28 USC controls the ...



Only top voted, non community-wiki answers of a minimum length are eligible