-2

In the news in the last 2 years, Anonymous/AntiSEC/etc... has been getting a lot of press for hacking high profile websites:

  1. PlayStation Network
  2. FBI
  3. CIA
  4. Bank websites
  5. Stratfor
  6. etc....

I'd like to know what the faults were for the server admins / developers, and how they got hacked - in an effort to make sure others don't repeat their mistakes. Can anyone fill in info about any of these?

I am NOT concerned with Denial of Service attacks...

1 Answer 1

1

There are quite a few methods, but the four main ones are as follows.

Open vulnerabilities are often to blame, either in the software running the website (Apache, PHP, IIS, etc) or the code (SQL Injection, buffer overflow, etc), or the operating system itself.

There's also the possibility of using an intermediary system such as an infected workstation or vulnerable firewall to access a web server that may not be as protected from threats posed by "trusted" systems.

Inside threats, from disgruntled current or prior employees, provide an attack vector that is extremely hard to defend against. This is especially true when the employee has a high level of access, such as a sysadmin.

Finally, social engineering can play a large part. Convincing someone over the phone that you need a password reset for "your" (wink, wink) account is a common one, but there are innumerable possible cons that can be run on an unsuspecting organization.

Sometimes it's a failure of the sysadmins, sometimes it's a business decision to not finance security, sometimes it's a matter of a stupid user or two. Against a determined, financed adversary, any system will eventually succumb. It's just a matter of time because there is no such thing as perfect security.

If you want a nutshell answer to how to be safer: Keep all software up to date with the latest security patches, review all in-house code, train all your employees, and limit the amount of access to what is absolutely needed by employees and systems. Hiring competent people (technical or not) and treating them well also helps immensely.

1
  • SQL injection is only made possible by negligent and infantile programming by not encapsulating parameters, and is inexcusable (IMHO). Buffer overflow exploitation ought to be impossible if code (and compilers) are properly written, but they are a statistical fact because humans are involved and can't think of everything. Defensive programming considers every line of code for exploitation as it is being written, but takes extra time and money. As there is often so much pressure to deliver something working ASAP, short cuts are inevitable and can remain unnoticed and unpatched. Dec 26, 2011 at 21:08

Not the answer you're looking for? Browse other questions tagged .