Feeds

Inept crackers stung by intended ‘victim’

Whacked by honey pot sting

  • alert
  • submit to reddit

3 Big data security analytics techniques

A small group of inept crackers fell into a trap set by the Honeynet Project, also featured by SecurityFocus, in which the attackers' own clumsy exploit became an ironic means of eavesdropping on their entire plan.

The wannabes, in addition to whacking several hundred machines, were in this case actually cracking a honey pot trap, a bait box set up to attract hack attempts and log information about the methods used to compromise it. Logs are usually diverted to another box, to prevent advanced crackers from finding and deleting them on the target machine.

A bot which the would-be crackers uploaded to the bait system, probably meant to give them permanent ops in an IRC channel which they frequented, logged their channel sessions for the intended 'victim'.

The transcripts of these sessions are a priceless document of the way semi-skilled crackers feel their way clumsily towards their goals. Honeynet re-named the two main crackers "D1ck" and "J4n3", and their crew "K1dd13", to express their contempt for the group's skills.

First we learn that the crew members either foolishly consider themselves to be quite sophisticated, as Honeynet assumes, or, as we suspect, are merely given to bouts of comic self-mockery. In any case, a few minutes' reading reveals that the crew, far from elite, are actually struggling to learn the basics.

Note: We have removed intervening comments in the dialogues for clarity.

:D1ck: i am making a elite archieve of sploits just for k1dd13 members
:D1ck: can u make pass protection on sites?
:J4n3: yeah i can make it password protected
:D1ck: make sure it's leet i dont want any other person other then u me m4ry mi||er and glitchX to have access
:D1ck: hehe
:D1ck: all leet stuff
:J4n3: y0 hooo
:J4n3: ha ha
:J4n3: d0n worry boss
:D1ck: hehehe

Later, crew-member "b0b" expresses considerable interest in learning to code in C. This, he reckons, will make the crew even leeter than it already is.

:b0b :what's vor-ticks-3?
:D1ck :A TROJAN
:D1ck :on receiving a string
:D1ck :on port 80
:D1ck :it opens a bind shell
:D1ck :like on a string 'asad'
:D1ck :it opens port 234323,
:D1ck :or some thing
:D1ck :hehehe
:D1ck :LOL

:b0b :btw, i'm going to be learning C soon too inshallah
:b0b :the[n] we'll have C fights
:b0b :yipeeee
:b0b :i'll insult you in code
:b0b :and once we develop m4d C skillz.. we'll develop D

Talk turns to the construction of a Web site for the crew, and the inevitable 'mission statement'. D1ck waxes political as he proposes the boilerplate:

"K1dd13 came into existance almost a year ago. It was born out of hate and contempt for violence, atrocities and human rights violations against Muslims, specially the affectees in Kashmir. It was precipitated to bring the attention of world leaders and organizations to the issue in cyberspace which is today the leading source of communication."

Other notable moments arrive when D1ck explains to J4n3 how to mount a drive, and again when D1ck and friend "Sp07" endeavour to figure out how to use a network sniffer.

Later, Sp07 asks D1ck "what time is it in pakiland," to which D1ck replies "6 am," suggesting that D1ck either is Pakistani, or has frequent occasion to know the time there. Thus it's hardly surprising when D1ck and J4n3 later muse about taking over Indian networks:

:J4n3: lemme own sum 1nd1an b0x3s and bring more bots :p
:D1ck: oye
:D1ck: scan indian servers for bind
:D1ck: 8.2
:D1ck: and
:D1ck: 8.2.1
:J4n3: am on windows right now
:J4n3: i'll do it later and make a log of it
:D1ck: 0h
:D1ck: okie
:D1ck: kewl

"Often you will see [the crew members] attempting to figure out the most fundamental of Unix skills," Honeynet notes. "And yet, they are still able to compromise or damage a large number of systems."

And that observation, more than any other, is the kernel of this morality tale. Cracking, as we have noted ad nauseum, is hardly brain surgery; so why is it that so many hotshot systems administrators and elite law enforcement authorities find themselves routinely humiliated by such inept Script Kiddies? ®

High performance access to file storage

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
It may be ILLEGAL to run Heartbleed health checks – IT lawyer
Do the right thing, earn up to 10 years in clink
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.