Feeds

Inept crackers stung by intended ‘victim’

Whacked by honey pot sting

  • alert
  • submit to reddit

Intelligent flash storage arrays

A small group of inept crackers fell into a trap set by the Honeynet Project, also featured by SecurityFocus, in which the attackers' own clumsy exploit became an ironic means of eavesdropping on their entire plan.

The wannabes, in addition to whacking several hundred machines, were in this case actually cracking a honey pot trap, a bait box set up to attract hack attempts and log information about the methods used to compromise it. Logs are usually diverted to another box, to prevent advanced crackers from finding and deleting them on the target machine.

A bot which the would-be crackers uploaded to the bait system, probably meant to give them permanent ops in an IRC channel which they frequented, logged their channel sessions for the intended 'victim'.

The transcripts of these sessions are a priceless document of the way semi-skilled crackers feel their way clumsily towards their goals. Honeynet re-named the two main crackers "D1ck" and "J4n3", and their crew "K1dd13", to express their contempt for the group's skills.

First we learn that the crew members either foolishly consider themselves to be quite sophisticated, as Honeynet assumes, or, as we suspect, are merely given to bouts of comic self-mockery. In any case, a few minutes' reading reveals that the crew, far from elite, are actually struggling to learn the basics.

Note: We have removed intervening comments in the dialogues for clarity.

:D1ck: i am making a elite archieve of sploits just for k1dd13 members
:D1ck: can u make pass protection on sites?
:J4n3: yeah i can make it password protected
:D1ck: make sure it's leet i dont want any other person other then u me m4ry mi||er and glitchX to have access
:D1ck: hehe
:D1ck: all leet stuff
:J4n3: y0 hooo
:J4n3: ha ha
:J4n3: d0n worry boss
:D1ck: hehehe

Later, crew-member "b0b" expresses considerable interest in learning to code in C. This, he reckons, will make the crew even leeter than it already is.

:b0b :what's vor-ticks-3?
:D1ck :A TROJAN
:D1ck :on receiving a string
:D1ck :on port 80
:D1ck :it opens a bind shell
:D1ck :like on a string 'asad'
:D1ck :it opens port 234323,
:D1ck :or some thing
:D1ck :hehehe
:D1ck :LOL

:b0b :btw, i'm going to be learning C soon too inshallah
:b0b :the[n] we'll have C fights
:b0b :yipeeee
:b0b :i'll insult you in code
:b0b :and once we develop m4d C skillz.. we'll develop D

Talk turns to the construction of a Web site for the crew, and the inevitable 'mission statement'. D1ck waxes political as he proposes the boilerplate:

"K1dd13 came into existance almost a year ago. It was born out of hate and contempt for violence, atrocities and human rights violations against Muslims, specially the affectees in Kashmir. It was precipitated to bring the attention of world leaders and organizations to the issue in cyberspace which is today the leading source of communication."

Other notable moments arrive when D1ck explains to J4n3 how to mount a drive, and again when D1ck and friend "Sp07" endeavour to figure out how to use a network sniffer.

Later, Sp07 asks D1ck "what time is it in pakiland," to which D1ck replies "6 am," suggesting that D1ck either is Pakistani, or has frequent occasion to know the time there. Thus it's hardly surprising when D1ck and J4n3 later muse about taking over Indian networks:

:J4n3: lemme own sum 1nd1an b0x3s and bring more bots :p
:D1ck: oye
:D1ck: scan indian servers for bind
:D1ck: 8.2
:D1ck: and
:D1ck: 8.2.1
:J4n3: am on windows right now
:J4n3: i'll do it later and make a log of it
:D1ck: 0h
:D1ck: okie
:D1ck: kewl

"Often you will see [the crew members] attempting to figure out the most fundamental of Unix skills," Honeynet notes. "And yet, they are still able to compromise or damage a large number of systems."

And that observation, more than any other, is the kernel of this morality tale. Cracking, as we have noted ad nauseum, is hardly brain surgery; so why is it that so many hotshot systems administrators and elite law enforcement authorities find themselves routinely humiliated by such inept Script Kiddies? ®

Internet Security Threat Report 2014

More from The Register

next story
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Lords take revenge on REVENGE PORN publishers
Jilted Johns and Jennies with busy fingers face two years inside
Yes, yes, Steve Jobs. Look what I'VE done for you lately – Tim Cook
New iPhone biz baron points to Apple's (his) greatest successes
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.