Feeds

Feds: Hospital hacker's 'massive' DDoS averted

Arrest foils 'Devil's Day' scheme

Next gen security for virtualised datacentres

GhostExodus outed

In some respects, McGraw's hacking regimen bordered on the paranoid. He kept a webcam over the outside door to his one-bedroom apartment so he'd know in advance when someone was calling on him. But otherwise, court documents portray someone who was sloppy in covering his tracks. The picture on a fake FBI credential he showed in one video matched the photo on his driver's license. Another video in which GhostExodus showed off Wireshark and other hacking tools revealed an IRC session that revealed an IP address issued by swbell.net.

His need for attention led him to volunteer a wealth of information about himself. A profile here made in March lists his age as 24 and shows the face of a white male that is identical to the one belonging to the individual McGrew says he observed in the hospital videos. (Those clips have since been taken down).

Combining the IP address with a Craigslist posting and GhostExodus's YouTube videos, McGrew soon deduced the miscreant probably was a night security guard at Carrell Clinic.

GhostExodus's tell-tale screen capture

Besides breaching the security of the hospital, McGraw also posted evidence that he accessed a computer used by the aviation unit of the Dallas Police Department. Police officials confirmed that a machine assigned to that unit was known "to have been compromised by an unauthorized individual."

McGrew - who despite the name similarity has no relation to McGraw - first learned of the HVAC breach after someone from Electronik Tribulation Army sent him an unsolicited instant message on June 18 bragging of the exploit. The message pointed to screenshots that suggested it wasn't a hoax. With a specialty in SCADA, or supervisory control and data acquisition, McGrew quickly took notice. Three days later he tipped off the Texas Attorney General's office and the FBI.

"I can't just see that and let that go," he said. "I spent the entire weekend trying to find out as much about GhostExodus as possible."

Of particular concern was the sinking realization that someone had unauthorized access to the system that controls the air-conditioning systems that cool operating rooms and other critical areas of the Texas hospital, where temperatures regularly hit the triple digits.

"Elements of critical infrastructure, like HMIs for control systems in hospitals have such low security that even someone like this can get in," he said. "It really shows how dangerous even a low-skilled attacker can be." ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New twist as rogue antivirus enters death throes
That's not the website you're looking for
ISIS terror fanatics invade Diaspora after Twitter blockade
Nothing we can do to stop them, says decentralized network
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.