ImageShack hacked in oddball security protest
Anti-Sec in erratic war declaration on full disclosure
Agentless Backup is Not a Myth
A hacking group has broken into one of the biggest image hosting websites on the net before uploading its manifesto.
"Anti-Sec" broke into ImageShack to post a protest over sites that publish full disclosure material on security vulnerabilities, though how the attack furthers this agenda is unclear. The group, which also attacked the websites of astalavista.com last month, pledged to cause further "mayhem and destruction" against supporters of full disclosure, which it argues benefits security firms and cybercrooks at the expense of the wider community.
Ironically, exploit code associated with Anti-Sec's latest attack was posted on a full disclosure mailing list.
Anti-Sec’s proposed program of action calls for "eliminating the security industry in its present form". Security blogs or exploit-related websites who support full-disclosure were warned to brace themselves for attack.
Security firms were quick to pick apart the group's arguments. Rik Ferguson, a security consultant at Trend Micro, said the group fails to acknowledge that full disclosure allows security organisations to "mitigate against attacks before they are exploited in the wild". It also ignores the point that cybercrooks often profit from undisclosed vulnerabilities.
Ferguson compares the group to the "wacky end of the survivalist movement... heading for the hills with their tins of beans and their AK-47s (and now SQLi [SQL injection - a common website exploit technique])."
ImageShack, which was hit by the defacement late on Friday, restored its service to normal over the weekend. A screen shot of the defacement, via Mashable, can be found here. ®
COMMENTS
Script Kiddie?
By definition, a script kiddie uses someone else's code. These dudes are using their own 0-days which should explain their motives pretty plainly.
They don't want anyone else to have their tools. They don't want script kiddies sh**ting up the pool with a million derived iterations of something they discovered and would prefer to horde.
Also, money. Because it always boils down to money. Perhaps they want to sell their 0-days to the vendors or on the black market. Full disclosure makes that impossible or at least less profitable.
Even if the anti-sec front dudes performing the actual attacks against sites are script kiddies, you can bet the message was written by someone with an actual brain. Just read it. There is a serious lack of high-fivin' leet speak. The grammar and formatting look correct. It reads like a manifesto, not a "lolz u got pwned" defacement.
I have no idea who is behind the Anti-Sec "movement", but it isn't just some neckbeard sitting in his mom's basement stuffing Cheetos in his gullet, washing it down with a Code Red Mountain Dew while symbolically raging against the jocks who used to give him wedgies. It reminds me, in a way, of Anonymous and the attacks against Scientology.
This could be the start of something.
Maybe not. Maybe it is just a flash in the pan, but there is lots of money to be made in exploits and giving them away via full disclosure is pissing off the wrong people. Whether the truly criminal elements in the security market would be bold enough to strike in such an almost sanctimonious manner remains to be seen.
Look at the birth of the Pirate Party after what happened to The Pirate Bay. TPB may have sold out to pay their fines, but the mindset, the feelings of F* the Man and the Corporations are still boiling.
There will be an outlet.
@Antisec isn't a group, Its a Movement, Get it strait.
facepalm.jpg
Oh well, I was dumb like that back in the early 90's.
Imagine that.
Appears that the perpetrators picked their prey purely for the pun possibilities. I'll chuckle at the message, but their political policy is poop.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
