Feeds

Security elite pwned on Black Hat eve

Kaminsky, Mitnick, et al

Choosing a cloud hosting partner with confidence

On the eve of the Black Hat security conference, malicious hackers posted a 29,000-line file detailing embarrassing attacks that took complete control of servers and websites run by several high-profile security researchers, including Dan Kaminsky and Kevin Mitnick.

The file posted on security mailing lists claimed to have obtained more than four years' worth of data from Kaminsky, and as proof, it offered a smattering of emails, instant messages, and other communications that laid out sensitive research work and intimate personal conversations. It also revealed multiple passwords Kaminsky used and back-end configurations for Kaminsky's website, which was yanked offline Tuesday afternoon and remained down at time of writing almost 24 hours later.

The data also documented attacks on the website of security expert Kevin Mitnick, who confirmed to The Register that his website was breached after hackers gained unfettered root access to machines used by his webhost. The 1MB text file capped weeks of hacks on several other security researchers, including penetration testing firm Matasano. The breaches highlight the often-overlooked reality that even seasoned security professionals are vulnerable to attacks that can expose sensitive business secrets.

"It's the illusion of invulnerability," said Mitnick, who said he purposely kept sensitive data off the servers that ran his website. "I was actually surprised that the other people would keep their email and work data on an internet-facing host. It appeared the boxes were actively used for work."

The breaches also raise the possibility that previously unpublished research about critical security vulnerabilities may have leaked into the public domain. Among the data published Tuesday was a Perl script exploiting Kaminsky's DNS cache poisoning bug. It also aired bash scripts showing security professional Jay Beale, who had an account set up on Kaminsky's server, performing nmap scans on a variety of domain names and IP addresses (presumably belonging to clients).

Kaminsky wasn't available for comment at time of writing. He scheduled a press conference for Wednesday evening. On his Twitter page, he wrote: "Messy, but heh. Walk onto a battlefield, you might get shot."

The attacks are reminiscent of ones that hit security researchers last year. In all of them, the attackers appear more interested in personally embarrassing the researchers and damaging their business reputations than in exposing vulnerabilities so they can be fixed.

So far, it's unclear how the attacks were carried out. Freelance reporter Robert Lemos, whose website was compromised Tuesday evening, said a vulnerability in blogging software WordPress is the most likely explanation. Security researchers gathered at Black Hat have revived rumors that there's a zero-day vulnerability that's being exploited in SSH applications, but so far, there is no evidence to support the suspicions. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.