Agentless Backup is Not a Myth

On the eve of the Black Hat security conference, malicious hackers posted a 29,000-line file detailing embarrassing attacks that took complete control of servers and websites run by several high-profile security researchers, including Dan Kaminsky and Kevin Mitnick.

The file posted on security mailing lists claimed to have obtained more than four years' worth of data from Kaminsky, and as proof, it offered a smattering of emails, instant messages, and other communications that laid out sensitive research work and intimate personal conversations. It also revealed multiple passwords Kaminsky used and back-end configurations for Kaminsky's website, which was yanked offline Tuesday afternoon and remained down at time of writing almost 24 hours later.

"It's the illusion of invulnerability," said Mitnick, who said he purposely kept sensitive data off the servers that ran his website. "I was actually surprised that the other people would keep their email and work data on an internet-facing host. It appeared the boxes were actively used for work."

The breaches also raise the possibility that previously unpublished research about critical security vulnerabilities may have leaked into the public domain. Among the data published Tuesday was a Perl script exploiting Kaminsky's DNS cache poisoning bug. It also aired bash scripts showing security professional Jay Beale, who had an account set up on Kaminsky's server, performing nmap scans on a variety of domain names and IP addresses (presumably belonging to clients).

Kaminsky wasn't available for comment at time of writing. He scheduled a press conference for Wednesday evening. On his Twitter page, he wrote: "Messy, but heh. Walk onto a battlefield, you might get shot."

The attacks are reminiscent of ones that hit security researchers last year. In all of them, the attackers appear more interested in personally embarrassing the researchers and damaging their business reputations than in exposing vulnerabilities so they can be fixed.

So far, it's unclear how the attacks were carried out. Freelance reporter Robert Lemos, whose website was compromised Tuesday evening, said a vulnerability in blogging software WordPress is the most likely explanation. Security researchers gathered at Black Hat have revived rumors that there's a zero-day vulnerability that's being exploited in SSH applications, but so far, there is no evidence to support the suspicions. ®

Steps to Take Before Choosing a Business Continuity Partner