User Controls
Homeland Security
-
2016-09-02 at 4:17 AM UTCLets pretend that Homeland Security and the FBI are actively investigation me. What precautions would be wise?
-
2016-09-02 at 4:18 AM UTClandmines
-
2016-09-02 at 4:26 AM UTCYeah, landmines. An invisibility cloak would be good too.
What are we pretending they're investigating you for? -
2016-09-02 at 4:36 AM UTCYou should have thought of that before you went and hacked those sites. But since you asked, i am assuming you are live booting and have all your data externally stored and encrypted? If not i suggest you throw your SSD/HDD in a volcano. Also, if you have the know how to gain access to and exfiltrate data while remaining unnoticed for a sustained amount of time on several dot gov domains i am assuming you are familiar with the basic principles of opsec. Then again, the government is known to be highly incompetent, so who knows.
-
2016-09-02 at 4:36 AM UTCLets pretend that hack some web servers and stole over 6.5 million pieces of person information. Well also pretend that I hacked one a year and a half ago and got over a million SSN.
-
2016-09-02 at 4:38 AM UTCWe are in the news.
http://www.idahostatesman.com/news/politics-government/state-politics/article99395062.htmlHack that hit Idaho Fish and Game involved 6.5 million users in four states
Outdated security was the cause of a data breach in Idaho and three other states, but it’s not clear whether the hacker responsible actually stole information, or even wanted to.
The first indication that a hacker might have accessed personal data on the online licensing website used by Idaho Fish and Game came late on Monday, Aug. 25. The vendor that runs the service patched the vulnerability the same day.
Separately, Idaho Fish and Game learned of the potential breach through the Department of Homeland Security on Tuesday. The site was promptly shuttered and the public put on notice.
By then, authorities and site operators knew that the hacker, using the handle Mr. High, had boasted of accessing personal information for as many as 6.5 million people in Idaho, Washington, Oregon and Kentucky.
Mr. High had actually announced his gambit the Friday before, Aug. 19, on a cheekily named online forumaccessible from any web browser.
To date, authorities still don’t know whether the hacker actually downloaded any information. And theft, it seems, might not have been the motivation. (The Statesman is referring to the hacker as male, given the handle he used.)
Instead, the breach might have been the hacker’s call to action.
“On Monday I’m going to report five security holes,†he wrote on the forum site Friday, saying he planned to reach out then “to the administrators and to random people like the FBI.â€
The licensing sites used by Washington, Oregon and Idaho are contracted to a third-party vendor. Kentucky’s system is in-house. Despite Mr. High’s reference to five security holes, the hacker has not identified a fifth system.
“I’m only reporting the sites that I’ve already worked. The rest stay open for business,†he wrote.
On Monday, Mr. High wrote again on the forum and also on betaBay, a marketplace site on the anonymous, encrypted part of the internet known as the dark web.
“This should make the news,†the hacker wrote. “I’ll list the exact websites once the security hole is patched and/or it makes the news.â€
About 10 hours later, he named the target sites and what he had obtained: personal information for 2.4 million users in Washington, 2.1 million in Kentucky, 1.2 million in Oregon and 788,000 in Idaho. The data included names and addresses, dates of birth, driver’s license numbers, partial Social Security numbers, email addresses and phone numbers, and personal details such as height, weight and hair color.
In his forum message, the hacker said Kentucky’s site administrator, when contacted about the vulnerability, “replied quickly†and “was thankful†for the notification. He said he also contacted “a couple hacking news sites.†At least one security blogger picked up on the hack.
The other licensing sites are managed by Dallas-based Active Network, a data analytics firm that manages cloud-based event and activity registration and payment services for clients. The company says it processes 100 million registrations and $3 billion in payments annually for 42,000 clients and 650,000 activities.
It handles Idaho’s Parks and Recreation reservation system, but that is separate from the Fish and Game licensing site and was not affected by the breach.
Active Network, through a Washington, D.C.-based PR firm, has declined comment beyond an initial statement. The company said it patched the weakness “within 15 hours†and has engaged a “top-tier cybersecurity firm to conduct a review.â€
The FBI and Department of Homeland Security are investigating as well.
The exploit, systems experts said, involved a weakness in the front end of the licensing sites — that is, the actual web page users visit to input information.
The weakness meant that a malicious user could gain access to data by inputting the ID assigned to a user upon registering on the site. Older user IDs were numeric only; later, users received more secure betanumeric IDs, among other security upgrades. In the case of Idaho, only users who signed up in 2008 or earlier and received a numeric ID were at risk.
A hacker could write a fairly straightforward computer script to access individual records for thousands of users in sequence, covering his tracks by hiding his internet address and by obtaining the information gradually over time.
And the exploit might have been open to the hacker for months: Mr. High posted about accessing data as early as March.
When Fish and Game technical staff attempted the exploit based on the hacker’s information, their test “didn’t retrieve all the information that the hacker claimed to have gotten,†said Greg Zickau, Idaho’s chief technology officer. “It’s not confirmed that he was able to get some of the things that he claimed and how long it would have taken for him to get the volume of records that he claims to have had.â€
If officials want to prosecute the hack as a crime, that would have to occur in the state where the data resides — in this case, Texas.
Idaho’s state systems have suffered relatively minor cybervandalism in recent years, Zickau said, including website defacements; “ransomware,†a type of malware that attempts to lock out a user until a payment is made; and denial-of-service attacks, in which websites are inundated with simultaneous page-view requests to the point where they are unable to load for legitimate users.
“We’re constantly being scanned, and relatively constantly under some level of attack with varying levels of success,†Zickau said.
The Idaho system will remain offline pending thorough third-party testing.
Bill Dentzer: 208-377-6438, @IDSBillD
Identity theft: What you can do
Idaho Fish and Game says the vendor that manages its licensing website will contact users whose data might have been accessed in the recent site hack.
Concerned about identify theft? The Federal Trade Commission hosts a number of resources.
For information on prevention, visit ftc.gov/idtheft.
To report identity theft, visit identitytheft.gov. -
2016-09-02 at 4:44 AM UTCLmfao, you should make a twitter handle, you'll have over 9000 twitter followers in hours.
-
2016-09-02 at 5:02 AM UTClol 1. - they screencapped the post
lol 2. - they suppressed the site url for the first time I've ever seen - looks like they didn't want to publish 'niggasin.space'
lol 3. - "The weakness meant that a malicious user could gain access to data by inputting the ID assigned to a user upon registering on the site."
they didn't use sessions or anything, just allowed you to access data by guessing IDs in the post data or URL? fuck off. -
2016-09-02 at 5:10 AM UTCYeah that'd be something I'd wanna have planned before I decided to hack any government sites. I dont have any words of wisdom here to give, but I'd say in the future to always plan for the worst and hope for the best.
-
2016-09-02 at 5:15 AM UTC
lol 1. - they screencapped the post
lol 2. - they suppressed the site url for the first time I've ever seen - looks like they didn't want to publish 'niggasin.space'
lol 3. - "The weakness meant that a malicious user could gain access to data by inputting the ID assigned to a user upon registering on the site."
they didn't use sessions or anything, just allowed you to access data by guessing IDs in the post data or URL? fuck off.
[greentext]>Then again, the government is known to be highly incompetent[/greentext]
Called it.
1.Download firefox
2.Get Live HTTP Headers
3. Find gubmint site
4.??????
5.PROFIT!!!!! -
2016-09-02 at 5:48 AM UTCmy bad, they actually did post a link to the site
-
2016-09-02 at 5:58 AM UTCsmoke a lot of meth that way the shadow people can guard your house and let you know when those fuckers are on the roof cutting wires and installing microphones and shit.
[FONT=Verdana]the house was bugged so we would write nots to each other about illicit activities then we would take the time to say things that would exculpate us in the eyes of the law (ie "so, it's a damn good thing we no longer are involved with methamphetamine manufacture or sales")[/FONT]
-
2016-09-02 at 5:59 AM UTCalso people will just think your on drugs and can't possibly be doing anything signifigant and just ignore you.
-
2016-09-02 at 6:15 AM UTC
a cheekily named online forumaccessible from any web browser.
fuckkken ZONGO son. Seriously ZONGO. Our humble little servers on the moon space station made the news. You are a niggasin.space OVERNIGHT LEGEND!!!.
[SIZE=48px]AND IF ANY FBI ARE READING THIS PLEASE CONSIDER HIRING ME!. I would be a useful asset in taking down darknets and vendors. through my own private investigations I found launderers and LBC and figured out their PI with hydromorphone tier sleuthing skills (although I need to be on meth to do this)[/SIZE]
All I want is a small cut of the bitcoins we seize, like 10000 BTC and I'm G
-
2016-09-02 at 6:19 AM UTCtop kek. we in the news niggas! Well not me since I dont hacking. But damn mrhigh u r going 2 dai cuz da fbi.
Also I agree. Landmines. -
2016-09-02 at 6:55 AM UTCI like how we said 'we' as in the whole site including Lanny was in on this shit. I be he gets popped in less than a month. After thinking about the situation he should just make a dash for the border and hide out. He drew too much heat on his ass and is scared now. Don't play with fire unless you're prepared to get burnt And its a bad time to try and put on gloves after the boiling water is already on your hands.
-
2016-09-02 at 7:27 AM UTCmeh, your "we" argument would never hold up in court. We are a community (as are all forums) and the fact that a few posts by some users were screen capped in an article and the site was linked means we as a community made it on the news. It is basically the same as when someone posts pictures of someone they killed on 4chan. You cant blame the entire site or charge them with a crime but the entire site is referenced in news articles surrounding the subject.
-
2016-09-02 at 7:38 AM UTC
meh, your "we" argument would never hold up in court. We are a community (as are all forums) and the fact that a few posts by some users were screen capped in an article and the site was linked means we as a community made it on the news. It is basically the same as when someone posts pictures of someone they killed on 4chan. You cant blame the entire site or charge them with a crime but the entire site is referenced in news articles surrounding the subject.
I remember that happening twice, were either of them for real? -
2016-09-02 at 8:14 AM UTCI know one was real for sure. verified it myself. But really why wouldnt it be? I mean 4chan is big enough to where its not beyond reasoning that at least a few deranged souls would try and find fame through posting their bad decisions. TBH im surprised its only twice that you remember. Seems to be at least yearly.
-
2016-09-02 at 9:07 AM UTCThey won't say niggers but show the cucked button with a big black penis
I want to see "that cheekily named website" on CNN or MSNBC. I can just see the NSA weekly meeting, someone is like "yeah this MrHigh guy is posting about his hacks on a hacker forum"
"Oh really let's check out the URL"
"Its uhh.. Niggas in dot space sir.."
*F-F-F-FRONT PAGE FLUSH♣♠♥♦
JEEEEEEEEEERT!!!1!!
AHKMAH!!!!
NO IM GOiiUM!!!!*
"get the fuck out of my office you crack pot"
