Skip to Content

AOL Tech

Hacker posts

Computers, Web

Lazy Passwords Leave 21K Routers, Cams, Phones Open to Attack


In the "yet another thing to be paranoid about" category comes a report that nearly 21,000 routers, webcams and VoIP products are wide open to remote attack, simply because their owners have committed the ultimate sin: failing to change the manufacturer's default password for the devices.

The study was performed by Ang Cui, a grad student at Columbia University's Intrusion Detection Systems Laboratory, which has sponsored the likes of DARPA and the Department of Homeland Security. Researchers have now scanned over 130 million IP addresses, and discovered nearly 300,000 devices to be remotely accessible. And the 21,000 devices with default passwords are, of course, the most vulnerable -- "runts of the litter", if you will.

Read more →

Computers, Web

New Cyber Threat Study Delivers Surprising Results


The SANS Institute, an IT security education and research group, has released a study of computer and network vulnerabilities that can only be described as massive. Involving some 15,000 organizations, the study is one of the first to offer hard data about the the number and severity of digital threats across the entire computing landscape.

According to the data collected by SANS, the biggest threats out there right now don't stem from exploited operating systems, but rather the vulnerabilities of applications and the server-based software that powers the Internet. For all of its faults, Windows isn't the problem. By the same token, Apple isn't the solution. Most attacks on today's computers focus on vulnerabilities in Web browsers, Flash, Acrobat Reader, Microsoft Office. Alternatively, they go right to the source and weasel their way onto legitimate sites.

Read more →

Computers, Web

E-Mail Hacking Services Evade Law Enforcement

When a hacker is caught, as was the one who weaseled his way into Sarah Palin's e-mail account, it tends to be the exception to the rule. In fact, many hackers openly advertise their services on sites like YourHackerz.com or SlickHackers.com. On such sites, they promise to hand over e-mail and social networking passwords for as little as $30 a pop.

Unfortunately, this type of attack, while illegal, leaves little evidence linking it back to the hacker, and is only qualified as a misdemeanor -- not something law enforcement officials are likely to spend significant time investigating.

Read more →

Computers

Fake ATM Dupes Hackers at Hacker Expo

Don't you love that lovely twist wherein the hunter becomes the hunted?

Such was the case at the recent DefCon hackers' convention in Las Vegas, where a fake ATM was set up in the conference center of the Riviera Hotel Casino in order to steal account information from any gullible hackers who might cross it. Apparently, there were at least a few of them. (As of yet, no reports stating the exact number of victims have emerged.)

It's unclear how long the ATM was there, or whether or not it was an inside job perpetrated by one of the conference attendees. Witnesses told authorities that the machine was placed in such a way as to avoid the gaze of surveillance cameras.

Brian Markus, CEO of Aries Security, first identified the machine as a trap. "In any casino anything that is considered that high value has a camera," Markus told Wired, "and they placed it where there were no [hotel] cameras visibly watching that exact spot where the ATM was."

Shining a flashlight through the machine's smoked glass screen, Markus didn't see the typical camera looking back at him, but instead a PC meant to steal card data.

The best part? The ATM was operating right outside the hotel's security office. Major bonus points for that one. [From: Wired, via Neatorama]

Computers

$300 Billion Pentagon Project Hacked (Data Compromised, Again)

$300 Billion Pentagon Project Hacked

According to a front page Wall Street Journal article this morning, it looks like piles of data related to the $300 billion F-35 Joint Strike Fighter military plane have found their way in to the hands of hackers. According to government officials the newspaper spoke with, the Defense Department was the subject of a concerted cyber attack over the past few months in which terabytes (yes plural) of data related to the project were intercepted and fed to IP addresses that have been tracked to China.

Of course, the Chinese embassy issued a statement denying any involvement and said it "opposes and forbids all forms of cyber crimes," but we know it means that in the same way Ted Haggard meant that he opposed homosexuality.

"We aggressively monitor our networks for intrusions...," Air Force Lt. Col. Eric Butterbaugh told the WSJ. Now, anyone who has ever tried to download an HD movie via BitTorrent knows how long it takes to download a few gigabytes of data, which leads us to believe the monitoring couldn't be too aggressive if spies were able to siphon off several thousand gigabytes before setting off alarms.

Read more →

Cell Phones, Computers, BlackBerry, iPhone

Simple Text Messages Can Be Used to Steal Data


Some phones today can have pretty dramatic security functions; case in point, the iPhone will erase itself if you screw up entering your password 10 times in a row. Unfortunately, all a hacker really needs to bypass your password and take over your phone is a simple text message.

In a series of proof-of-concept videos posted on YouTube, Dan Dearing (Vice President of marketing at Trust Digital) demonstrates how, using a text message, he can hijack a phone and steal data off of it. Using an SMS text message, Dearing can force a smart phone to launch Mobile Internet Explorer, download and install a malicious software package, and send data back to his own phone. This attack is referred to as a "midnight raid attack," since it would ideally be done while the victim is sleeping so they don't notice the cellular activity.

Read more →

Computers, Green Tech

Hackers Could Cause Blackouts on Smart Grid

Hackers Could Cause Blackouts on Smart Grid
One of the things that the money in President Obama's tech-laden stimulus bill is supposed to pay for is a massive re-hauling of the U.S.'s energy infrastructure and the deployment of what is called a smart grid. This is a great thing, since smart grids are considered essential to reigning in our power usage and reducing our dependence on foreign oil.

Simply put, smart grids are two-way communication systems that dynamically adjust how power is used in a home in order to minimize load on the grid, thus preventing blackouts and increasing efficiency. The system relies on specialized meters installed in homes that can be controlled over the Internet. This raises a bit of a problem for us paranoid computer types, because this leaves our power grid open to attack via the Internet, and recent studies from security firm IOActive have shown that a smart grid may be vulnerable to hackers on a massive scale.

IOActive found that a hacker with $500 in equipment and a background in electronics and engineering could break into the grid with relative ease. From there, it would be a trivial matter to gain control of hundreds (or even thousands) of meters and cause a blackout.

Read more →

Computers

Assessing Our Cyber Security From the Oval Office



The White House has tapped cyber consultant Melissa Hathaway to conduct an extensive review of US Internet security. She will now be tasked with analyzing the effectiveness of programs she helped foster as the point person of former President George W. Bush's effort to check an increase in breaches of military and government sites in early 2007.

The nascent Obama administration's unprecedented openness through its WhiteHouse.gov site has showcased the President's commitment to the Internet as a necessary tool of modern government, foreshadowed by his extensive and tremendously successful use of the Internet and Web 2.0 during his campaign. Still, the President has been called to extend cyber security beyond government sites to include protection for citizens and businesses and to foster greater collaboration with foreign countries. Fortunately, Hathaway has a history of getting stodgy bureaus to play nice and work together; she spent 15 years as a management consultant getting military and intelligence organizations to collaborate.

President Obama knows the consequences of flimsy Web security firsthand; in April 2008, a programming error allowed a zealous Hillary Clinton supporter to redirect part of Obama's campaign Web site to Clinton's site.

Read more →

Computers

Internet Scams Increasing as Economy Stumbles


We've noted before the economic downturn has been a boon to online scammers. As more tech workers have lost their jobs, the pool of potential cyber criminals has been growing, as has the number of people out there willing to believe the e-mails promising virus protection, get-rich-quick schemes, and funny or pornographic videos circulating on the Web.

By mid September, there were 31,000 malicious programs making the Internet rounds. Trojans, worms, even good 'ol fashioned data mining schemes have really taken off following the collapse of the banking industry and the rest of the economy. The scams are being fed to victims via IM, e-mail, and even social networking services.

Hackers and criminals are becoming more sophisticated as well, hijacking banner ads and complete Web sites, using Flash to install malware, and redirecting users from legitimate pages to infected sites. Monster.com and MyCheckFree.com have both fallen victim recently attacks, and experts only expect the number of scams to increase during 2009.

So keep your guard up when online, and remember as easy as a life of theft may seem, crime -- even cyber crime -- doesn't pay. And now you know... and knowing is half the battle. [From: USA Today]

Related links:

Computers

Hacked Obama Site Offering Up Virus

Hackers Target My.BarackObama.Com
Like most of the Internet, we're more than a little excited about having our first truly tech-savvy president here in the U.S. Unfortunately, for all our fawning over the idea of a government that doesn't still think dial-up is modern technology, we've neglected that putting more emphasis on the Internet makes one more susceptible to attacks by hackers and other computer criminals.

We've already seen the Obama campaign's Web site hijacked, and fake Obama e-mails spread viruses. We've even seen our fair share of fake Obama Web sites loaded with malicious software. Now hackers are trying to directly reach Obama supporters by creating fake profiles and blogs on the MyBarackObama social network. The fake blogs often contain links, made to look like YouTube videos, that lead you to a YouTube-like page loaded with porn. Playing one of these videos launches a pop-up that uses the old "install this missing codec" trick. The supposed missing software is, of course, a virus.

Have you ever been the victim of a computer virus?



Read more →

Computers

Scammers Baiting Internet Users with Fake Obama Web Sites


If you receive an e-mail or visit a Web page asking you to look at BestBarack.com, JoBarack.com or TheBarackSite.com, just don't do it. According to Panda Security, an Internet security firm, scores of malicious Web sites are running a fake news story entitled "Barack Obama has refused to be a president."

People who go to the sites are asked to download a file, which (of course) is a virus that will turn your computer into a so-called zombie. What is a zombie, you ask? We've got a nice description here, but, basically, a zombie is an infected computer that can be controlled by a far-away hacker. Not nice.

Throughout the presidential campaign and lead-up to the inauguration, enterprising ne'er-do-wells used the names and images of President Obama and John McCain to trick people into downloading viruses or falling for scams.

Read more →

Computers

Hackers Help Companies Illegally Harvest Lumber in the Amazon

Hackers Help Companies Illegally Harvest Lumber in the Amazon
If you've been wondering why we haven't moved to completely electronic record keeping systems yet, here is a tale of an environmentally disastrous hack made possible by the lack of paper records.

For years, Brazilian logging companies have been using hackers to break into government systems to alter and issue permits that have allowed them to fell much more timber than would normally be allowed. According to the latest report from Greenpeace, over 1.7 million cubic meters of lumber have been illegally harvested from the Amazon using these permits.

The report also alleges that the hackers involved in these attacks have been employed by 107 (seriously, 107) various coal and logging companies, and 202 currently face charges in the ongoing investigation. Some of those involved are already facing prior suits for violating environmental and slave labor laws.

Because the state environmental agency relied on purely electronic records, there was no way to double check the terms of the permits issued, which allowed the companies to get away with the illegal logging scam for so long. In contrast, Google's about-face on net neutrality doesn't seem so evil after all. [From: BBC]

Computers

17-Year-Old Admits He Went on 3-Year Computer Crime Spree

Teen Hacker Arrested, Dodges Jail Time
In the online world, there are various levels of hackers. Lowest are the script kiddies, would-be miscreants who lack the skills to be a proper threat. Then there are the white hatters who infiltrate corporate and government networks largely just to see if they can -- often alerting the necessary authorities about the flaws. Worst are the skilled black hat hackers -- Dshocker was one of those, and arguably one of the most notable on the Web. Unfortunately (for him), he wasn't the most elusive, and he was sent to a juvenile detention facility for 11 months after being convicted of numerous crimes.

Dshocker is an unnamed 17-year-old kid from Massachusetts whose skills with computers got him into trouble. He not only led personal attacks against other online hackers, but was the leader of a large botnet and used his skills to make a number of bogus 911 calls. He was able to call emergency services and make it appear as if he was at one location, when in fact he was at another. He'd report that a violent crime was taking place, resulting in armed police storming the supposed origin of the call -- a dangerous situation for all involved.

Dshocker could have faced 10 years in prison had he been tried as an adult, but he managed to get away with less than a year in detention. We hope it's enough. [From: The Register]

Computers, Celebrities

Obama and McCain Campaigns Infiltrated by Foreign Hackers



Newsweek revealed yesterday that computers at both the Obama and McCain campaigns were hacked by a "foreign entity" during the campaign. Though the intrusions -- which started last summer and continued through September and October -- were detected by the campaigns, they were initially thought to be a simple virus or phishing attack. The day following the hacks, the FBI and Secret Service approached the Obama campaign and told them, "You have a problem way bigger than what you understand."

The end result was that the systems were compromised and large numbers of files were downloaded by the attacker or attackers. The FBI and the White House believe that the stolen information was related to policy positions and may be used to gain leverage over a future administration in negotiations. Agents assured the campaign that the attack did not originated with their political opponents. According to the report in Newsweek, the Obama team has speculated that the attack originated from China or Russia. To combat the intrustion, a security firm was hired to quickly plug up the holes in the campaign's computers.

The extent of the information obtained is not known, but judging from Bush's Chief of Staff Josh Bolton's comment to Obama Campaign Manager David Plouffe ("You have a real problem ... and you have to deal with it"), the FBI will be working tirelessly to find and out the culprits. [From: Newsweek]

Computers

Disgruntled Employee Takes Out Company's E-Mail


Listen closely, we don't want to have to repeat this again: Revenge-hacking your employer's servers is not a good idea. Whether it's a crappy desk location or an unpleasant termination, hacking is never an appropriate method of recourse.

Steven Barnes has been arrested and sentenced to one year in prison after pleading guilty to hacking an Exchange Server run by his former employer, Akimbo Systems. Barnes claims that he hacked into the system in retaliation for being fired in 2003 at the hands of a group of baseball-bat-wielding thugs. He testified that several Akimbo reps showed up on his door step and confiscated both his work and personal PCs.

Months later, Barnes discovered that some login information he had for the company was still valid and that the company had no security features in place to prevent him from taking over the company's e-mail server. Rather than leave well enough alone, the disgruntled employee turned the computer into an open relay server capable of sending large amounts of spam, deleted the companies Exchange database, and damaged critical operating system components so that the machine would crash when rebooted.

Akimbo said that it was unable to send, receive, or access e-mails and was blacklisted by several spam blocking services. Barnes, in addition to spending a year in prison, will have to pay $54,000 in restitution and will serve three years on probation. [From: Ars Technica]

Switched Video

Follow Switched on Twitter

Deals of the Day

Latest Reviews from CNET.com

CNET provides the latest tech news, unbiased reviews, videos, podcasts, software, and downloads, making tech products easy to find, understand and use.

Top Product Reviews

  • Home Audio Reviews

    9.0 out of 10

    Definitive Technology BPX
    Works great with Dolby Pro Logic and Dolby Digital. Full Review

    9.0 out of 10

    Denon AVR-4306 (black)
    Incredibly well-featured 7.1-channel receiver; excellent sound quality; three HDMI inputs; converts analog video to HDMI output; upconverts analog video to 720p/1080i HD resolution; iPod and USB MP3 player connectivity; Internet radio and MP3/WMA streaming audio via built-in Ethernet port; XM Satellite Radio compatible; touch-screen remote; multizone, multisource operation; browser-based control via home network; accurate autocalibration routine. Full Review

    8.8 out of 10

    KEF KHT3005 (black)
    The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review

  • Cell Phone Reviews

    8.7 out of 10

    SignalBoost Mobile Professional Amplifier Kit
    The Mobile Professional Amplifier delivers a powerful signal boost to your cell phone. Also, it offers a compact design and easy setup. Full Review

    8.6 out of 10

    Wi-Ex zBoost YX510-PCS-CEL cell phone signal extender
    The Wi-Ex zBoost YX510-PCS-CEL significantly boosts your cell phone reception and is easy to operate. Also, it uses a wireless connection to your phone. Full Review

    8.3 out of 10

    LG VX6000 (Verizon Wireless)
    Compact and stylish; impressive battery life; solid audio quality; sharp color screen; built-in camera; USB ready; affordable. Full Review

  • Digital Camera Reviews

    9.3 out of 10

    Canon EOS 1D Mark III
    Extremely fast, 10-megapixel continuous shooting; very low noise; highly customizable; well-designed body with weather sealing; 3-inch LCD; abundant optional accessories. Full Review

    9.3 out of 10

    Nikon D3 (body only)
    Full-frame sensor; well designed, pro-level weather-sealed body; very low noise, even at extremely high ISOs; fast. Full Review

    9.0 out of 10

    Canon EOS-1Ds Mark III
    Very low noise, high quality images; 21.1 megapixels; live view shooting; pro-level build-quality and performance. Full Review

  • Desktop Reviews

    8.5 out of 10

    Apple iMac (24-inch, 2.8GHz)
    A minor specification update results in some significant performance gains; graphics upgrade an option on this 24-inch model; sleek, polished design didn't receive an update, but we won't start clamoring for a new design until the current one is at least 12 months old. Full Review

    8.4 out of 10

    Apple iMac (27-inch, 3.06Hz Intel Core 2 Duo, ATI Radeon HD 4670, Fall 2009)
    Largest display among all-in-ones; fast dual-core CPU makes up for lack of quad-core (mostly); finally has an SD card slot; wireless mouse and keyboard; Mini DisplayPort input ripe with possibility. Full Review

Featured Galleries

Nissan Land Glider
Vintage Keyboards
Retro Computer Logos
Vintage Computer Festival
Motorola CLIQ
iPod touch
iTunes 9
Video iPod Nano
The Beatles: Rock Band

 

Switched Desktop

Get the New Switched Desktop

Latest tech news, Switched mail, and more.

AOL Tech Network

Resources

Autoblog

Daily Finance

Download Squad

Engadget

Joystiq

Urlesque

Fanhouse Main

WalletPop

Gadling