The Anti-Sec movement

On July 11 2009 11:38 paper wrote:
FUCKING GREAT.

On July 11 2009 12:18 Nightmarjoo wrote:

LOL that sucks.

On July 11 2009 12:36 SWPIGWANG wrote:
When in doubt, hit it with Starlight breaker~~~~

On July 11 2009 13:14 DeathSpank wrote:
mmm tl. While I don't agree with full disclosure(this is actually the first I heard of it) it seems mighty counter productive to hack a bunch of sites to battle security companies.... Hey guys let's stop the money grabbing security companies by causing more havoc!! that way they consumers have more reason to buy their stuff!! LOL.

On July 11 2009 13:24 Medzo wrote:


Pretty much QFT.

On July 11 2009 12:20 konadora wrote:
Looks like imageshack found out, I think they're restoring the images

On July 11 2009 14:46 Chef wrote:

Oh man, imageshack's images are messed up for two hours and everyone abandons them

I still use them. I enjoy that I don't have to sign up for anything to upload files. AFIK you need to make an account to use photobucket... blaah. Then again, I haven't used photobucket in ten million years.

On July 11 2009 17:57 Lemonwalrus wrote:

They probably are 4chan.

On July 11 2009 11:34 benjammin wrote:
i'm not a computer science person in any way, but isn't this just laughably misguided? doesn't disclosure encourage the actual creation of fixes and distribution of them on a larger scale than otherwise? sure, it allows for malicious usage, but that would exist either way, and would be more effective if there was no disclosure

i don't know what that bit about money is all about, but this just seems immature

correct me if i am wrong, my degrees are in english :D

On July 12 2009 09:55 Mooga wrote:


See, the thing is that hackers don't want full-disclosure because it threatens to fix exploits that hackers are using faster than no-disclosure. This forces hackers to come up with novel hacks, instead of using the same method indefinitely without being detected. Of course they say that what they are doing is to stop the script kiddies, but most script kiddies use grey-hat or black-hat exploits anyway, they don't go through code and write their own, so black-hat or grey-hat hackers are still relied on anyway to develop exploits.

On July 12 2009 15:20 Badjas wrote:

So most hacks come from black hats, not from white hats? Where's your source?

On July 12 2009 16:10 Mooga wrote:


It's a question of how the exploits are packaged and how they deliver the payload. I don't know how much you know about script kiddies, but most of them rely heavily on programs written by black-hatters/grey-hatters to deliver the payloads because they can't understand/write the code themselves.

On July 11 2009 11:31 konadora wrote:
I think they're talking about how imageshack's security is bad, so they are proving that by hijacking the images...

ffs

I have to replace like 7 months of my blog's images

On July 12 2009 15:15 Badjas wrote:
Sheesh whiners, the people behind this are vindicated exactly through the proof itself. To those who don't see what they're about, read the damn thing. To those who say they are aggravated by them making you lose an image, how else are they gonna give you a wake up call for their cause, a newspaper ad?

On July 12 2009 17:26 Jusciax wrote:

How is this going to help imageshack or any other site that could be exploited? If there is no full-disclosure and no security firms, where do these sites go to get latest possible vulnerabilities? If you want to destroy something - give a better alternative, instead of wrecking sites to make your point, like some tagger spraying messages on private property.

On July 12 2009 19:54 datscilly wrote:
It makes sense that people would be confused as to the reason they do this, because there's a whole story behind this, and it's not a simple story.
It began in the 70's when knowledge of phreaking-- phone hacking-- became widespread. The computerized phone system at the time used tones of specific frequencies to communicate with the phone network, and people found that they could "hack" the phone system by whistling at a certain note or using a device to do the same. Wiki: + Show Spoiler +
With the seed introduced by phreaking, computer hacking took off in the 80's. + Show Spoiler +
"Hacking" as defined by the hacker subculture is different from the meaning assigned by the mass media and the mainstream public. To the subculture, a hacker is "A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary." It's about being fascinated with computers and wanting to know everything about them. It is being knowledgeable and an expert in a field, and when exploiting, the focus is on skill and expertise. This is often contrasted to "script kiddies", who breaking into computer systems just by downloading a script and running it.
Phrack is an online magazine dedicated to hacking, phreaking, and other related technological subjects. These days, the phrase "death of the hacker subculture" is frequently thrown around. What is the reason for this? The rise of the security industry: former hackers who have turned "white hat" and want to use their hacking knowledge to make a living. A case in point is the well-publicized hacker Kevin Mitnick, who was thrown in jail by the FBI after hacking into multiple companies' networks, and turned and started a security company when he got out of jail. If it is unclear, the security industry caters to corporations who want to protect their systems, and require knowledge of an expert in computer security. Why does the security industry mean the death of the hacker subculture? When every new exploit is publicized, almost all the 'holes' have been 'plugged' and there is nothing to play with. Only the most veteran of experts can now find new exploits, and they even have to work long and hard to find one.

+ Show Spoiler +

In the second paragraph you can see the grievances the hacker subculture have against the security industry. It's not just that the security industry is working against them, although that is the most basic reason, it is also that white hats have turned against their culture, a culture with a distaste for authority and a playful cleverness, who are all about taking the serious humorously and their humor seriously.
In the third paragraph they express their disgust at script kiddies who are viewed as unskilled and not 'in' their crowd.
The fifth paragraph is in reference to the people of the security industry who have chased money and made hacking into their job instead of a hobby.
Even though the hacker culture is not as active now as compared to the 90's, their are still people out there finding new tricks. This image is proof of that.

On July 12 2009 20:50 Badjas wrote:
The report of a known exploit does not have to go along with the details of how to perform it. Furthermore, the owner of the software (or maintainers in the case of open source) is the only one who needs to know the details to fix the problem. When the problem is fixed, they can put out a public notice that clients should get a patch for that software.

The only thing that publication of the details of an exploit does, is to force the owner of the software to get a fix to limit the damage done by the exploit. Well, a second thing, it forces everyone to update said software who's using it because the risk of being hit by the exploit is higher. Exploits should be reported publicly though, so as to warn 'the world' of the danger.

There's the method that white hatters have of warning a software producer about an exploit with details, and threatening to publicize the exploit publicly within x days. This I see as a working method. If this method was applied for the exploit that got imageshack hit, then imageshack or a third party software producer made the error of not plugging the hole. If the exploit used in imageshack is an unpublished one, then the imageshack hacker is wrong. It would be very helpful for their cause if they mentioned the used exploit in the image.

On July 12 2009 22:23 Jusciax wrote:

Could you give example of this, because i don't see how you could publicly report an exploit without giving away enough information for hacker figure it out. And if you publish it to small amount of maintainers, wouldn't leaked information be more dangerous, since most hackers would share it among themselves and only a handful of developers/maintainers would be able to fix it.

Why only "limit the damage done" if you can fix it? And I see only a positive thing out of 2nd statement. Again, i'm not expert, but just curious how can you report exploit publicly and give out enough details to help user and keep hacker in the dark?

This approach is far more logical than hacking the site to send a message.

On July 12 2009 22:06 Jusciax wrote:
Sounds quite simple. People with great skills who didn't manage grow up and adapt are being pissed at ones that could. Tho i don't see how this history justifies anything that they are doing, including hacking imageshack.

On July 12 2009 23:34 ThaddeusK wrote:


not really, its just that they view hacking as something that should be done for fun/as a hobby rather than as a job, saying that they didnt manage to grow up and adapt is like saying the people who play starcraft but are not progamers didnt grow up and adapt (my point being that doing something for a job doesnt have to be the end result of having a hobby, sometimes you just do it for fun) although you are right, it doesnt justify what they are doing.

On July 12 2009 16:43 Badjas wrote:

That didn't answer the question. Wait perhaps I was a bit unclear.
So most exploit discoveries come from black hats, not from white hats? Where's your source?