Convicted hacker allowed in prison IT class, hacks prison’s computer systems

There are plenty of stories about dumb criminals doing dumb things, but we don’t get to hear as often about dumb prisons allowing smart criminals to make them look dumb. At HM Prison Isis in London, teen hacker Nicholas Webber enrolled in an IT class, from which he hacked the prison’s computer systems.

The founder of Ghost Market, a website where criminals were able to buy and sell identities as well as learn the ins and outs of digital identity theft, was arrested in October, 2009. He was sentenced in May, 2011, to five years at HM Prison Isis. There, he met IT teacher Michael Fox who claims he was sacked after it was discovered that Webber had hacked into the prison computers while in class.

Fox claims that he was never told that Webber was a hacker and should not have been fired.

Very few details have been released about the hacking but the prison says that no personal data was accessed. The biometric thumb print security at the facility was reportedly wiped around the time of the incident though it has not been confirmed that Webber was responsible.

According to the Daily Mail:

The incident happened a year after the opening of the £110 million prison, which houses 18 to 24-year-olds. It has been beset by a series of technological problems caused by breakdowns in its cutting-edge biometric roll-call system where inmates have to leave an electronic thumbprint whenever they move from one part of the jail to another.

The moral of the story: if you have a hacker in your prison, don’t give him access to computers.

Duh. The easiest way to stop hackers is with real passwords.

One of the most personal online violations that can occur to anyone is getting hacked. It could be a personal attack such as a Facebook account, on which 600k successful hacks are achieved daily. It could be something more general such as a database hack that exposes personal information. It could be much, much worse.

With all of the security measures out there and counter-hacking attempts, many systems and accounts can be easily secured by having a strong password. There are plenty of hacks that can hit a system or an account that have nothing to do with front door password access, so there’s no reason to give hackers another easy point of entry by having a password that doesn’t take much time for a hacking script to break.

This infographic by OnlineCollegeCourses.com breaks down the stats behind hacking and reiterates the point that “password” is not a very good password.

* * *

“Password” image via Wisegeek.

The 10 most notorious hackers

While high-profile hacking made headlines in 2012, some of the most famous hack jobs took place years ago. The masterminds behind these notorious events are outlined below.

Kevin Mitnick
Labeled as the most wanted cyber criminal in United States history, Mitnick took down the dedicated servers of Motorola, Fujitsu and Nokia. After his 1995 arrest and five-year prison term, he went on to found a computer security firm.

Kevin Poulson
Using the name “Dark Dante”, Poulson gained notoriety by hacking into telephone systems, notably that of Los Angeles radio station KIIS, in order to win a contest. He also broke into police databases and was featured on the show “Unsolved Mysteries”. Poulson is now a journalist.

Adrain Lamo
Lamo is noted for his use of public Internet networks, such as in libraries and coffee shops, to infiltrate company computer networks. His biggest coups was breaching the NY Times database and abusing the paper’s Lexis-Nexis account to obtain confidential information. Lamo also became a journalist.

Stephen Wozniak
Best known as an Apple Computer founder, Wozniak began his career as a white-hat hacker. While still in university, he created a “blue box” that allowed people to call long distance for free. Wozniak eventually dropped out to join forces with Steve Jobs.

Loyd Blankenship
Known as one of the hacker elite, Blankenship was arrested in 1986 for activities connected with the Legion of Doom group. He penned the “Hacker Manifesto”, which is still a foundation of hacker philosophy today and was used in the 1995 film “Hackers”.

Michael Calce
At age 15, Calce brought down Yahoo, Amazon and eBay with intense denial of service attacks. Police arrested him after he bragged about the attack in chat rooms. He received a short jail term, probation and a fine.

Robert Tappan Morris
In 1988, Morris infected thousands of Unix computers with a virus, later dubbed the Morris Worm. He claimed he was simply trying to measure the size of the Internet, but received probation and a large fine.

Masters Of Deception
An elite hacking group, the MOD broke into phone systems. The group was brought down after its 1992 attack on AT&T, with most members not even going to jail.

David L. Smith
Smith is known for writing the infamous Melissa virus that was distributed via Usenet, causing millions of dollars worth of damage. He was sentenced to jail for the offense.

Sven Jaschan
Jaschan was the author of the Sasser and Netsky worms, which were virulent on the Internet in 2004. He was given a suspended sentence and later hired by a security firm.

App security: how important is it?

If you consider the amount of attempts to hack into government systems and databases, and how many times your personal information is compromised – you’d understand just how important application security really is.

The following infographic from Veracode details some of the biggest hacking attempts in recent history and the work behind the scenes to keep them from happening again.

Infographic by Veracode Application Security

Hacker group AntiSec leaks Apple device IDs to highlight FBI tracking

If reports from the hacker group are to be believed, the FBI has over 12 million Unique Device Identifiers (UDIDs) on file and now 1,000,001 of them have been leaked to the public.

Using the AtomicReferenceArray vulnerability in Java, the group allegedly hacked into Supervisor Special Agent Christopher K Stangl’s notebook in March of this year and retrieved a file with information about Apple iOS device users. The file, named “NCFTA_iOS_device_intel.csv”, is claimed to have usernames, device names, device types, push notification tokens, zip codes, phone numbers, addresses, and other personal identification components. If true, this could bring further scrutiny on the amount of information the federal government keeps on its citizens and people around the world.

The file name likely refers to the National Cyber-Forensics Training Alliance, an organization that is intended to combat cyber crimes. The irony here is that if the file is real then it represents a cyber crime itself.

According to TheNextWeb:

They published the UDID numbers to call attention to suspicions that the FBI used the information to track citizens. Much of the personal data has been trimmed, however, with the hackers claiming to have left enough for “a significant amount of users” to search for their devices.

* * *

“Cyber Security” image courtesy of Shutterstock.

As Gizmodo learned, you should change your company passwords regularly

It’s understandable when a Twitter account or other social media profile is hacked when a current employee gets their computer or cloud service hacked. It’s unforgivable when the accounts are taken over because a former employee gets hacked.

Gizmodo learned that lesson the hard way when their account was taken over by “foul-mouthed hackers” as reported by Mike Isaac at AllThingsD:

The technology site Gizmodo’s Twitter account was taken over on Friday evening for a brief period from approximately 5:15 to 5:30 PT. The hijackers appear to be part of a hacking group named “Clan Vv3,” and used the account — which has nearly a half million followers — to post racist and offensive messages. The attackers seem to have gained access after compromising former employee Mat Honan’s e-mail and Twitter account. We’ve reached out to Gawker Media, which owns Gizmodo, for comment.

Businesses should be changing their account passwords often, as much as once a week to be safe. Once a month is a safe amount. Once a quarter is a minimum. More importantly, they should always be changed whenever a high-level person with access to those accounts moves on to another company. This is Social Media 101. Keeping passwords static or using them across multiple channels is an invitation to hackers. While no amount of password changes can make any network completely secure, it’s situations like this that should remind us of the importance of constant diligence when nefarious people ranging from mischievous techno-thrill-seekers to corporate saboteurs are on the loose.

* * *

“Hacker” image courtesy of Shutterstock.

Hotel keycards can be easily hacked in 200 milliseconds

With less than $50 of store-bought hardware and some programming, a hacker can gain instantaneous and untraceable access into over four million hotel rooms around the world, according to Cody Brocious, a Mozilla software developer.

He details his findings on his website. The time it takes once installed: around 200 milliseconds.

“With how stupidly simple this is, it wouldn’t surprise me if a thousand other people have found this same vulnerability and sold it to other governments,” said Brocious. “An intern at the NSA could find this in five minutes.”

* * *

“Hotel Key Card” image courtesy of Shutterstock.

Small businesses must take preventative measures to safeguard against hackers

Hackers are becoming increasingly clever and conniving, while small businesses remain shockingly naive about the threat they face from cyber-attacks. This infographic conveys a clear message to all small businesses worldwide: You’re not as secure as you think. Far too many small businesses mistakenly believe that they are simply too small to be on hackers’ radars. The reality of the matter is that 72 percent of the known hacker breaches in 2011 affected businesses with 100 employees or less.

85 percent of small businesses believe they have taken adequate measures to keep safe from hackers. These small businesses seem to be living in a fantasy world because in reality, basic malware safeguards are lacking. 67 percent of small businesses do not use web-based security and 61 percent do not use antivirus on all desktops. 63 percent of small businesses do not have any security on systems used for online banking. Hackers can steal copyrighted material, medical records and bank account information from small businesses. The average cost to a small business from a cyber-attack is $188,242.

Most small businesses cannot withstand such a massive financial burden and are forced to shut down shortly after an attack. This is unfortunate because preventative measures are rather simple and cheap to implement.

Do you operate a small business? Have you taken the simple measures listed in this infographic to safeguard against hackers?

Infographic by Veracode Application Security

Sesame Street YouTube channel hacked, serves porn

For 22 minutes, kids around the world were greeted with a surprise when they went to the Sesame Street YouTube channel, and it wasn’t the kind of surprise that Elmo would have approved. Hackers took over the account on Sunday, deleted all of the videos uploaded by Sesame Street, and uploaded porn.

Google and YouTube responded quickly and the account is currently down. The name on the account was changed to MrEdxwx, a YouTube user who has since responded with a video saying that he wasn’t responsible. His channel has been hit with hundreds of comments ranging from admiration to death threats. Here’s the quick video he posted in response:

Things to do on TECHi

Tech Intelligence Whitepaper