WEAPON OF ANONYMOUS

Before starting, I would like to give a small preview about the topic. This article focuses on the world famous hacker group, known as “Anonymous.” I will be describing their attacking methodologies and way of planning, but we will be focusing more about the weapons or tools they use. The word anonymous simply means having no name or identity. The group Anonymous is a faction of hackers or hacktivists. They have their own website and IRC (Internet Relay Chat) channel where they hold lax online gatherings that focuses on brain storming. Rather than giving orders, the group uses a voting system that chooses the best way in handling any situation. This group is famous for their hacks, one of which is Distributed Denial of Service (DDOS) attacks on government websites, well-reputed corporate websites, and religious websites. Their famous slogan is:

We are Anonymous
We are Legion
We do not forgive
We do not forget
Expect us

This is the signature of Anonymous that can be seen in their every attack.

Skills of Anonymous hackers:

They are people with excellent hacking skills, but they use conventional black hat techniques and methods. In fact, their hacking techniques are familiar with other hackers. For example, they also use the same tools used by other hackers, like havij and sqlmap in performing an SQL injection attack on any website. In other words, they are able to take advantage of common web application vulnerabilities which can be found in many websites.

The Anonymous hackers are comprised of two types of volunteers:

• Skilled hackers –This group consists of a few skilled members that have expertise in programming and networking. With their display of hacking skills, one can surmise that they have a genuine hacking experience and are also quite savvy.
  
• Laypeople – This group can be quite large, ranging from a few dozen to thousands of volunteers from all over the world. Directed by the skilled hackers, their primarily role is to conduct DDoS attacks by either downloading and using special software or visiting websites in order to flood victims with excessive traffic. The technical skills required in this group ranges from very low to modest.
  

There was about a 10:1 ratio of laypeople to skilled hackers.

The Anonymous hackers’ first objective is to steal data from a website and server. If it fails, that is the time they attempt a DDOS attack. They are a very well-managed group. Before selecting a target, they conduct a voting poll in the internet. After that, they name their operation.

They already organized many operations that became very famous, one of which is “Pay Back” which became famous all over the world back in 2010. In operation Pay Back, they stopped the services of well known e-commerce business solutions, such as PayPal, Visa, MasterCard, and Sony by performing D-DOS attacks on them. There are many other operations which were conducted by this group such as Operation leakspin, Operation Israel, Operation Facebook, Operation Gaza, etc.

In the figure below, we can see an example of their voting system for an operation.


After the voting poll, they decide what the next operation is.

In the figure below, we have shown a good example of their voting response.


After finalizing voting for the target, the operation process proceeds.

Their hacking operation consists of three different phases.

1. Recruiting and communication phase

2. Reconnaissance and application attack phase

3. DDOS attack phase

1. Recruiting and communication phase: In this phase, Anonymous uses social media in recruiting members and promoting campaigns. In particular, they use popular social networking sites like Twitter, Facebook, and YouTube to suggest and justify an attack. This is really the essence of all hacktivism campaigns. Messages were spread via social media such as Facebook, Twitter and YouTube.

The content during this phase:

• Explains their political agenda for the campaign. In this case, a website was created that rationalized the attack. Twitter and Facebook were used to bring attention to the website and its arguments. In addition, YouTube videos further rationalizes the attack by denigrating the target and exposing perceived transgressions.

• Declared the dates and targets for protest in order to recruit protesters and hackers.

2. Reconnaissance and application attack phase: In this phase, the attackers have a sound knowledge on attacking tools. They use anonymity services to hide their identity and maintain a low profile. Their attack traffic levels during this phase were relatively low, especially when compared to the attack phase. However, the reconnaissance traffic was relatively high compared to ordinary days. An attacker tries to penetrate the web application by using famous tools like Havij, Acunetix Web vulnerability scanner, etc.

Example of tools used is stated below:

Havij- Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page. By using this software, a user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetch data from the database, running SQL statements and even access the underlying file system and executing commands on the operating system.

Acunetix – The Acunetix Web Vulnerability Scanner is an automated black box scanner that checks websites and Web applications for vulnerabilities such as SQL injection, Cross Site scripting, and other vulnerabilities.

Once the attacker successfully exploits any of these vulnerabilities, Anonymous will deface the website by replacing their website’s home page with their defaced page that looks like the figure below, with their slogan and a message to the world.

3. DDOS attack phase: DDOS attack it is the deadliest attack they use and is performed by their skilled hackers. If they fail to penetrate the web application then they go for this attack. They are also famous for this attack because whenever they perform this attack, they always succeed on their operation. But before conducting a DDOS attack, the anonymous group provides a list of tools in different social media like in an IRC channel, Facebook, pastebin, etc.

Some of the famous and powerful tools used by the Anonymous group are H.O.I.C, Pyloris, Qslowloris, Torshammer, etc.

I am going to show you some of the usage of the tools.

H.O.I.C- Also known as High Orbit Ion Cannon. It is a simple script launching HTTP POST and GET requests at the target server. It is a cross platform tool easily found for Windows, MAC and Linux platforms. As we can see in below figure Click on plus icon which opens a new small windows for adding targets.

Input the target address in URL box then set the power level to Low, Medium and High as your requirement.

In the figure above, we can see the third option was left blank.
HOIC’s boosters are used to tailor the HTTP requests sent by HOIC to the target for a specific type of attack. “HOIC is pretty useless,” the documentation file that comes with the code says, “unless it is used in combination with ‘Boosters.’” And that’s putting it mildly—the attack code is generated based completely on what’s in the booster file. When an attack is launched, HOIC compiles the booster to create the HTTP headers to be sent, and sets the mode of the attack.

After selecting the booster, it is ready for the attack, as we can see in the figure below.

Now just click on “FIRE TEH LAZER” and wait for few minutes.

Now when you will open your target web page, you will see a message like the figure above. If you see the message “Resource Limit Is Reached”, then it means the game is over.

PyLoris – It is a python based tool that works simultaneously on Linux and Windows platform. PyLoris also includes a feature called TOR Switcher, which allows attacks to be carried out over the anonymized Tor Network and switch between Tor “identities,” changing the apparent location the attack is coming from at user-defined intervals. Before using this tool, it is required that TOR browser and Python is installed on the system. Now we can start the tutorial.

1. First open Tor. In the Vidalia control panel, go to settings, then “Advanced”, and from the drop down menu, choose password. Finally, deselect Randomly Generate.
2. Next, go to Pyloris folder and open the file Tor_Switcher.py and input the password you just set in Tor. You can lower the rate of interval if you want. If you are getting rejected connections, try lowering or raising the rate of interval.
3. Leave Tor_Switcher.py running and open Pyloris.py. Configure it, by inputting your target website in the host under the general’s menu. The port is usually 80. You can raise the limits depending on how fast your computer is. Once it’s all set up, fire your laser, and click on the launch button.
   
4. After clicking the Launch button, a new window will pop up and will show the status of the attack. Please refer to the image below.
5. It takes some time before all the target’s sockets are filled, usually around 300 or so. Just wait and soon you will see that your target is down.

References:

http://en.wikipedia.org/wiki/Anonymous_(group)

http://arstechnica.com/business/2012/02/high-orbits-and-slowlorises-understanding-the-anonymous-attack-tools/

Is Anyone Really Responsible for Your Company's Data Security?

Protecting a company's critical information is a value proposition. Trade secrets, confidential business plans, and operational security depend on it. Losing that kind of information can mean a plunge in stock price and market share. So who's responsible for information security in your company?
To find out, I like to ask questions. But when I put the question to top management, well, they're busy — not their problem, that's for sure — and they refer me to the chief information officer or the chief technology officer. So I knock on their doors and put the same question to them. Our job, they say, is making stuff work. If the stuff doesn't work, that's our fault. But security? They refer me to the chief information security officer, but she works for the CIO, who doesn't much like to hear what's wrong with the system he built. Besides, she says, I have nothing to do with who gets access to the system. I don't write the rules. And (she looks around nervously: you won't quote me on this, will you?) my budget is a joke.
So I walk down the hall and knock on the general counsel's door. Cyber security my problem? he says. No, no, he laughs; I write the contracts that lay off the liability for cyber security on our contractors. And insofar as some of that liability stays here, it's a technical problem.
Who's left? I walk down the hall and visit the HR director, who is trying hard to conceal her opinion that, for asking her whether she has any responsibility for any kind of security, I must be the stupidest guy on Earth. Nevertheless I persist. You control the HR manual, don't you? She does. And the manual contains lots of access rules, doesn't it? She concedes the point. And weren't you the chief opponent of the CISO's plan to require a click-through log-on banner stating that information on the company's IT system belongs to the company and can be monitored? Suddenly she remembers her next appointment.
Try the experiment in your company. If you get answers like this, it means that nobody in your company is responsible for information security. The truth is, unless all these people understand they own a piece of the problem and can be brought to deal with it together, you cannot manage information security.
Verizon's newest data breach investigations report for 2013 tells us — yet again — that cyber security depends on people as much as technology. Breaches are nearly always caused by multiple factors, and people are nearly always one of them. In this latest report, based on a larger-than-ever sample, 29% of breaches involved social tactics like getting employees to click on fake emails (phishing). And gullible employees aren't the only problem. Year after year Verizon has been reporting that most intrusions — 78% this year — are "low difficulty" and could have been prevented by simple or mid-level security measures. Failure to implement patches for weeks and months on end is a common problem. This is a management failure, not a technological problem.
When intruders get in to corporate systems, they tend to stay in. We still see smash-and-grab hacks, mostly after personal information, but they are becoming less common, especially when the goal is stealing corporate information. Most breaches take time to discover — usually months rather than weeks, and sometimes longer. In a major release early this year, the forensic firm Mandiant reported solid massive Chinese hacking of private sector clients — and showed that the median period of the intrusion was nearly a year. Often such breaches are discovered only by third parties — like the FBI or the media. Not a pleasant experience.
So why do so many companies treat cyber security as merely a technical problem that can be pushed down into the IT department?
Cyber security involves legal issues, human resources practices and policies, operational configurations, and technical expertise. But while each of these silo chieftains — the general counsel, the HR director, the chief operations officer, and the IT director — owns a piece of the problem, some of them don't know it, and none of them owns the whole thing. This makes information security a risk management and governance challenge, because unless these people attack the challenge together under a C-suite mandate, it can't be managed effectively. Unfortunately this rarely happens.
Information security cannot involve not locking down information that must move quickly. It does involve figuring out where information must move, and where it must not move. And above all, it means making rules that don't stifle creativity in the business. Protecting critical information protects corporate value and is a core responsibility of the board and executive management. Best-in class companies view information security as a value proposition — not merely as a deduction from the bottom line.