Hacking.BaBa

Avira, Mcdonalds, Hyundai And Microsoft Sites Hacked by Hmei7

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on">World 3rd most Dangerous hacker of the World in now a day "<span style="color: red;">Hmei7</span>" <span style="color: grey; font-family: Courier New; font-size: small;">indonesian<b> </b></span>hacker Hacked official sites of Avira, Mcdonalds, Hyundai And Microsoft. This kind of attack show the level of knowledge of those Black hats who remain under cover but still they are lot more power full the world Security Experts.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz-GvDkAB4H3juS_c6UiHtw2UNOeWSOUVXR9m0O3H8a1B1a3hYY-k6y1cUbrN_lMZ0rfm-mToRsHuZWxXJYCe2S8gP2ZOOYH_3ciaVj4bmPSZ93l3qzcYit60AIaGgH4Rs793QSS2tDF88/s1600/microsoft+hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz-GvDkAB4H3juS_c6UiHtw2UNOeWSOUVXR9m0O3H8a1B1a3hYY-k6y1cUbrN_lMZ0rfm-mToRsHuZWxXJYCe2S8gP2ZOOYH_3ciaVj4bmPSZ93l3qzcYit60AIaGgH4Rs793QSS2tDF88/s320/microsoft+hacked.png" width="320" /></a></div><br /><b>- Avira</b><br /><a href="http://avira.si/">http://avira.si/</a><br /><a href="http://www.zone-h.org/mirror/id/18292028">http://www.zone-h.org/mirror/id/18292028</a><br /><br /><b> - Mcdonalds</b><br /><a href="http://mcdonalds.md/">http://mcdonalds.md/</a><br /><a href="http://www.zone-h.org/mirror/id/18277764">http://www.zone-h.org/mirror/id/18277764</a><br /><br /><b>- Hyundai</b><br /><a href="http://hyundai.ps/interior.php">http://hyundai.ps/interior.php</a><br /><a href="http://www.zone-h.org/mirror/id/18286094">http://www.zone-h.org/mirror/id/18286094</a><br /><br /><b>- Microsoft</b><br /><a href="http://microsoft.com.mk/biznispaketi/x.htm">http://microsoft.com.mk/biznispaketi/x.htm</a><br /><a href="http://www.zone-h.org/mirror/id/18285958">http://www.zone-h.org/mirror/id/18285958</a><br /><br /></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Avira, Mcdonalds, Hyundai And Microsoft Sites Hacked by Hmei7

World 3rd most Dangerous hacker of the World in now a day "Hmei7" indonesian hacker Hacked official sites of Avira, Mcdonalds, Hyundai And Microsoft. This kind of attack show the level of knowledge of…

12 Sep 2012

Domino's Pizza says website hacked

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 style="background-color: white; border: 0px; color: #333333; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 26px; font-weight: normal; line-height: 30px; margin: 0px 0px 7px; outline: 0px; padding: 0px;">Domino's Pizza says website hacked</h1><div><h2 style="background-color: white; border: 0px; color: #666666; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px; font-weight: normal; line-height: 20px; margin: 0px 0px 10px; outline: 0px; padding: 0px;">Indian Domino's franchisee says that customer information was not leaked</h2></div><div><img height="400" src="http://news.hitb.org/sites/default/files/styles/article_large/public/field/image/500px-Dominos_pizza_logo.svg_.png" width="400" /> </div><div><br /></div><div><div>IDG News Service - The website of Domino's Pizza India was hacked, but customers' information was not compromised, the local franchisee Jubilant FoodWorks said on Wednesday.</div><div><br /></div><div>Personal information including names, phone numbers, email addresses, passwords and city details from 37,000 accounts was leaked from Domino's website to some blogs and websites by by a little-known Turkish hacker group, according to various reports earlier this week. It isn't clear why the group had targeted Domino's website.</div><div><br /></div><div>The hack reflects India's continuing problems with online security. In July, 2021 Indian websites were defaced, according to the government's Indian Computer Emergency Response Team (CERT-In). An earlier government estimate stated that a total of 112 government websites in India were hacked from December to February.</div><div><br /></div><div>Confirming that there was a security breach, Jubilant FoodWorks said it was limited to the "Wow Club" page on the brand website, and the hackers were able to steal some data which was non-commercial in nature. "They had posted the data on few blog sites which we have got blocked now," it added.</div><div><br /></div><div>The Wow Club gives members access to deals and offers at Domino's. Jubilant, which runs the website as Domino's franchisee for India, Nepal, Sri Lanka and Bangladesh, has said in its privacy statement that it requests personal information under certain circumstances, including when members want to order online or register with the Wow Club.</div><div><br /></div><div>Jubilant said its online pizza ordering site is fully secure, and there had not been any data leakage there. "This is a very unfortunate event which has happened despite the security ecosystem that we have created around our online assets," it said in a statement. The company said it had improved its security, monitoring and audits to avoid any such incident in future.</div><div><br /></div><div>Indian government websites have been frequently hacked, usually by groups that claim to be based in Pakistan. India and Pakistan have a longstanding border dispute. More recently a fledgling branch of Anonymous in the country has attacked Indian government and politicians' websites in protest against alleged Internet censorship in the country, by both hacking and denial-of-service attacks.</div><div><br /></div><div>Private companies have also been hacked, including Microsoft India's online store. The site was attacked in February by Chinese hackers who said they wanted the company's attention, but Microsoft later cautioned that the hackers may have also compromised customers' financial information. The website was hosted by a third-party service provider.</div></div></div>

Domino's Pizza says website hacked

Domino's Pizza says website hackedIndian Domino's franchisee says that customer information was not leaked IDG News Service - The website of Domino's Pizza India was hacked, but customers' information…

12 Sep 2012

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates</h1><div><br /><img alt="Microsoft releases two security bulletins for September 2012" src="http://i1-news.softpedia-static.com/images/news2/XSS-Vulnerabilities-Addressed-by-Microsoft-s-September-2012-Updates-2.png?1347441537" /> <br /><br /></div><div><div>Microsoft has issued two security bulletins as part of its September 2012 Patch Tuesday release. One noteworthy fact is that the company hasn’t made available so few bulletins since May 2011.</div><div><br /></div><div>The first bulletin – rated as Important - addresses a cross-site scripting (XSS) security hole present in Visual Studio Team Foundation Server.</div><div><br /></div><div><br /></div><div> Another Important XSS flaw has been identified in Microsoft System Center Configuration Manager, affecting Microsoft Systems Management Server 2003 Service Pack 3 and Microsoft System Center Configuration Manager 2007 Service Pack 2.</div><div><br /></div><div>Trend Micro researchers highlight the fact that such vulnerabilities have been utilized successfully on numerous occasions, several such attacks being recorded in 2011.</div><div><br /></div><div>As always, Microsoft customers are advised to apply the updates as soon as possible to ensure that they’re systems are protected. Fortunately for users, the bulletins don’t require that they restart their computers. </div><div><br /></div><div>Attacks that leverage these vulnerabilities haven’t been recorded so far, but that doesn’t mean they will not be launched in the future, which is why its highly recommended that the updates are applied.</div><div><br /></div><div>The Redmond company also took this opportunity to remind everyone of the fact that the October updates would come with a major security improvement. The use of RSA keys with a length less than 1024 bits will be restricted.</div><div><br /></div><div>“For those who find they are using certificates with RSA key lengths of less than 1024 bits, those certificates will be required to be reissued with at least a 1024-bit key length. (1024 should, by the way, be considered a minimum length; the most up-to-date security practices recommend 2048 bits or even better),” Angela Gunn of Trustworthy Computing explained.</div><div><br /></div><div>Here’s this month’s video in which Yunsun Wee provides further details regarding the two bulletins and the improvements made with the upcoming update:</div></div><div><br /><br /></div><div></div></div><br /></div>

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates

XSS Vulnerabilities Addressed by Microsoft’s September 2012 Updates Microsoft has issued two security bulletins as part of its September 2012 Patch Tuesday release. One noteworthy fact is that the com…

12 Sep 2012

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

<div dir="ltr" style="text-align: left;" trbidi="on"><table border="0" cellpadding="0" cellspacing="0" style="color: #9e9e9e; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; text-align: start; width: 725px;"><tbody><tr><td class="contentheadings" valign="top"><h1 id="htitle" style="color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches</h1><div><br /></div><div><img src="http://i1-news.softpedia-static.com/images/news2/August-2012-VIPRE-Report-Scams-Mobile-Malware-and-Privacy-Breaches-2.png?1347439404" /> </div><div style="color: #5e5e5e;"><br /></div><div><div><span style="color: #5e5e5e; font-size: x-small;">GFI Software has released its VIPRE Report for August 2012 and the numbers show that in the past month cybercriminals have been busy launching email scams, malicious mobile applications, and phishing campaigns.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">One of the biggest spam campaigns recorded in August revolved around Nationwide. Several variants of the bogus emails have been spotted, all of them attempting to lure internauts to websites where they were requested to hand over their account details.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Experts also noticed a lot of scam websites that relied on UK's Directgov logo in order to convince Internet users to sign up for all sorts of premium services.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">Last, but certainly not least, mobile malware and shady app markets have left their print on the last month of summer. </span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">And speaking of mobile malware, GFI researchers have analyzed the apps released by the Mitt Romney and Barack Obama presidential campaigns. They have discovered a number of privacy issues that most likely weren’t taken into consideration by most users when they installed the applications.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">For instance, the Romney app not only collects information from the mobile device, but it also asks customers to sign in through their Facebook account. This allows it to post messages on the social media network on their behalf.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“The past month’s examples show that the world of smartphone applications has firmly become a battleground for scammers and malware writers, keen to take advantage of unsuspecting users,” Christopher Boyd, senior threat researcher at GFI Software, explained.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“Avoiding mobile malware often requires the same preventative tactics associated with traditional malware such as verifying the legitimacy of any unsolicited emails or hyperlinks before installing an unknown application or submitting personal information,” Boyd added.</span></div><div><span style="color: #5e5e5e; font-size: x-small;"><br /></span></div><div><span style="color: #5e5e5e; font-size: x-small;">“However, as we saw this month, the increased activity aimed at mobile devices doesn’t mean traditional attacks, such as desktop malware and email scams, have become any less of a threat.”</span></div><div><span style="color: #5e5e5e; font-size: x-small;"> Add me on Google+</span></div></div><div style="color: #5e5e5e;"><br /></div></td></tr></tbody></table></div>

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches

August 2012 VIPRE Report: Scams, Mobile Malware and Privacy Breaches GFI Software has released its VIPRE Report for August 2012 and the numbers show that in the past month cybercriminals have been bus…

12 Sep 2012

SMS-Sender Trojans Served by Shady Google Play Replica Site

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 id="htitle" style="background-color: white; color: #001f5b; font-family: Arial, Helvetica, sans-serif; font-size: 34px; letter-spacing: -2px; line-height: 34px; margin: 3px 0px 5px;">SMS-Sender Trojans Served by Shady Google Play Replica Site</h1><div><img alt="Shady Android app market" height="311" src="http://i1-news.softpedia-static.com/images/news-700/SMS-Sender-Trojans-Served-by-Shady-Google-Play-Replica-Site.png?1347437964" width="640" /> </div><div><div>Although the Olympics and the Paralympics have come to an end, researchers say that cybercriminals are still relying on them to spread their malicious elements. A site that attempts to replicate Google Play – iplay-andro7d.net - has been found to serve all sorts of shady apps that hide an SMS Trojan.</div><div><br /></div><div>The applications hosted on the site – Skype, Firefox, Facebook, Instagram and others – hide a nasty Trojan (Trojan.AndroidOS.Generic.A) that sends out SMS messages to premium rate numbers, inflating the bills of unsuspecting Android users, GFI researchers note.</div><div><br /></div><div>Apparently, the malicious app market - proudly displaying the Olympics logo - only serves the Trojan-infested software to internauts who access it from an Android device, a trick successfully utilized in the past.</div><div><br /></div><div>Again, we will take this opportunity to advise users to refrain from downloading applications from untrusted alternative Android markets. Also, beware of Olympics scams as it seems they’re still doing the rounds.</div></div></div>

SMS-Sender Trojans Served by Shady Google Play Replica Site

SMS-Sender Trojans Served by Shady Google Play Replica Site Although the Olympics and the Paralympics have come to an end, researchers say that cybercriminals are still relying on them to spread their…

12 Sep 2012

Consumer cybercrime cost India $8 billion in last 12 months: Norton

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;">Consumer cybercrime cost India $8 billion in last 12 months: Norton</span> <br /><span style="font-family: Georgia, 'Times New Roman', Times, serif; font-size: 30px;"><br /></span> <br /><div class="newslist_img" style="color: #4e4e4e; float: left; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 10px; margin-right: 10px; margin-top: 10px;"><img alt="more-hacking.jpg" class="imgbdr" id="HeadContent_FullstoryCtrl_mainstoryimage" src="http://cdn.ndtv.com/tech/images/gadgets/more-hacking.jpg" style="background-color: white; border: 1px solid rgb(225, 225, 225); padding: 4px;" /></div><div style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;"></div><div id="HeadContent_FullstoryCtrl_fulldetails" style="color: #4e4e4e; font-family: Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;">Software security services provider Norton today said consumer cybercrime has cost the country a whopping USD 8 billion or around Rs 42,000 crore in the past 12 months, impacting 42 million people.Releasing the findings of its annual cybercrime report, it is estimated that over 42 million people fell victim to cybercrime in the past 12 months in the country, incurring around USD8 billion in direct financial losses. In terms o cost, this is a full 18 percent increase.<br />Against this, the global loss has been pegged at USD110 billion.<br />The study further notes that as many as 66 percent of online adults have been a victim of cybercrime in their lifetime in the country. During the past 12 months, as many as 56 percent of online adults here have experienced cybercrime- that is over 1,15,000 victims per day, 80 victims per minute and over one every second.<br />According to the report, the average direct financial cost per victim is USD192, which is up 18 percent over 2011 when it was USD163.<br />One key finding this year is that both the cost per victim as well as social and mobile incidents are on the rise due to cybercrime.<br />The study is based on the findings of self-reported experiences of over 13,000 adults across 24 countries, Norton by Symantec said in a statement.<br />Globally, every second, 18 adults fall a victim of cybercrime, resulting in over 1.5 million cybercrime victims each day. With losses totaling an average of USD197 per victim across the world in direct financial costs, in the past 12 months, an estimated 556 million experienced cybercrime, represents 46 percent of online adults in the past 12 months, says the report. Last year the percentage was 45 percent.<br />The survey has found an increase in new forms of cybercrime compared to last year, such as those found on social networks or mobile devices, indicating that cybercriminals are starting to focus their efforts on these increasingly popular platforms.<br />One in three online adults (32 percent) has been a victim of either social or mobile cybercrime during the past 12 months, and 51 percent of social network users have been victims of social cybercrime in the country.<br />As many as 22 percent of social network users reported someone have hacked into their profile and pretended to be them, while 15 percent users said they have fallen victim to a scam or fake link on their social network platform.<br />"Cybercriminals are changing their tactics to target fast growing mobile platforms and social networks where consumers are less aware of security risks," says Norton by Symantec Asia director and internet safety advocate Effendy Ibrahim said.</div></div>

Consumer cybercrime cost India $8 billion in last 12 months: Norton

Consumer cybercrime cost India $8 billion in last 12 months: Norton Software security services provider Norton today said consumer cybercrime has cost the country a whopping USD 8 billion or around R…

12 Sep 2012

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h2 style="color: #4c586c; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 32px; font-weight: lighter; margin: 0px;">DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More</h2><div><br /></div><div><img src="http://ctovision.com/wp-content/uploads/DHS.png" /> </div><div><br /></div><div><div style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px; padding: 0px 0px 8px;">Here is today’s federal cybersecurity and information technology news:</div><ul style="background-color: white; color: #4c4d4f; font-family: Georgia, 'Times New Roman', Times, serif; font-size: 13px; line-height: 19px;"><li>As many security experts suspected, the Apple device ID’s that Anonymous claimed came from a Federal Bureau of Investigation agent’s hacked laptop actually came from the hack of an application development company. More <a href="http://www.wired.com/threatlevel/2012/09/udid-leak-traced-to-blue-toad/" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>A new survey finds that although much of federal information technology has not yet moved to the cloud, agencies seem to be gaining confidence in moving more critical systems to the cloud. More <a href="http://www.fiercegovernmentit.com/story/survey-cloud-migration-slow-possibly-more-confident/2012-09-10" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>The Executive Office of the President is seeking a unified system for managing thousands of internship applications. More <a href="http://www.nextgov.com/cio-briefing/2012/09/white-house-seeks-unified-system-manage-interns/57989/?oref=ng-channelriver" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>Secretary of the Department of Homeland Security Janet Napolitano called for guidelines to facilitate public-private cybersecurity information sharing at a recent conference. More <a href="http://searchsecurity.techtarget.com/news/2240162981/Napolitano-calls-for-cybersecurity-intelligence-information-sharing" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li><li>In an attempt to bolster their cybersecurity workforce, the Department of Homeland Security is encouraging qualified hackers to apply even if they don’t have a college degree or don’t intend to stay at the position indefinitely. More <a href="http://blogs.csoonline.com/security-leadership/2355/cso-security-standard-dhs-wants-you-little-while-least" style="color: #256790; text-decoration: none;" target="_blank">here</a>.</li></ul></div></div>

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More

DHS Looking Outside the Box for Hackers, Feds Warm Up to the Cloud, and More Here is today’s federal cybersecurity and information technology news:As many security experts suspected, the Apple device …

12 Sep 2012

Cosmo the God Hacker

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><img height="227" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw1.jpg" width="400" /> </div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><br /></div><div style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><span style="color: #333333;">Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet he’s getting bigger, because Cosmo — also known as </span><a href="http://twitter.com/cosmothegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cosmo the God</a><span style="color: #333333;">, the social-engineering mastermind who weaseled his way past </span><nobr style="color: #333333; margin: 0px; padding: 0px;">security systems</nobr><span style="color: #333333;"> at</span><span style="color: red;"> Amazon, Apple, AT&T, PayPal, AOL, Netflix, Network Solutions, and Microsoft — is just 15 years old.</span></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">He turns 16 next March, and he may very well do so inside a prison cell.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was arrested along with dozens of others <a href="http://www.fbi.gov/newyork/press-releases/2012/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-24-arrests-in-eight-countries-as-part-of-international-cyber-crime-takedown" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">in a recent multi-state FBI sting</a> targeting credit <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_3_0_2" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">card</a></nobr>fraud. It is the day before his court date, but he doesn’t know which task force is investigating him or the name of his public defender. He doesn’t even know what he’s been charged with. It’s tough to narrow it down; he freely admits to participation in a wide array of crimes.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">With his group, UGNazi (short for “underground nazi” and pronounced “you-gee” not “uhg”), Cosmo took part in some of the most notorious hacks of the year. Throughout the winter and spring, they DDoS’ed all manner of government and financial sites, including NASDAQ, ca.gov, and CIA.gov, which they <a href="http://www.telegraph.co.uk/technology/news/9222447/Hackers-claim-credit-for-CIA-website-going-offline.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">took down for a matter of hours in April</a>. They bypassed Google two step, hijacked 4chan’s DNS and redirected it to their own Twitter feed, and repeatedly <a href="http://www.leakedin.com/2012/04/17/page/2/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">posted Mayor Michael Bloomberg’s address and Social Security number online</a>. After breaking into one billing agency using social-engineering techniques this past May, they proceeded to dump <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">some 500,000 credit card numbers online</a>. Cosmo was the social engineer for the crew, a specialist in talking his way past security barriers. His arsenal of tricks held clever-yet-idiot-proof ways of getting into accounts on Amazon, Apple, AOL, PayPal, Best Buy, Buy.com, Live.com (think: Hotmail, Outlook, Xbox) and more. He can hijack phone numbers from AT&T, Sprint, T-Mobile and your local telco.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was a big deal,” Mikko Hypponen, the chief security researcher at F-Secure, told Wired via email. “The Cloudflare hack was a big deal. They could have done much more with that technique.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">So, yes, he is Cosmo the God. But before he was Cosmo, he was Derek*. And while Cosmo may be a god, Derek is just a kid. A high school dropout. A liar, fraud, vandal and thief. But ultimately a kid, without much adult supervision or guidance.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I met Cosmo by accident and opportunity, after hackers used social-engineering techniques <a href="http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">to circumvent Apple’s and Amazon’s security mechanisms and break into my accounts</a>. They wrought enormous damage, wiping my computer, phone and tablet, deleting my Google account, and hijacking my Twitter account.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">After it happened I fell into their world and began communicating regularly with the very hacker who jacked me, a kid named <a href="http://www.twitter.com/phobiathegod" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Phobia</a>. He introduced me to Cosmo, who wanted to tell me about all manner of other account vulnerabilities. And last month, I flew down to Long Beach to talk to him face to face.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">*<em style="margin: 0px; padding: 0px;">Editor’s note: Because he is a minor, Wired is not disclosing Cosmo’s real name</em>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115561" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115561" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw3-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw3" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;">The suburban Southern California neighborhood that Cosmo calls home. <em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Becoming Cosmo</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo squirms in his chair as we sit in his grandmother’s living room. Her small <nobr style="margin: 0px; padding: 0px;"><a class="FAtxtL" href="http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/#" id="FALINK_1_0_0" style="background-color: transparent !important; border-bottom-color: rgb(28, 125, 255) !important; border-bottom-style: solid !important; border-bottom-width: 1px !important; color: rgb(28, 125, 255) !important; display: inline !important; margin: 0px; outline: none; padding-bottom: 1px !important; padding-left: 0px; padding-right: 0px; padding-top: 0px;">apartment</a></nobr>, with dark brown carpeting, is directly downstairs from his own. The front door is open to let the breeze blow. It’s hot, even sitting next to a fan. There is a picture of Jesus on a table. Cosmo’s family has lived in Long Beach for four generations; in fact, his great grandfather poured the foundation on the very property where we now sit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo lives upstairs with his mother, who he says typically works six days a week as an insurance claims adjuster. She gets home late in the evening. He doesn’t speak to his father. They live just south of State Route One in Long Beach. When I look up their address on <a href="https://www.crimereports.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">CrimeReports</a>, it is right on the border of a zone where crime is extremely frequent and violent. But Derek doesn’t get involved with any of that, says his grandmother.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Derek is always, always home. He don’t go anywhere,” says his grandmother. “He’s a good kid. He’s a very good kid.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">That may be, but it turns out this wasn’t his first tangle with the law. He describes previous run-ins as he sits cramped, legs and head akimbo, in the passenger seat of my rental car, while we drive around looking for a quiet place to talk. The year before, he’d been arrested after getting caught smoking pot in a bathroom at school. I ask if that was the only other time. He says it was. Then he pauses.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Oh! And I also got, I guess you could say arrested, in October 2011. <a href="http://belmontshore.patch.com/articles/wilson-high-bomb-scare-evacuates-most-of-4300-students" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Someone called in a bomb threat to my school</a>. They did it every day of the school week, and on the fifth day they said my name. The fifth day they called in and said I had a gun. It was other hackers.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo’s name and address — his documents, or “dox” as hackers know them — have long been published online. And it’s meant he’s been a target for both vengeance and lulz — just, you know, because he’s Cosmo the God and one of the more notorious social engineers around.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Someone also swatted my house,” he tells me, smiling. “It happens a lot to me. Well, the SWAT team was only once at my house, but lots of time with the local police department.” Swatting is a vicious prank where a hacker uses an internet call system to report a hostage situation, which scrambles local law enforcement to the victim’s doorstep.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Through AOL, you can use <a href="http://relayservices.att.com/content/2/im_relay_3.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">AT&T Relay</a> to call the SWAT. It’s for handicapped people. You have to sign up, but it’s easy to sign up. You just instant message the username AT&T Relay and then 911. They ask what’s your location, the emergency. That’s what they did to me. That’s what they did to my school too, because there’s less ways of getting caught.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo shrugs at this, like it’s all perfectly normal stuff for a teenage boy. And the thing is, in 2012, it is perfectly normal for a bored teenage boy on the edge of delinquency. Instead of egging cars and swinging bats at mailboxes, he’s breaking into e-mail accounts.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo got into hacking via online gaming. He grew up on Xbox, and played others online competitively. One day, he was knocked offline mid-match, forfeiting the game. He discovered that this was done via a simple trick, where one gamer turns a script on his opponent’s IP address. He began using this same tactic himself. It was easy and required nothing more than off-the-shelf programs, like <a href="http://www.youtube.com/watch?v=e19D9E3e0b0" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Cain and Able</a>. It was a veil lifted.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Xbox gamers know each other by their gamertags. And among young gamers it’s a lot cooler to have a simple gamertag like “Fred” than, say, “Fred1988Ohio.” Before Microsoft beefed up its security, getting a password-reset form on Windows Live (and thus hijacking a gamer tag) required only the name on the account and the last four digits and expiration date of the credit card on file. Derek discovered that the person who owned the “Cosmo” gamer tag also had a Netflix account. And that’s how he became Cosmo.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Netflix and it was so easy,” he chuckles. “They said, ‘What’s your name?’ and I said, ‘Todd [Redacted],’ gave them his e-mail, and they said, ‘Alright your password is 12345,’ and I was signed in. I saw the last four digits of his credit card. That’s when I filled out the Windows Live password-reset form, which just required the first name and last name of the credit card holder, the last four digits, and the expiration date.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This method still works. When Wired called Netflix, all we had to provide was the name and e-mail address on the account, and we were given the same password reset.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo says he did not know with certainty Netflix had the information he wanted prior to the call. But his success was an ah-ha moment.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I figured that if Netflix could score, so could any big provider. Back then, Amazon was easier. And then it got a little bit more security. They made it where you needed the last four of the credit card to reset [a password]. That’s when I figured out you just have to go to fakenamegenerator.com to get a credit card number. So, I would just add the card, hang up, call back, give them the last four and they’d reset it.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This Amazon method, the same one other hackers used to break into my accounts, was one of Cosmo’s innovations. (Although other hackers also claim to have discovered it independently.) I ask him how he figured out he could pull it off, because it’s as clever as it is devious. He shrugs. “It just came to me.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><div class="wp-caption alignnone" id="attachment_115668" style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px 0px 5px; width: 670px;"><a href="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4.jpg" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="size-large wp-image-115668" data-lazy-loaded="true" height="440" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/hackerbw4-660x440.jpg" style="border: none; display: inline; margin: 0px; padding: 0px;" title="hackerbw4" width="660" /></a><br /><div class="wp-caption-text" style="background-color: black; color: #dddddd; font-size: 12px; line-height: 15px; margin-right: 10px; margin-top: -5px; padding: 10px;"><em style="margin: 0px; padding: 0px;">Photo: Sandra Garcia/Wired</em></div></div><br style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin: 0px; padding: 0px;" /><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Enter UGNazi</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was soon finding all manner of sources for getting information: Hulu, Buy.com, BestBuy, PayPal, Apple and AOL all offered avenues into others’ accounts, where he could peep in at credit card numbers, addresses and emails.  He learned new social-engineering techniques online and likewise passed along what he knew to others. There is a constant information trade back and forth online. IRC and AIM are the user manuals to every back-end customer service system in corporate America.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Meanwhile, he had more time than ever to devote to his particular brand of hacking, also known as socialing. After the bomb threats, he was asked to leave Woodrow Wilson High School in October. He started taking classes at an adult continuing education program where he could complete his degree. But he found it boring. And he had to walk there and back, three miles each way. So in December, he quit.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">This meant he was now home all the time, bored. The next month, an online friend of his approached him about joining a new hacking team. The friend was Josh the God, and he was putting together a hacktivist group called UGNazi, with the intention of using their combined skills to protest SOPA and CISPA. Far from being intimidated by the proposed anti-piracy legislation, they were motivated by it. They wanted to attack it and those who supported it. Cosmo’s job was to socially engineer companies that could provide data about their targets.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">One of their initial targets was UFC.com–the website of the Ultimate Fighting Championship–in retaliation for its support of SOPA. (They did the same to Coach.com.) Once Cosmo gathered the necessary background information on UFC’s president, Dana White, they were able to get into the company’s account with Network Solutions. Via Network Solutions, they redirected the DNS to one they controlled. Bang.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">SOPA, of course, died. But UGNazi lived on. They took down the websites for the states of California and Washington and the cities of New York and Washington D.C. They took out Papa John’s website after it<a href="https://twitter.com/UG/status/204715194801328129" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">failed to deliver a pizza in a timely manner</a>. They hacked into MyBB.com, the back-end that many websites use to power forums, and then hijacked its domain. They were pure mayhem.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“UGNazi was also remarkable in how they apparently had no limits on who to attack–the U.S. government, CIA, Wounded Warrior etc.” says Hypponen, “and no apparent [sense of] self preservation, which led to their demise. In this regard, UG and Lulzsec were similar.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The group’s <a href="http://www.net-security.org/secworld.php?id=13032" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">last big takedown was 4Chan</a>. “Josh thought everyone on 4chan was a child molester,” Cosmo explained. But there was more than likely another motivation as well: Lulz. Not to mention huge traffic. If they could redirect 4chan to their own Twitter feed, even for a minute, they would achieve instant notoriety.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Their avenue to jack 4chan was a web services company called CloudFlare that was providing 4chan’s DNS services. (Ironically, UGNazi.com was also a CloudFlare customer.)</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The original idea was to take CloudFlare via Network Solutions, something UGNazi done many times before with other companies. They had gotten CloudFlare CEO Matthew Prince’s dox and had all the information they typically needed to hijack a NetSol account. But they hit a snag: Prince had a two-step security mechanism on his account. They needed a device-specific PIN code that they couldn’t get. But they had been able to ascertain that Prince’s phone number was on AT&T, which meant they had another avenue of attack: his Google email, <a href="http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">which used that AT&T number as an account recovery option</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Security is only as strong as its weakest link. And in this case, the weak link was AT&T. If UG Nazi could get to Prince’s phone, which was his backup mechanism, they could get to his Google account. And to get to his phone, they just needed his Social Security number. That sounds like it’s a tough thing to get. It’s not.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Social Security numbers are freely bought and sold online, not on hidden Tor sites or via some dark back alley, but on the open Web in broad daylight. The cost to buy a Social Security number and date of birth on one Russian site Cosmo referred us to, for example, is $3.80, payable via an alternative currency favored by carders called <a href="http://www.libertyreserve.com/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">Liberty Reserve</a>.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Once they had Prince’s Social Security number, it was time to manipulate AT&T’s customer service.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“First we called AT&T to forward [Prince’s] cell phone number to Google Voice. We did that, and the lady said ‘alright what’s your name?’ And Josh said ‘Matthew Prince.’ And the lady said, ‘what’s the last four digits of your SSN?’ And Josh gave the full SSN anyway. And she was like ‘alright what’s the phone number you want to forward it to?’</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“He gave her the Google Voice number, and it was forwarded.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo initially said UGNazi used text message forwarding, which both Google and Prince say is not the case. Furthermore, while Wired was able to set up a forwarding number in the manner Cosmo described, we were not able to forward text messages to Google Voice from AT&T. Voice yes, text no. It’s the one glaring inconsistency in everything Cosmo reported. When I asked him about it again, via AIM, he replied “maybe it’s just voice for them then.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As Prince described the attack to Wired, his personal Gmail address was the backup address for his corporate Google Apps email. Although he had two step on the corporate account, he did not have it on the personal one. Furthermore, his phone number was the account-recovery option on that personal address. So UGNazi sent an account recovery request to his phone, which was forwarded to their number, and then used it to take over his personal Gmail.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Once they were in that, they used it to get into my corporate email by doing an account recovery, which was sent to my personal email,” says Prince. “Even though I had two-factor authentication on, for this one account-recovery procedure, Google didn’t verify any out-of-band system. They just sent the email to my personal Gmail and then, once they were in that, they were able to get into my personal email.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Google says this type of attack is no longer possible. A Google spokesperson gave Wired a statement noting “We fixed a flaw that existed in the account recovery process for Google Apps for Business customers under very specific conditions. If an administrator account that was configured to send password reset instructions to a registered secondary email address was successfully recovered, 2-step verification would have been disabled in the process. This could have led to abuse if their secondary email account was compromised through some other means. We swiftly resolved the issue to prevent further abuse.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Ultimately, the end result was that UG Nazi was able to bypass the Google two factor and gain access to Prince’s CloudFlare’s email and then admin tools. They were then able to redirect 4Chan’s DNS to point to their own Twitter account. The hack lasted mere minutes, but given 4chan’s traffic volume, it was enough. It was extremely high profile, and UG Nazi was now basically the most notorious hacking crew of 2012.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">People Are The Key to Every Lock</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As he did with Prince and CloudFlare, Cosmo accomplished many of his feats by going after individuals associated with organizations UG Nazi was targeting. He would gather little bits of information here and there, collecting dox data from various online services, like addresses and credit card numbers, until he had what he needed to launch an attack. Often, he did that by calling a company’s tech support system and pretending to be a worker in another department. Sometimes he was able to pull that off by learning intimate details of a company’s back-end systems.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I had a friend who installed a remote access tool on a Netflix computer. When [the Netflix employee] was AFK–not at the computer–he could use that computer. From there he took a bunch of screenshots, and saw the [support] <a href="http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">tool was called Obiwan</a>.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo couldn’t actually use Obiwan himself because he didn’t have a Netflix IP address. But that didn’t matter. He just needed to know what the back end looked like.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to impersonate a Netflix agent. So you call up and say ‘Hey, my name is Derek. I’m from Netflix Canada and I’m having a technical difficulty with Obiwan. Can you look something up for me?’ Then you say the email, the name, the billing, and then you ask for the last four. Then you just call back and reset their password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And that’s the secret. When Cosmo calls a company pretending to be an employee, he doesn’t wait for them to ask for details. He tells them all the person’s data he has up front. If he knows three pieces of a puzzle and just needs the fourth, he gives them those first without waiting to be asked for them. That way he demonstrates a knowledge of the system, disarming the person on the other end of the line and making them less likely to question his authenticity.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo sometimes even provides details that he knows tech support doesn’t need. For example, if a tech support requires only the zip code on file, he’ll provide the full address anyway. It makes him appear more knowledgeable and less likely to be questioned. That’s classic social engineering.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You can pretty much do it at any company–impersonate an agent,” he shrugs and smiles. “Most people will fall for it unless they’ve been trained not to. But most companies aren’t doing that.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Some of his techniques are incredibly complicated and involve multiple levels of social engineering, like the method he developed for getting into PayPal.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The inside of a PayPal account is a trove of information for social engineers. Once logged in, you can see the last four digits of someone’s credit cards and bank accounts, and their current billing address. That information can, in turn, be used to obtain password resets on all sorts of other sites. More nefariously, once inside someone’s PayPal account, you can flat out rob them.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo explained exactly how it is done.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You have to add a bank account. You can make a virtual bank account on eTrade.com with info from FakeNameGenerator.com.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired verified that it’s possible to create online bank accounts with automatically generated information–although we were also required to enter a driver’s license number, which we got via a second site, using the information from FakeNameGenerator.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“You call PayPal, and you have to have the last four of a payment method. You can get that from Amazon or you can impersonate a PayPal agent. They access your account from the last four. You tell them you want to add a phone number, and you add a Google Voice number. And then you say, I also want to add a new bank account I just got. And they add that for you.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Then you hang up, go to PayPal.com, and go to Reset My PayPal Account. It says send to a phone number and shows the last digits. You pick your Google Voice number, and then it [calls] your phone. You enter that, and you go to a new page of verification that says please enter your full bank account with routing number. You just add the bank account number you made with E-Trade. And once you click next, it prompts you to create a new password.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to replicate this method and receive PayPal password resets. After we disclosed the issue to PayPal, the company closed this security hole. PayPal’s director of communications, Anuj Nayar, told Wired this was a temporary issue caused by product testing that was accidentally left open and had now been closed.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired’s subsequent tests found this to be the case, although we could still add a phone number to an account, PayPal would no longer send a password reset to it until it had been verified by logging in.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"></div><h2 style="background-color: white; font-family: Arial, Verdana, sans-serif; font-size: 1.3em; line-height: 1.3; margin: 0px; padding: 0px;">Busted</h2><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo was still sleeping when the police arrived at his apartment. Officers and a detective with the Long Beach Police Department searched his home and seized three of his netbooks and his iPod Touch. They put him in handcuffs and refused to let him change clothes out of the shorts and t-shirt he’d been sleeping in the night before. Then they took him to the Los Padrinos Juvenile Hall, where he spent the next two days.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">They raided his grandmother’s home, too.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I was in the bathroom and I heard some guys talking,” she says. “When I opened up the bathroom door there was this cop standing right at the door. He stood right inside this door and it startled me. He took me by my arm and told me to come in and sit down. I sat down and the three cops were standing over there and they just stood there. I was startled and some cops walked by with Derek, and he was handcuffed.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo suspects the raid was tied to UGNazi’s participation in the <a href="http://www.forbes.com/sites/andygreenberg/2012/05/22/hackers-impersonate-web-billing-firms-staff-to-spill-500000-users-passwords-and-credit-cards/" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;">WHMCS credit card dump</a>, when they dropped a half million credit card numbers on the open Web, and not the CloudFlare hack that ultimately landed UGNazi on the FBI’s hit list. Still, he expressed remorse for what had gone down with Prince and for people who were still having accounts compromised via methods he pioneered.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“I called Matthew Prince the night before [the hack],” Cosmo told me. “I was going to tell him about it. I called through AT&T relay and he hung up on me. I was just going to let him know, ‘Your site’s about to get hacked.’ Josh was going to do it anyway, but…”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Did Cosmo really try to warn Prince? Prince confirms that he did get several calls via an AT&T relay the night before. And while a warning may seem far fetched, it would not be completely out of character.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;"><a href="http://www.wired.com/gadgetlab/?attachment_id=114934" rel="attachment wp-att-114934" style="color: #007ca5; margin: 0px; outline: none; padding: 0px; text-decoration: none;"><img alt="" class="alignleft size-medium wp-image-114934" data-lazy-loaded="true" height="300" src="http://www.wired.com/images_blogs/gadgetlab/2012/09/Screen-Shot-2012-09-04-at-3.52.38-PM-119x300.png" style="border: none; display: block; float: left; margin: 0px; padding: 5px 20px 5px 0px;" title="Cosmo and Mikko" width="119" /></a>For example, I was hacked long after Cosmo was arrested and had lost his ability to do any more damage. Yet he managed to learn about how it was done and attempted to relay that information to me via Mikko Hypponen, whom we both follow on Twitter. It was too late, but, still, he made the effort.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">And then there’s the question of why he’s speaking to me at all. Why he’s essentially incriminating himself before he goes to trial. He ultimately reached me via Phobia, the guy who hacked me. Phobia said Cosmo wanted to tell me about a specific AOL account hack that they wanted closed. From my first interaction with Cosmo, weeks ago, through today, he has maintained this was his motivation for talking.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">The method Cosmo described for taking an AOL account away from its owner is distressingly simple. Worse, multiple hackers described the AOL exploit as ancient and well known. In short, it takes nothing more than someone’s name and address to take over their AOL email.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">To get a password reset on a free AOL email or chat account, all one needs to give the over-the-phone tech-support worker is the first and last name and zip code on the account. For a paid account, AOL asks for either the address or the last four digits of the credit card on file.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Cosmo tells me this casually, while drinking water from a plastic bottle. I stare at him.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“Yeah…. that’s all you need to do.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">Wired was able to confirm this and received password resets on both paid and free accounts, despite being being unable to answer account security questions. In some cases, we even deliberately provided incorrect answers. After we informed AOL, it quickly halted issuing password resets over the phone.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">“We looked into the matter and found that there was, in fact, a gap in our phone support processes,” AOL’s Senior Vice President for Mail and Mobile David Tempkin informed Wired via email. “We addressed the problem immediately, and as of today, AOL users are better protected — it’s no longer possible to hack into an account via a phone-based password reset.”</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">As a direct result of Cosmo coming forward, PayPal and Aol changed their account security procedures. For me, this only adds to his enigma.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">I wonder how much of everything else Cosmo has told me is true. The only thing I am certain of is that online security is an illusion. But I think he is being honest now. I think he’s genuinely remorseful and just wants all these gaping account holes, many of which he found or helped publicize, closed at last before anyone else has their identity stolen, or the SWAT team sent to their door. That’s what I believe, at least.</div><div style="background-color: white; color: #333333; font-family: Arial, Verdana, sans-serif; font-size: 14px; line-height: 20px; margin-bottom: 20px; margin-top: 20px; padding: 0px;">But then, he’s a very, very good liar.</div></div><a class="twitter-follow-button" data-show-count="false" href="https://twitter.com/thehackersmedia">Follow @thehackersmedia</a><script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div>

Cosmo the God Hacker

Cosmo is huge — 6 foot 7 and 220 pounds the last time he was weighed, at a detention facility in Long Beach, California on June 26. And yet he’s getting bigger, because Cosmo — also known as Cosmo th…

12 Sep 2012

Florida firm was Hacked, exposing Apple ID numbers

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 style="background-color: white; border: 0px; color: #242424; font-family: Droid-Serif, georgia, serif; font-size: 23px; font-weight: normal; line-height: 25px; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Florida firm was hacked, exposing Apple ID numbers</h1><div><br /></div><div><img alt="   " src="http://assets.bizjournals.com/dallas/news/apple%20carousel.jpg?v=1" /> </div><div><br /></div>BlueToad, an Orlando digital publishing company, has said that it is the source of the 1 million Apple IDs that were stolen last week, according to the Los Angeles Times.<br />AntiSec, a hacker group associated with Anonymous, posted the IDs online.<br />The group said it had hacked the IDs from an FBI officials’ laptop. The FBI denied this and BlueToad took responsibility on Sept.10 after its CEO, Paul DeHart, saw that the posted IDs closely matched his company’s data.<br />BlueToad, which develops apps for magazine, newspaper and book publishers, went to the FBI and to Apple (Nasdaq: AAPL) as soon as it discovered the match.<br />AntiSec had stated that 12 million IDs had been stolen and that it had also taken corresponding email addresses, phone numbers and other information. DeHart said this is not true and that “we don’t have any reason to believe they have any other information from our users.”<br /></div>

Florida firm was Hacked, exposing Apple ID numbers

Florida firm was hacked, exposing Apple ID numbers BlueToad, an Orlando digital publishing company, has said that it is the source of the 1 million Apple IDs that were stolen last week, according to t…

12 Sep 2012

GoDaddy hacked by Anonymous? Not likely

<div dir="ltr" style="text-align: left;" trbidi="on">GoDaddy hacked by Anonymous? Not likely<br /><br /><img src="http://www2.macleans.ca/wp-content/uploads/2012/09/GoDaddy-tp.jpg" /> <br /><br /><br />Yesterday the massive Internet registrar/lowbrow advertiser GoDaddy went down, taking millions of web sites offline with it. Breaking news reports attributed the trouble to a hack by Anonymous. Later, these items were corrected to say that the hack was not the work of Anonymous as a whole, but that Twitter user @AnonymousOwn3r was claiming responsibility. Mashable called @AnonymousOwn3r ”the security leader of Anonymous,” which must be true because @AnonymousOwn3r calls themself “the security leader of Anonymous” on his or her Twitter profile (and an “official member” to boot).  CNN went with the more measured description of @AnonymousOwn3r as “a person affiliated with Anonymous.”<br /><br />All of this is very silly. Anonymous isn’t an organized group of any kind and has no office or officer to make anything official. It has no leaders of security or of anything else, but I guess it does have affiliates. You become one by being anonymous on the Internet. Are you logged in to Macleans.ca right now as you read this? If not, you are a person affiliated with Anonymous.<br /><br />Whoever @AnonymousOwn3r is, they’ve gained notoriety and thousands of new followers in the last 24 hours and are likely having a laugh at the media right now. It might be a big laugh, because @AnonymousOwn3r might have had nothing to do with GoDaddy’s troubles.<br /><br />GoDaddy is claiming today that they were not, in fact, hacked at all. CEO Scott Wagner said in a statment today that the outage had nothing to do with a hack or with a denial of service attack, Anonymous’ brute force method of pushing sites offline. Instead, it was “due to a series of internal network events that corrupted router data tables” (which is totally what I thought it was from the start).<br /><br />Could Wagner’s statement be face-saving bluster? Possibly, but if so, he would be playing a very risky game. Hackers are usually all too happy to provide technical proof of their deeds, and if necessary, demonstrate their “ownage” of a site by smacking it offline again. @AnonymousOwn3r is assuring doubters that he or she is the real deal and linking to GitHub text purportedly documenting GoDaddy’s vulnerabilities.<br /><br />As security experts analyze this, we’ll find out who is lying: CEO Scott Wagner or @AnonymousOwn3r.<br /><br />My best guess? GoDaddy went dark due to some internal technical glitch, some random indvidual took credit, the media ran with it, and “lulz” ensued.<br /></div>

GoDaddy hacked by Anonymous? Not likely

GoDaddy hacked by Anonymous? Not likely Yesterday the massive Internet registrar/lowbrow advertiser GoDaddy went down, taking millions of web sites offline with it. Breaking news reports attributed th…

12 Sep 2012

Load more posts