The 10 Most Infamous Student Hackers of All Time

Hacking has always been inherently a young person’s game. The first usage of the word “hacker” was to describe pranksters meddling with the phones at MIT. Many hackers have cited boredom, a desire for change, or the thrill of going somewhere one is not supposed to go as their motivation for hacking, all of which could apply to scores of common activities on college campuses. While today’s hacking scene is dominated by large hacking groups like Anonymous and Masters of Deception, many of the greatest hacks ever have been pulled off by college, high school, and even middle school kids who rose to infamy armed only with a computer and the willingness to cross the bounds of legality.

1. Sven Jaschan:
   In the words of one tech expert, “His name will always be associated with some of the biggest viruses in the history of the Internet.” The viruses: the Sasser and NetSky worms that infected millions of computers and have caused millions of dollars of damage since their release in 2004. The man behind the viruses proved to be not even a man at all, legally. Seventeen-year-old hacker Sven Jaschan, a student at a computer science school in Germany, claimed to have created the viruses to become a hero by developing a program that would eradicate the rampaging Mydoom and Bagle bugs. Instead he found himself the subject of a $250,000 bountycourtesy of Microsoft, for which some of his classmates turned him in.
2. Jonathan James:
   In 2000, at the age of 16, James, or “C0mrade” as he was known in the hacker community, infamously became the first juvenile federally sentenced for hacking. The targets of his notorious hack jobs were a wing of the U.S. Department of Defense called the Defense Threat Reduction Agency, NASA, and the Marshall Space Flight Center in Huntsville, Ala. (By hacking the latter James gained the ability to control the A/C in the International Space Station.) All of these were pulled off “for fun” while James was still a student at Palmetto Senior High in Miami. Unfortunately, the fun ran out when James was tied into a massive identity theft investigation. Though insisting he was innocent, James took his own life, saying he had “no faith in the justice system.”
3. Michael Calce:
   Yahoo. CNN. Ebay. Amazon. Dell.com. One by one in a matter of days, these huge websites crashed at the hands of 15-year-old Canadian high school student Michael Calce, aka “MafiaBoy.” Armed with a denial-of-service program he called “Rivolta” that overloaded servers he targeted, the young hacker wreaked $7.5 million in damages, according to court filings. Calce was caught when he fell victim to a common ailment of teenage boys: bragging. The cops were turned on to him when he began boasting in chat rooms about being responsible for the attacks. On Sept. 12, 2001, MafiaBoy was sentenced to a group facility for eight months on 56 counts of cybercrime.
4. Kevin Mitnick:
   Before performing hacks that prompted the U.S. Department of Justice to declare him “the most wanted computer criminal in United States history,” Kevin Mitnick had already made a name for himself as a hacker in his school days, first at Monroe High School in LA and later at USC. On a dare, Mitnick connived an opening into the computer system of Digital Equipment Corporation, which some fellow hackers then used to steal proprietary source code from the company before ratting on him. While still on probation for that crime, Mitnick broke into the premises of Pacific Bell and had to go on the run from police in the aftermath, during which time he hacked dozens of systems, including those of IBM, Nokia, Motorola, and Fujitsu.
5. Tim Berners-Lee:
   “Scandalous” is a synonym for “infamous,” and for this legendary computer scientist, knight of the British Empire, and inventor of the World Wide Web to have been a hacker in his school days is certainly a juicy factoid. During his time at Oxford in the mid-’70s, Sir Tim was banned from using university computers after he and a friend were caught hacking their way into restricted digital areas. Luckily by that time he already knew how to make his own computer out of a soldering iron, an old TV, and some spare parts. And also luckily for him, he will always be revered as the father of the Internet.
6. Neal Patrick and the 414s:
   In the early ’80s, hacking was still a relatively foreign concept to most Americans. Few recognized the enormous power hackers could hijack with a few strokes on a keyboard, which explains why a young group of hackers known as the 414s (after a Milwaukee area code) were virtual celebrities after they hacked into the famous Los Alamos National Laboratory, the Memorial Sloan-Kettering Cancer Center, and elsewhere. While today hacking a lab where classified nuclear research is conducted could earn you a one-way ticket to Guantanamo, the 17-year-old ringleader and high school student Neal Patrick was on the cover of Newsweek. The group members got light sentences but prompted Congress to take a stronger role in cybercrime.
7. Robert T. Morris:
   The first ever Internet worm, the Morris Worm derived its name from Cornell grad student Robert Tappan Morris. In 1988, Morris released the worm through MIT’s system to cover his tracks, which would seem to contradict his claims that he meant no harm with it. But that’s exactly what resulted: the worm spread out of control, infecting more than 6,000 computers connected to the ARPANET, the academic forerunner to the World Wide Web. The damages reached as high as an estimated $10 million, and Morris earned the ignominious distinction of being the first person prosecuted under the Computer Fraud and Abuse Act. Morris got community service but was apparently not considered too infamous to be offered his current job as a professor at MIT.
8. George Hotz:
   To some, George Hotz (aka “geohot,” aka “million75,” aka “mil”) is a public menace, a threat to electronic businesses everywhere. To many, Hotz is a hero. The high-schooler shot to fame/infamy in 2007 at the tender age of 17 by giving the world its first hacked, or “jailbroken” iPhone. He traded it for a new sports car and three new iPhones, and the video of the hacking received millions of hits. Apple has had to grudgingly come to terms with jailbreaking, seeing as the courts have declared it legal, but Sony Corp. is definitely not OK with such tampering. When Hotz hacked his PlayStation 3 and published the how-to on the web, the company launched a vicious lawsuit against him. In turn, the hacker group Anonymous launched an attack on Sony, stealing millions of users’ personal info.
9. Donncha O’Cearbhaill:
   According to the FBI, this 19-year-old freshman at Trinity College Dublin is one of the top five most wanted hackers in the world. Well, he was; now that he’s been arrested he’s not really “wanted” anymore. The Feds contend the young man is a VIP member of the Anonymous and LulzSec hacking groups that have already been mentioned and whose targets have included the FBI, the U.S. Senate, and Sony (in the Hotz backlash). It seems “Palladium” (O’Cearbhaill) took the liberty of listening in on a conference call between the FBI and several international police forces who were discussing their investigations of the hacking groups. He could be sentenced to up to 15 years in prison if convicted for that hack alone.
10. Nicholas Allegra:
    Just as George Hotz moved on from the Apple hacking game, Brown University student Nicholas Allegra is also hanging up his jersey. “Comex,” as he is known to millions of rooted iPhone fans, created the simple-to-use Apple iOS jailbreaking program JailbreakMe in 2007 and has since released two newer versions of it. However, Comex seems to have gone over to the dark side,accepting an internship with the very company whose products he became famous exploiting. Still, Allegra’s hacking skills are so advanced (one author puts him five years ahead of the authors of the infamous Stuxnet worm that corrupted Iran’s nuclear facilities) and so many people availed themselves of his talents, he will forever live in hacking infamy.
    Source: Link

Follow @thehackersmedia

Researchers Demonstrate CRIME Attack Against TLS Protocol [Video]

Researchers Demonstrate CRIME Attack Against TLS Protocol [Video]

Juliano Rizzo and Thai Duong – the security researcher who became famous after demonstrating the SSL attack known as the BEAST – have come up with an attack against the TLS protocol.
To prove their findings, they’ve released a video proof-of-concept which shows that an attacker can gain access to protected user cookies and hijack sessions.

According to the researchers, the new attack is similar to the BEAST, but they didn’t pinpoint the TLS feature responsible for the information leak, ThreatPost notes.

Apparently, all TLS versions are susceptible to these attacks which work on both Firefox and Chrome.

The experts reveal that users can protect themselves against such attacks by permanently keeping their browsers updated and by disabling compression on servers.

The details of the CRIME attack will be presented by the researchers at the upcoming ekoparty security conference in Buenos Aires, Argentina.

Source: View

Hijacked Pinterest Accounts Promote Work-at-Home Jobs on Facebook and Twitter

Spammers are using compromised Pinterest accounts to advertise shady work-at-home job offers. For users who have linked their Pinterest profiles to Facebook and Twitter it’s even worse, since the spammy messages are pushed onto these websites as well.
The growing popularity of the relatively new social media platform Pinterest is beginning to attract more and more cybercriminals. The company has started warning users a few weeks ago to be on the lookout for any suspicious elements (malware, phishing scams, and malicious browser plugins) which could allow crooks to take over their accounts.

However, it seems that many users still fall for the traps set by the spammers. According to Sophos experts, in the past few days a number of shady work-at-home jobs have been advertised. 

In situations where the Pinterest account is linked to Twitter and Facebook, the spam appears as messages such as “Omg this is so cool! Can’t wait for more!” or “Omg this is so exciting! Too excited for next ones!”

Bitdefender’s HotForSecurity reports that the attackers haven’t changed the passwords of the compromised accounts. They simply utilized them to promote their shady offers.

Experts report that for some Twitter customers the situation is so frustrating that they have even decided to close their Pinterest accounts in order to stop the spam from flowing in.

Pinterest is working hard on removing the shady pins, but it appears that they’re having difficulties in properly cleaning up the platform. Unfortunately, this incident once again highlights the necessity for a proper anti-spam mechanism that could combat this phenomenon.

For now, Pinterest keeps advising the victims of such attacks to immediately change their passwords. They also recommend users to be cautious when installing third-party apps and web browser extensions since in many cases they’re the ones responsible for allowing hackers to hijack accounts.

Source: View

Visa to Introduce Point-to-Point Encryption Service to Payment Terminals At the end of August, Visa revealed its plans to introduce a new point-to-point encryption ((P2PE) service called Visa Merchant Data Secure. The service – which will be made available at the beginning of 2013 – will aim at securing payment terminals and other critical systems across the industry.  The P2PE technology will allow merchants to protect sensitive cardholder information by encrypting data within the payment processing environment. The encryption keys will be guarded by Visa, the gateway, or the company that acquires the service.  "Merchants large and small have expressed an interest in encryption as a way to protect cardholder data in their payment systems and simplify their security protocols," Ellen Richey, chief enterprise risk officer at Visa, explained when the service was announced. "Since encrypted data can't be used to commit fraud, Visa's point-to-point encryption solution can significantly reduce the risk and impact of data compromises." According to Eduardo Perez of the Visa Risk Group, the new service is not required yet, but it is “one of the tenets of the PCI Data Security Standard.”  In a recent interview, Perez revealed that the main goal was to continue to encourage organizations to adopt the more secure EMV (Europay, MasterCard, Visa) standard and rely more on dynamic authentications.  The new encryption solution might represent the answer to the issues highlighted a few days ago by University of Cambridge researchers. They discovered the fact that the unpredictable number (UN) used by EMV cards to authenticate themselves was somewhat predictable. They found a pattern in the way many ATMs and point-of-sales (POS) devices generated the “random” part of the UN. Because manufacturers of these devices are taking shortcuts, EMV card holders might become exposed. Their theory might explain some of the phantom withdrawals that some cardholders have reported. Source: View

BlackHole Exploit Kit 2.0 Made Available, Price Remains the Same

The infamous BlackHole exploit kit has been upgraded to the 2.0 version. Its developers have noticed that security solutions have no problem in identifying the old variant as being malware, so they claim to have rewritten it from scratch.

As expected, BlackHole 2.0 comes with several improvements. First of all, they added a protection mechanism that prevents security firms from accessing the exploits, and in order to achieve this, dynamic URLs – which are valid for only a few seconds - are generated.

 The new variant doesn’t rely on plugindetect to determine the Java version that’s installed, thus speeding up the malware download process. Old exploits that were causing browsers to crash and “scary visual effects” have been removed. 

Furthermore, because the link to the malicious payload was easily identified by security software, BlackHole 2.0 comes with a feature that allows the customer to choose the link. The creators of the exploit kit claim that this way none of the commercial antivirus solutions is able to detect it.

Dynamic URLs are utilized everywhere, permanent variable names – which were easily detectable - not being used anymore.

A number of 16 improvements have also been made to the BlackHole’s administrator panel: it’s faster, statistics are easier to view, and mobile phones and Windows 8 have been added to allow customers to see precisely what types of devices are infected.

Finally, a number of “private tricks” have been implemented, which the author prefers to keep a secret because he fears that competitors and antivirus companies are “sneaking around.”

As far as the pricing goes, the developers are renting it to anyone for the amount of $500 (400 EUR) per month on their own servers. If the customer has his own server, the license is much cheaper: $700 (560 EUR) for three months, $1,000 (800 EUR) for six months, and $1,500 (1,200 EUR) for a whole year.

The cybercriminals even offer support on weekdays between 9AM and 7PM.

Source: Click To View Source