Updates on Lulz arrest

http://www.telegraph.co.uk/news/uknews/crime/8650129/Teenager-quizzed-over-links-to-international-computer-hacking-ring-faces-extradition-to-US.html

A little more information on the person they suspect to be TFlow, looks like the world wide arrest total is at 60 now.  I am sure more details will be release as the legal stuff rolls on.

More Lulz

So to get everything up to date.

The person that was fingered as the leader of lulzsec says he is not and has provided email headers that are supposed to prove that he is not.  The web ninja’s have pointed out the headers have a discrepancy in the X-Mailer portion.  The version that is stamped did not come out until a year later.

Then he was asked to provide headers with missing IP address but says that is not possible.

So where does that leave everything?

Well I am still waiting to see what happens before I decide for my self whats going on.  It would be useful if someone tested all of this to clear up the header confusion though.  Just not me

You can catch up here, and check out the comments.

http://lulzsecexposed.blogspot.com/2011/07/caught-naked.html

More Anon updates

Additional to the last post.

http://lulzsecexposed.blogspot.com/2011/07/party-van.html#comments

It contains links to twitter feeds that line up with the raids, and a few more links with more information.

The wired article has more details also.

http://www.wired.com/threatlevel/2011/07/paypal-hack-arrests/

This was all from operation payback in December 2010.

http://en.wikipedia.org/wiki/Operation_Payback

Anon and some Lulz updates

http://www.foxnews.com/scitech/2011/07/19/exclusive-fbi-search-warrants-nationwide-hunt-anonymous/

There is always a trail to follow, they may not follow it fast but they get you one day.

The list of people picked up is staggering. The majority of the ages are less then 30, with a few that are way out of the norms.  This is still in reaction to the DDoS against PayPal way back when, the amount of information that they have to go through to do this must be huge.

Lulz updates

So the Web Ninja’s, Th3J35t3r and a Indiana Jones have posting information on the “real” Sabu.

http://lulzsecexposed.blogspot.com/2011/07/job-done.html

And..

The guy that is named as Sabu replied to the thread saying he was not Sabu, and Sabu tweeted that it was right.  So whats going on?

I don’t know but from my perspective more beer will solve it.

The gentleman who has been outed that says hes not said that he sold a domain in auction that Sabu purchased that the whole bread trail relies on.  The Web Ninja’s asked for a receipt.

Then Gwaker had to get in on the whole thing.

http://gawker.com/5821305/vigilantes-out-wrong-guy-as-hacker-mastermind

It also appears that Sabu is still active inside anonymous, if you have been following the latest antisec releases.

Zeus research update

I have been prepping for an up coming exam and I have not been able to do as much as I like with it, I am hoping that I will have some time soon.  If not I will be picking up this topic again in a couple more months when I am done with the test, and before I start my next paper.

Whew!

Your friendly neighborhood “Windows Service Centre”

http://www.computeractive.co.uk/ca/pc-help/1908340/exposed-cold-pc-service-company-tried-mislead

I keep hearing about these more and more, after a bit of research there seems to be more of it in the UK.  At least what I could find they were the most vocal.  I got one of these myself at home, but someone else answered the phone and kindly informed them they don’t have Windows PC’s.

I found this one also, is a good laugh.

http://www.youtube.com/watch?v=nXjmmbDV1bk

I really liked this forum post, http://whocallsme.com/Phone-Number.aspx/01865600898.

One of the scammers chimes in saying that he is legit, in his broken poor English.

This seems to be pretty effective at getting access to funds and machines, but wow that’s not efficient.

VSFTPD backdoor

https://security.appspot.com/vsftpd.html

Looks like if you logged in with a you got a connect back trying to establish a shell.

Good times.

TDL Bot

The read about this bot is great.

I especially like the affiliate program that pays you to help infect machines for them.  This is not the first time I have see something like this, but this one just seems to stick out.

The communication the system uses is highly resistant to C&C take downs, it’s just encrypted files on a public p2p network.

I won’t spoil any more of it.

Non-Biological Weapons Convention

It’s getting to be time that electronic weapons such as computer viruses had some sort of international agreement on their use such as the biological weapons convention.

http://en.wikipedia.org/wiki/Biological_Weapons_Convention

I like the articles of the BWC and ideally for everyone I think we need a NBWC for non-biological wepons that would cover weaponized software like Stuxnet.  If this was written correctly we may even be able to enable international law enforcement to have something to charge these authors with.

I can think of a few countries off the top of my head that would probably never sign something like this, but you can always hope.