Krypt3ia

(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Archive for July 31st, 2011

Not So 3R337 Kidz

with 5 comments

Once again we find ourselves following the story of a new uber dump of data on a Friday (Fuck FBI Friday’s) as they have been dubbed by the skiddies. It seems that 4cid 8urn, C3r3al Kill3r, and Zer0C00l once again have failed to deliver the goods in their #antisec campaign with their ManTech dump. ManTech, for those who don’t know, is a company that handles defense and government security contracts for such things as secure networks etc. The skiddies decided to try and haxx0r the Gibson and get the goods on the bad bad men at ManTech.

Once again, they failed.

The files are mostly UNCLASS (kids, that means UN-CLASSIFIED mmkay?) with a few SBU (Sensitive but UNCLASSIFIED) as well. Many of the files are just documents of finances, bills, resume’s and email addresses that frankly you could get with a good Googling session. Again, we are not impressed by this crap Lulz skiddies. I have told you once, and now I till tell you again, you are failing to deliver anything of interest really.

Now, if you were real APT, then you would have used the data in the excel sheets to create some nice phishing exploits and then gone on to root some good shit. But no, you aren’t that advanced are you? You just want to do the quick hit and dump your ‘booty’ to collect the love from your adoring, albeit stupid, fans. I am sure some of them are at home now wanking off to the idea that you have really stuck it to ManTech and by proxy ‘the man’

Well, you haven’t.. Not so 3r337 as Raz0r and Bl4d3 say.

What you keep failing to understand are sever key things here:

  1. The good shit is in more protected systems, ya know, like the ones Manning had access to
  2. You have no idea what you are taking or what you are dumping! Bitch please, understand the classification markings!
  3. It’s only important to your ‘movement’ if the data actually uncovers bad behavior on the part of the government!

And it’s on that last point I want to harp a little more on. You guys say you are exposing fraud and devious behavior (other than your own subversive tendencies?) and yet, you keep missing the mark. There have been no cohesive plots outed by you other than Aaron and HB Gary’s little foray into creating 0day and programs for propaganda tools online.

Yay you!… ehhh… not so much.

You certainly did spank Aaron though, and for that my top hat and monocle are off to you. He rather deserved what he got for being so God damned stupid. However, you must all understand that these are the standard operating procedures in warfare (PSYOPS, INFOWAR, PROPAGANDA) every nation plays the game and its just the way of life. So, unless you get some real data of a plan to use this type of tech by the US on the US, (other than Rupert & Co.) Once again, I am not really so impressed.

Of course, you have to know that you are now the target of all of those tools right? Not only by the US, but other nations as I have mentioned before. Do you really think that you have not opened the door for other nation states to attack using your name? No one mentioned yet that you are now considered domestic terrorists and could even be considered non domestic after you get caught? You have opened Pandora’s box and all the bad shit is coming.. And much of it is going to be aimed straight at you.

The ironic thing is this.. You have delivered shit. It’s the idea and the cover you have given other nation states or individuals that is key here. You say you can’t arrest an idea… I say certainly not! BUT They can arrest YOU and then make that IDEA not so appealing to the other skiddies once your prosecutions begin on national TV.

So keep it up.. That hornets nest won’t spew hundreds of angry wasps…

K.

Of PLC Controllers and Obvious Statements

with one comment

The Summary from :

SCADA & PLC VULNERABILITIES IN CORRECTIONAL FACILITIES

by

Teague Newman
Tiffany Rad, ELCnetworks, LLC
John Strauchs, Strauchs, LLC

A logical conclusion to this research is that our findings do not only pertain to PLC and SCADA vulnerabilities in correctional facilities, but in any high-security location that uses these technologies as well as in manufacturing plants, transportation and just about anywhere that multiplexing is used. When securing the country’s most dangerous liabilities, we encourage that more attention be paid to access control, network security/segmentation and personnel policies. And as was the case with Stuxnet, proper adherence to secure operating procedures will greatly reduce the chances of infection of PLCs and control computers from the inside and outside of a secure facility.

Wait, you’re telling me that PLC systems (SCADA) are vulnerable and there are systems out there that are rather important that are likely vulnerable because of this?

NO WAY!

INCONCEIVABLE!

Sorry, just had to get that out of my system there. Seriously though, there is nothing new at all here with this white paper other than the fact that the prisons actually use these systems to keep the doors shut. Sure, if someone were savvy enough to get some code together (and it seems that there were some off the shelf exploits by the wording in the document) could possibly cause all of the doors in a penitentiary to open or close.

Uh, yeah.. Just like the same kinds of exploit code written for any other PLC system that is vulnerable (and lets face it, they all are) to make, say, a generator eat itself and burn up (see video here by DHS) Or maybe say, oh, I dunno, affect the rotational speeds of centrifuges in a nuclear fuel processing center?

Oh yeah, I remember now! That’s been done!

Stuxnet, still making waves in the news cycle was an important wake up call for the general public and not so much for the security world. Sure, the complexity and chaining of exploits (0day) to keep the Stux in the Natanz systems was APT all the way, but the concept of affecting SCADA systems adversly had been around for quite a long time. Just ask anyone who has maybe ping sweeped a factory with computer controlled PLC’s.

Shit will happen.

So, post Stuxnet, this paper and the presentation to follow at DEFCON this year seems more like a call for attention and perhaps a marketing scheme than anything revelatory befitting a talk at DEFCON. Having read the paper, it leaves me nonplussed as to why this s being presented at all. What is surprising is that companies and entities government or otherwise have not taken steps to insure that their PLC systems are not vulnerable. Furthermore, all those who use these systems for important functions like power regulation should in fact be screaming for security testing and upgrades to each and every maker of PLC systems. What we get though usually are excuses if not just silence

*crickets*

So, this paper and talk point out that prisons use the PLC’s and they are vulnerable to attack. It also makes mention that these systems seem to be connected to networks with internet connectivity!

SAY IT AIN’T SO!

Not much else to see here is there? These things we all know. In fact, the whole point of the Stuxnet attack was to blend it so that it would work in an air gapped as well as network environment! So, what exactly are you saying here Strauchs’ that is telling us anything we already didn’t know? Had the writers actually come up with some plans or legislation or even a call to arms for all PLC makers to secure their products, then I would say they have something to hang their hat on.. What you get here is “ho hum”

“Many places use PLC’s to control their operations”

“Many of those places connect their systems to networks with internet connections”

“The majority of PLC code is vulnerable to attack!”

…. Wait… Is that the CAPTAIN OBVIOUS sign in the sky over Las Vegas!?!?

See you there.

K.

 

 

Written by Krypt3ia

2011/07/31 at 00:14