lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 16 Apr 2014 16:59:27 -0700
From: Joe Pierini <jpierini@...sw.com>
To: Andrew Klaus <andrewklaus@...il.com>, Justin Bull <me@...tinbull.ca>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Suspect arrested who used Heartbleed to infiltrate the
 Canada Revenue Agency (Our IRS)

"The CRA also declined to explain how it determined which SINs were
hacked, since Heartbleed intrusions are hard to detect.²

My guess is he was probably quite proud of himself and went and told the
agency. ³Hey you¹ve got Heartbleed, look at all the SIN¹s somebody can
get.² and then they promptly turned around and arrested him. He¹ll be
touted as the latest evil hacker and the CRA will bang on about how they
³detected and captured² him.

Remember kids, if you don¹t have a signed authorization form, stay out or
at the very least, keep your mouth shut.

Joseph Pierini | CISSP, PCI: QSA, PA-QSA, QAE
Director of Technical Services
Security Assessor - Penetration Tester
PSC - Business & Technology Experts in Payments, Security & Compliance




On 4/16/14, 4:28 PM, "Andrew Klaus" <andrewklaus@...il.com> wrote:

>I'm guessing he scripted to pull as many login/passes (or cookies) as
>possible, then simply looped through them and grabbed the SIN data from
>the
>web interface. Needing to "login" to each.
>
>Indeed, what an idiot.
>
>
>On Wed, Apr 16, 2014 at 12:27 PM, Justin Bull <me@...tinbull.ca> wrote:
>
>> Some 19 year old kid used heartbleed to gain access to the CRA systems
>>and
>> purge 900 SINs (akin to SSN) from the agency.
>>
>> What a fool.
>>
>>
>> 
>>http://www.theglobeandmail.com/news/national/rcmp-charge-teen-in-relation
>>-to-alleged-heartbleed-bug-theft/article18041007/#dashboard/follows/
>>
>> --
>> Best Regards,
>> Justin Bull
>> E09D 38DE 8FB7 5745 2044 A0F4 1A2B DEAA 68FD B34C
>>
>> _______________________________________________
>> Sent through the Full Disclosure mailing list
>> http://nmap.org/mailman/listinfo/fulldisclosure
>> Web Archives & RSS: http://seclists.org/fulldisclosure/
>>
>
>_______________________________________________
>Sent through the Full Disclosure mailing list
>http://nmap.org/mailman/listinfo/fulldisclosure
>Web Archives & RSS: http://seclists.org/fulldisclosure/



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists