We analyzed the chat logs from Lulzsec that were provided in the Guardian. Specifically, we tried to analyze the technical approach used to bring down websites and steal data. Hopefully, our analysis can give security teams and even nontechies insights into how Lulzsec carried out their attacks and more importantly, help tune defenses. (We’d also recommend looking Byron’s blog for some other lessons.)
Lulzsec was a team of hackers focused on breaking applications and databases. There were no virus or malware experts. Even their approach to distributed denial of service (DDoS) attacks relied on weaknesses in applications. We hope this episode helps bring attention to the fact that the center of gravity has shifted from firewalls and anti-virus to applications and databases. For security, this does not mean “we have updated our anti-virus and put in place a network firewall.” Rather, it means “we have identified all sensitive data and have put in place technology with the audit and protection capabilities required to safeguard that data.”
Here’s a breakdown of the major technical tools used to hack sites worldwide:
Tool #1: Remote File Include
The relevant snippet from the chat log (emphasis ours):
lol – storm would you also like the RFI/LFI bot with google bypass i was talking about while i have this plugged in?
lol – i used to load about 8,000 RFI with usp flooder crushed most server 😀
Remember that lol is Kayla who brought a bot army to Lulsec’s toolbox. The key in the snippet above is “RFI” or remote file include. We published an extensive overview of RFI about two months ago. Lulzsec used RFI to get bots to DDoS websites, which is how they brought down the CIA public site.
In our report, we said that RFI “attacks have the potential to cause as much damage as the more popular SQL Injection and Cross-Site Scripting (XSS) attacks.” We also noted that RFI is “not widely discussed.” The key here is “not widely discussed.” In other words, Lulzsec used an often overlooked vulnerability to help ambush their targets. An RFI attack inserts some nasty code into a web application server. What does the code do? Usually, RFI is used to take over the web application and steal data. In the case of Lulzsec, they used it to conduct DDoS attacks. The second line, “8,000 RFI with usp [they meant UDP] flooder” tells you that lol had 8,000 infected servers (not PCs!) to conduct the DDoS attacks. That’s pretty sizable. How much? In our webinar on DDoS 2.0, we estimated that one infected server is equal to 3,000 bot infected PCs, so 8,000 servers would be like 2.5M PCs. CORRECTION: This should be 25M PCs.
Finally, our report gives some suggestions on countering RFI attacks.
Tool #2: SQL Injection
Jun 03 13:18:44 [redacted] you mean with the coupons?
Jun 03 13:18:57 [redacted] was it from that SQLi
Jun 03 13:21:57 sabu yeah
Volumes have been written about SQL injection. What more can we possibly write about the biggest vulnerability in the history of mankind that is the cause of millions of lost data records? We described in detail here how SQL injection may have helped with the PBS hack.
Tool #3: Cross Site Scripting
May 31 11:19:38 [redacted] XSS in billoreilly lol
Again, volumes on XSS. What more can we possibly write about the 2nd biggest vulnerability in the history of mankind that is the cause of millions of lost data records?
Be safe.
Lulzsec was a team of hackers focused on breaking applications and databases. There were no virus or malware experts. Even their approach to distributed denial of service (DDoS) attacks relied on weaknesses in applications. We hope this episode helps bring attention to the fact that the center of gravity has shifted from firewalls and anti-virus to applications and databases. For security, this does not mean “we have updated our anti-virus and put in place a network firewall.” Rather, it means “we have identified all sensitive data and have put in place technology with the audit and protection capabilities required to safeguard that data.”
Here’s a breakdown of the major technical tools used to hack sites worldwide:
Tool #1: Remote File Include
The relevant snippet from the chat log (emphasis ours):
lol – storm would you also like the RFI/LFI bot with google bypass i was talking about while i have this plugged in?
lol – i used to load about 8,000 RFI with usp flooder crushed most server 😀
Remember that lol is Kayla who brought a bot army to Lulsec’s toolbox. The key in the snippet above is “RFI” or remote file include. We published an extensive overview of RFI about two months ago. Lulzsec used RFI to get bots to DDoS websites, which is how they brought down the CIA public site.
In our report, we said that RFI “attacks have the potential to cause as much damage as the more popular SQL Injection and Cross-Site Scripting (XSS) attacks.” We also noted that RFI is “not widely discussed.” The key here is “not widely discussed.” In other words, Lulzsec used an often overlooked vulnerability to help ambush their targets. An RFI attack inserts some nasty code into a web application server. What does the code do? Usually, RFI is used to take over the web application and steal data. In the case of Lulzsec, they used it to conduct DDoS attacks. The second line, “8,000 RFI with usp [they meant UDP] flooder” tells you that lol had 8,000 infected servers (not PCs!) to conduct the DDoS attacks. That’s pretty sizable. How much? In our webinar on DDoS 2.0, we estimated that one infected server is equal to 3,000 bot infected PCs, so 8,000 servers would be like 2.5M PCs. CORRECTION: This should be 25M PCs.
Finally, our report gives some suggestions on countering RFI attacks.
Tool #2: SQL Injection
Jun 03 13:18:44 [redacted] you mean with the coupons?
Jun 03 13:18:57 [redacted] was it from that SQLi
Jun 03 13:21:57 sabu yeah
Volumes have been written about SQL injection. What more can we possibly write about the biggest vulnerability in the history of mankind that is the cause of millions of lost data records? We described in detail here how SQL injection may have helped with the PBS hack.
Tool #3: Cross Site Scripting
May 31 11:19:38 [redacted] XSS in billoreilly lol
Again, volumes on XSS. What more can we possibly write about the 2nd biggest vulnerability in the history of mankind that is the cause of millions of lost data records?
Be safe.
Try Imperva for Free
Protect your business for 30 days on Imperva.
