LulzSec's parting Trojan is a false positive

Discussion in 'General Off-Topic Chat' started by Zekrom_cool, Jun 28, 2011.

  1. Zekrom_cool
    OP

    Member Zekrom_cool I respect faith, but doubt is what gets you an edu

    Joined:
    Apr 17, 2011
    Messages:
    915
    Location:
    Heaven [N's Castle]
    Country:
    India
    [​IMG]

    The LulzSec hacking group sailed off into the sunset Saturday, leaving behind a treasure trove of stolen data along with what some antivirus programs identified as a nasty surprise for anyone who downloaded the Torrent file: a Trojan horse program.

    But not so fast. On Monday several antivirus vendors took a close look at the file in question and decided that the program wasn't actually harmful. Consider it an inadvertent parting prank on the security industry the hacking grew took such delight in tormenting. More Lulz for the Lulz Boat.

    Early in the day, 26 of the 42 security companies whose scanning products can be tested on the VirusTotal Web site reported that a file within LulzSec's "AT&T internal data" folder was malware, designed to give hackers remote access to the victim's computer.

    But by Monday night Kaspersky Lab, McAfee and Trend Micro all reported that this was incorrect. According to Roel Schouwenberg, a researcher at Kaspersky Lab, other companies are flagging the file as a Trojan because it used pirated WinRar compression software that made the file look very similar to known malicious programs. These pirated compression programs are often used to compress malicious files and "a lot of companies are quite aggressive with these detections," he said in an interview.

    In its final press release, LulzSec blamed the whole thing on AT&T, warning readers not to open the file and saying, "it is malware (due to AT&T using a pirated copy of WinRar)"

    The file in question has reportedly been pulled from the LulzSec torrent, but the incident added to the chaos and confusion that the LulzSec crew seemed to love leaving in its wake.

    LulzSec took particular pleasure in causing trouble for security companies, especially those it saw as aiding its enemies -- such as Prolexic, a provider of denial-of-service attack mitigation services, thought to be securing Sony's networks, and Endgame Systems, a company with links to the U.S. Central Intelligence Agency. The hackers released dox -- dossiers of information including phone numbers, addresses and online profiles of the executives at these companies and their family members.

    They also hit two Infraguard websites, set up by the U.S. Federal Bureau of Investigation to encourage corporate security teams to share information with each other and the federal government.

    LulzSec said it was taking aim at "the government and whitehat security terrorists across the world. With their very public hacking and data dumps, they also caused problems for security staffers at the companies they broke into. But the group blamed its victims for not patching their security flaws. "When Sony and FBI affiliates fail to protect themselves against entry-level haxing, there's a problem," LulzSec said in a June 19 Twitter message.

    "Their whole objective was chaos and I think they've done a pretty good job at that," said Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham.

    But there are important lessons for the security industry too, he said.

    According to him, LulzSec showed that many organizations just don't do a good enough job of testing out their systems in real-world attack scenarios. "What we're seeing is a great illustration that we haven't done a good job of testing our security," he said.

    LulzSec also proved that even though everyone knows better, people -- even security professionals -- still reuse passwords.

    That's got to change, Warner said. "It's just not acceptable to use the same password on a Sony Pictures Sweepstakes page as you use for your Hotmail account and your bank account."[/p]

    Source
     
  2. prowler

    Member prowler Sony

    Joined:
    Jul 14, 2009
    Messages:
    9,473
    Location:
    Ragol
    Country:
    United Kingdom
    Really? You call this news?

    False positives are everywhere.

    I'm not exactly going to make a thread about it every time I get one.
     
  3. ManFranceGermany

    Member ManFranceGermany Atheist, Socialist and pro EU!

    Joined:
    Nov 14, 2010
    Messages:
    624
    Country:
    Germany
    this group is a sickness, not because of a fales positive, but because stealing cedit card numbers and releasing privat adresses and telephone numbers, even of family members.
     
  4. Bladexdsl

    Member Bladexdsl ZOMG my posts...it's over 9000!!!

    Joined:
    Nov 17, 2008
    Messages:
    14,347
    Location:
    Queensland
    Country:
    Australia
    i hope the boat gets eaten by a giant squid
     
  5. Sausage Head

    Banned Sausage Head Lord Sausage LXIX

    Joined:
    Oct 28, 2010
    Messages:
    1,677
    Location:
    alanjohn check ur pm
    Country:
    Netherlands
    the kraken, that is.

    kraken > pirates
     
  6. ferofax

    Member ferofax End of the World

    Joined:
    Jan 26, 2009
    Messages:
    2,564
    Location:
    Philippines
    Country:
    Philippines
    ...but as of saturday, there's officially no more lulzboat, so no boat for kraken to eat.

    Davy Jones: Sorry, Kraken, m'boy. Go play somewhere else.
     

Share This Page