LulzSec's parting Trojan is a false positive

Discussion in 'General Off-Topic Chat' started by Zekrom_cool, Jun 28, 2011.

  1. Zekrom_cool
    OP

    Zekrom_cool I respect faith, but doubt is what gets you an edu

    Member
    915
    24
    Apr 17, 2011
    India
    Heaven [N's Castle]
    [​IMG]

    The LulzSec hacking group sailed off into the sunset Saturday, leaving behind a treasure trove of stolen data along with what some antivirus programs identified as a nasty surprise for anyone who downloaded the Torrent file: a Trojan horse program.

    But not so fast. On Monday several antivirus vendors took a close look at the file in question and decided that the program wasn't actually harmful. Consider it an inadvertent parting prank on the security industry the hacking grew took such delight in tormenting. More Lulz for the Lulz Boat.

    Early in the day, 26 of the 42 security companies whose scanning products can be tested on the VirusTotal Web site reported that a file within LulzSec's "AT&T internal data" folder was malware, designed to give hackers remote access to the victim's computer.

    But by Monday night Kaspersky Lab, McAfee and Trend Micro all reported that this was incorrect. According to Roel Schouwenberg, a researcher at Kaspersky Lab, other companies are flagging the file as a Trojan because it used pirated WinRar compression software that made the file look very similar to known malicious programs. These pirated compression programs are often used to compress malicious files and "a lot of companies are quite aggressive with these detections," he said in an interview.

    In its final press release, LulzSec blamed the whole thing on AT&T, warning readers not to open the file and saying, "it is malware (due to AT&T using a pirated copy of WinRar)"

    The file in question has reportedly been pulled from the LulzSec torrent, but the incident added to the chaos and confusion that the LulzSec crew seemed to love leaving in its wake.

    LulzSec took particular pleasure in causing trouble for security companies, especially those it saw as aiding its enemies -- such as Prolexic, a provider of denial-of-service attack mitigation services, thought to be securing Sony's networks, and Endgame Systems, a company with links to the U.S. Central Intelligence Agency. The hackers released dox -- dossiers of information including phone numbers, addresses and online profiles of the executives at these companies and their family members.

    They also hit two Infraguard websites, set up by the U.S. Federal Bureau of Investigation to encourage corporate security teams to share information with each other and the federal government.

    LulzSec said it was taking aim at "the government and whitehat security terrorists across the world. With their very public hacking and data dumps, they also caused problems for security staffers at the companies they broke into. But the group blamed its victims for not patching their security flaws. "When Sony and FBI affiliates fail to protect themselves against entry-level haxing, there's a problem," LulzSec said in a June 19 Twitter message.

    "Their whole objective was chaos and I think they've done a pretty good job at that," said Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham.

    But there are important lessons for the security industry too, he said.

    According to him, LulzSec showed that many organizations just don't do a good enough job of testing out their systems in real-world attack scenarios. "What we're seeing is a great illustration that we haven't done a good job of testing our security," he said.

    LulzSec also proved that even though everyone knows better, people -- even security professionals -- still reuse passwords.

    That's got to change, Warner said. "It's just not acceptable to use the same password on a Sony Pictures Sweepstakes page as you use for your Hotmail account and your bank account."[/p]

    Source
     
  2. prowler

    prowler Sony

    Member
    9,473
    2,816
    Jul 14, 2009
    Ragol
    Really? You call this news?

    False positives are everywhere.

    I'm not exactly going to make a thread about it every time I get one.
     
  3. ManFranceGermany

    ManFranceGermany Atheist, Socialist and pro EU!

    Member
    624
    5
    Nov 14, 2010
    Gambia, The
    this group is a sickness, not because of a fales positive, but because stealing cedit card numbers and releasing privat adresses and telephone numbers, even of family members.
     
  4. Bladexdsl

    Bladexdsl ZOMG my posts...it's over 9000!!!

    Member
    16,124
    3,786
    Nov 17, 2008
    Australia
    Queensland
    i hope the boat gets eaten by a giant squid
     
  5. Sausage Head

    Sausage Head Lord Sausage LXIX

    Member
    1,677
    19
    Oct 28, 2010
    Netherlands
    alanjohn check ur pm
    the kraken, that is.

    kraken > pirates
     
  6. ferofax

    ferofax End of the World

    Member
    2,566
    437
    Jan 26, 2009
    Philippines
    ...but as of saturday, there's officially no more lulzboat, so no boat for kraken to eat.

    Davy Jones: Sorry, Kraken, m'boy. Go play somewhere else.