The government’s brand new price check portal has been hit by a security breach, allowing hackers to obtain details such as email addresses and contact information of over 2,000 registered users which security experts say can be used to steal financial data in a roundabout way.
The breach follows 1 Malaysia Pengguna Bijak’s (1MPB) immediate outage after its launch on Tuesday, which government officials blamed on teething problems.
Online community portal Lowyat.net reported this morning that there were “several vulnerabilities” in the RM1.4 million 1pengguna.com site that allowed hackers to pull “signup details, usernames, email addresses and hashed passwords (encrypted).”
Personally identifying information such as names, addresses, birthdays and any banks or companies one does any business with can be used for identity theft or so-called phishing, which use personal details to make a phishing attempt look legitimate.
“These passwords are not difficult to decrypt. You can also use these vulnerabilities to defame the entire site,” Lowyat.net founder and chief executive Vijandren Ramadass told The Malaysian Insider.
Vijandren also said that Lowyat had discovered “a severe lack of security on the site” when it was launched and contacted the website administrator but received no response.
He said that a hacker group called Rilekscrew group also pointed out that “these vulnerabilities allowed almost all the data contained on the server to be remotely accessed.”
“Obviously, this is not an RM1.4 million job. Security and user privacy is a very important issue, especially on a site backed by the government,” he added.
The Malaysian Insider has also obtained a list of over 1,000 user details including that of two site administrators.
The government admitted yesterday that the 1MPB portal was not ready for the 3.5 million hits it has received since being launched two days ago.
Domestic Trade, Co-operative and Consumerism Minister Datuk Seri Ismail Sabri Yaakob said that the 1pengguna.com website had “teething problems” after expecting only 300,000 to 400,000 hits.
The government had launched the portal on Tuesday, saying it will list the prices of 355 products sold at 110 hypermarkets, 100 products at 404 supermarkets, 50 products at 360 wet markets and 100 products at 24-hour convenience stores.
But it was down for most of Wednesday as attempts to obtain prices from the website located at 1pengguna.com resulted in repeated connection failures.
Showing posts with label Hack. Show all posts
Showing posts with label Hack. Show all posts
5 Tips To Protect Your Google Account From Hackers
Quick searches of Twitter and Google reveal a flurry of recent Gmail hackings, and the Guardian reports that they might be rooted in the Gawker database breach last December.
Once hacked, victims' accounts send out spam e-mails that make it appear that the sender has been mugged. If you try to respond to one of these, your message will go to a dummy address. The spam message are tweaked so that the victim won't get your response if you hit reply all.
Sophos's Graham Cluley told the Guardian, "Our suspicion is that this is a Gawker-related incident. We know that people were using the same password for multiple sites and then others were trying to use the passwords against those accounts." You might remember that Twitter was hit hard by an acai berry spam attack following the breach.
Slate's Farhad Manjoo writes, "A password is the only thing separating your e-mail, banking information, and social networks from a bad guy," and unfortunately, a complex password with letters, numbers and symbols just won't cut it anymore. Adding an additional layer of authentication -- like the key fobs required by many companies for security -- cuts down on the potential harm of a stolen password. It might seem like a lot of work, but a thief who has gained access to your Gmail account also has control over your calendars, Google Docs, Gchat, YouTube account and, of course, years of your personal email.
Read on for five essential tips for protecting and backing up your Gmail account.
1. Set Up Two-Step Verification
Head to Google's Accounts page, and click "Using 2-step verification" under the Personal Settings heading. Google rolled out the feature earlier this year, and it works with your smartphone (via Google's authenticator app or SMS) to send an updated verification code every 30 seconds. Yes, you'll need to have your phone with you when you access your email, but it's a much more secure system.
2. Reset Your Password Via Text Message
On your Google (not Gmail) account page, click "Recovering your password," and set up your phone to receive a password-reset code via SMS. In the event your account is hacked, head to Google's recovery page and enter your username to receive an automatic text from Google to start the reset process.
3. Add Additional Recovery E-mail Accounts
While you're on the "Recover Your Password" page, go ahead and add a secondary email address. If you simply forget your password or your account was hacked, Gmail will be able to send reset instructions to this alternate address -- again, head to the password recovery page. James Fallows writes, "If you wait until after you've had a problem to think of this step, it's too late."
4. Keep Gmail Secure With HTTPS
The non-secure networks you'll find at coffee shops and in public places make your computer open and vulnerable, so we recommend looking at Gmail's settings. While it should be set to always use https by default, double check by clicking the gear icon in the top right of Gmail and then "Mail settings." Make sure "always use https" is selected, and scroll down to the bottom of the page to hit save.
5. Backup Your Account
Over 40,000 Gmail users got a scare earlier this year when the email service wiped out their accounts. Fortunately, Google was able to recover the accounts, but the mess clearly showed that Google's not infallible when it comes to data loss and downtime. The healthy shock made many consider secondary backup options, and we recommend checking out Hotmail backup, e-mail forwarding, desktop apps or paid services (or even all three) as ways to achieve email piece of mind.
Related posts:
* Now, anyone can hack
* Tougher Google Authentication
Once hacked, victims' accounts send out spam e-mails that make it appear that the sender has been mugged. If you try to respond to one of these, your message will go to a dummy address. The spam message are tweaked so that the victim won't get your response if you hit reply all.
Sophos's Graham Cluley told the Guardian, "Our suspicion is that this is a Gawker-related incident. We know that people were using the same password for multiple sites and then others were trying to use the passwords against those accounts." You might remember that Twitter was hit hard by an acai berry spam attack following the breach.
Slate's Farhad Manjoo writes, "A password is the only thing separating your e-mail, banking information, and social networks from a bad guy," and unfortunately, a complex password with letters, numbers and symbols just won't cut it anymore. Adding an additional layer of authentication -- like the key fobs required by many companies for security -- cuts down on the potential harm of a stolen password. It might seem like a lot of work, but a thief who has gained access to your Gmail account also has control over your calendars, Google Docs, Gchat, YouTube account and, of course, years of your personal email.
Read on for five essential tips for protecting and backing up your Gmail account.
1. Set Up Two-Step Verification
Head to Google's Accounts page, and click "Using 2-step verification" under the Personal Settings heading. Google rolled out the feature earlier this year, and it works with your smartphone (via Google's authenticator app or SMS) to send an updated verification code every 30 seconds. Yes, you'll need to have your phone with you when you access your email, but it's a much more secure system.
2. Reset Your Password Via Text Message
On your Google (not Gmail) account page, click "Recovering your password," and set up your phone to receive a password-reset code via SMS. In the event your account is hacked, head to Google's recovery page and enter your username to receive an automatic text from Google to start the reset process.
3. Add Additional Recovery E-mail Accounts
While you're on the "Recover Your Password" page, go ahead and add a secondary email address. If you simply forget your password or your account was hacked, Gmail will be able to send reset instructions to this alternate address -- again, head to the password recovery page. James Fallows writes, "If you wait until after you've had a problem to think of this step, it's too late."
4. Keep Gmail Secure With HTTPS
The non-secure networks you'll find at coffee shops and in public places make your computer open and vulnerable, so we recommend looking at Gmail's settings. While it should be set to always use https by default, double check by clicking the gear icon in the top right of Gmail and then "Mail settings." Make sure "always use https" is selected, and scroll down to the bottom of the page to hit save.
5. Backup Your Account
Over 40,000 Gmail users got a scare earlier this year when the email service wiped out their accounts. Fortunately, Google was able to recover the accounts, but the mess clearly showed that Google's not infallible when it comes to data loss and downtime. The healthy shock made many consider secondary backup options, and we recommend checking out Hotmail backup, e-mail forwarding, desktop apps or paid services (or even all three) as ways to achieve email piece of mind.
Related posts:
* Now, anyone can hack
* Tougher Google Authentication
Epsilon hacked - one of the biggest such breaches
The names and e-mails of customers of Citigroup Inc and other large U.S. companies, as well as College Board students, were exposed in a massive and growing data breach after a computer hacker penetrated online marketer Epsilon Data Management.In what could be one of the biggest such breaches in U.S. history, a diverse swath of companies that did business with Epsilon stepped forward over the weekend to warn customers some of their electronic information could have been exposed.
Drugstore Walgreen, Video recorder TiVo Inc, credit card lender Capital One Financial Corp and teleshopping company HSN Inc all added their names to a list of targets that also includes some of the nation's largest banks.
The names and electronic contacts of some students affiliated with the U.S.-based College Board -- which represents some 5,900 colleges, universities and schools -- were also potentially compromised.
No personal financial information such as credit cards or social security numbers appeared to be exposed, according to the company statements and e-mails to customers.
Epsilon, an online marketing unit of Alliance Data Systems Corp, said on Friday that a person outside the company hacked into some of its clients' customer files. The vendor sends more than 40 billion e-mail ads and offers annually, usually to people who register for a company's website or who give their e-mail addresses while shopping.
"We learned from our e-mail provider, Epsilon, that limited information about you was accessed by an unauthorized individual or individuals," HSN, also an e-commerce operator, said in an e-mail to customers on Sunday.
"This information included your name and e-mail address and did not include any financial or other sensitive information. We felt it was important to notify you of this incident as soon as possible."
Citigroup customer names and some credit card customers' e-mail addresses -- but no account information -- were part of the data breach, the third-largest U.S. bank said on Saturday.
The College Board, which administers the SAT admissions tests, on Saturday warned students about the breach and asked them to be cautious about receiving "links or attachments from unknown third parties," according to two e-mails reviewed by Reuters.
The not-for-profit organization is in contact with more than 7 million students, according to its website. It did not immediately return calls for comment.
PROBING FOR ANSWERS
Law enforcement authorities are investigating the breach, though it was unclear on Sunday how many customers or students had been exposed. Epsilon is also looking into what went wrong.
"While we are cooperating with authorities and doing a thorough investigation, we cannot say anything else," said Epsilon spokeswoman Jessica Simon. "We can't confirm any impacted or non-impacted clients, or provide a list (of companies) at this point in time."
Capital One, which also runs a bank, and Walgreens, the largest U.S. drugstore, said the Epsilon hacker accessed its customer e-mail addresses, but no personally identifiable information.
via Reuters
Related link:
* Epsilon Notifies Clients of Unauthorized Entry into Email System
Gawker was hacked by Gnosis
Millions of web users are being asked to reset their passwords as concerns spread over a major hacking attack.Yahoo, Twitter and LinkedIn have asked users to change their details, days after gossip site Gawker was hacked.
Online game World of Warcraft, which has more than 12 million subscribers, has also asked some users to reset their passwords.
Blizzard, the company behind the game, said it was an attempt to "minimise the effects" of the Gawker breach.
Although thousands of Twitter accounts were compromised after the attack, there have been few other reports of damage directly linked to the breach.
Many companies, however, have taken steps to identify users at risk and warn them before an exploit can take place. A spokesman for LinkedIn said it necessary to take "proactive security measures" to screen users thought to be in danger.
The attack on Gawker, which runs one of the world's most popular blog networks, was carried out over the weekend by an organisation calling itself Gnosis.
The group - which says it was making a protest at the site's perceived "arrogance" - subsequently published account details of 1.3 million Gawker users online, including a significant number of passwords.
Analysis of the breach has triggered a widespread defensive response because it emerged that many users had chosen common words and codes that left them wide open to abuse.
Documents show that the most popular password among Gawker users was "123456", followed by "password" and "12345678".
Other common terms, used by hundreds of people, included "monkey", "qwerty" and "consumer".
Although security experts warn against the use of passwords that are easy to guess, research suggests such behaviour is increasingly common online.
According to a study by computer security company Sophos, 33% of people admitted using the same password for every single website they visit.
A further 48% said they used just a handful of different codes, while just one in five said they never used the same password twice.
The firm's Graham Cluley said that the domino effect evident among web companies exposed a number of significant issues.
While it was important to remind users that their passwords should be changed regularly, he said, the warnings sent out to users did not always address the central issue of poor password choices.
"The bad guys already have databases of the most common passwords, and they look a lot like this," he said.
"It's no bad thing to try and help, but websites should give users more information about how to create a secure password."
Tips for keeping your password safe
* Never use the same password across lots of different websites
* Do not use a word that you - or a hacker - could find in the dictionary: these are susceptible to so-called 'brute force' attacks
* Try to include some digits and special characters to add a layer of complexity that will make life difficult for a criminal
* Pick a phrase or mnemonic that helps you remember your password
* You can avoid having to remember passwords altogether by using a password manager program. There are many available to download online
via BBC
Hacktivists using LOIC program to attack Amazon, Visa, Mastercard and PayPal sites
Activists are targetting using the Anonymous attack tool, known as LOIC. When a person installs the tool on their PC it enrols the machine into a voluntary botnet which then bombards target sites with data.
Once downloaded, LOIC would enabled computers to join the co-ordinated attacks against websites perceived to be "anti-Wikileaks" and is now reported to have been downloaded more than 31,000 times.
However, security experts warned people to avoid joining the voluntary botnet.
These distributed denial-of-service (DDoS) attacks are illegal in many countries.
Social network Facebook confirmed that it had removed Operation Payback - as the campaign is known - from the site because it was promoting its attack tool.
Earlier attacks against Visa and Mastercard knocked the official websites of the two offline for a while and resulted in problems for some credit card holders.
Defending against an attack typically involves analysis to work out which ones are being employed. A tactic that may not work well in this case.
As well as releasing the attack tool, the Anonymous group has also been active in helping to create mirror sites. To date there are over one thousand sites offering exact copies of the content on Wikileaks.
It is also ensuring the information is available on dark nets, heavily encrypted layers of the internet via which information can be extracted while remaining untraceable.
via Reuters
Once downloaded, LOIC would enabled computers to join the co-ordinated attacks against websites perceived to be "anti-Wikileaks" and is now reported to have been downloaded more than 31,000 times.
However, security experts warned people to avoid joining the voluntary botnet.
These distributed denial-of-service (DDoS) attacks are illegal in many countries.
Social network Facebook confirmed that it had removed Operation Payback - as the campaign is known - from the site because it was promoting its attack tool.
Earlier attacks against Visa and Mastercard knocked the official websites of the two offline for a while and resulted in problems for some credit card holders.
Defending against an attack typically involves analysis to work out which ones are being employed. A tactic that may not work well in this case.
As well as releasing the attack tool, the Anonymous group has also been active in helping to create mirror sites. To date there are over one thousand sites offering exact copies of the content on Wikileaks.
It is also ensuring the information is available on dark nets, heavily encrypted layers of the internet via which information can be extracted while remaining untraceable.
via Reuters
Now, anyone can hack
Cyber crimes are evolving. A lay person can now have a go at hacking with the advent of “attack tool kits” sold in the underground economy servers.
MALAYSIAN Lin Mun Poo did more than get himself arrested when he allegedly hacked into the high security computer networks of the United States’ Federal Reserve Bank (FRB) and the Pentagon’s security contractor.
He put Malaysia on the map of “super hackers”, on par with those from China and Russia, raising concerns from US security and intelligence officials.
“How did a hacker in Malaysia manage to penetrate a computer network operated by the Federal Reserve Bank of Cleveland?” mused MSNBC.com, the website of the giant US cable news network NBC, when the news broke.
“To have the skills to break into highly sensitive systems like that is an impressive level of criminal activity,” MSNBC.com quoted Kurt Baumgartner of Kaspersky Lab, a computer security firm, as saying.
Last Monday, Lin, 32, pleaded not guilty to charges of hacking into the FRB and unlawful possession of stolen credit and debit card account numbers belonging to individuals. He was denied bail.
Little is known of Lin except that he hails from Ipoh where he has a business address. It turns out to be a pub cum karaoke lounge in a commercial district of Ipoh.
Malaysian police say Lin has no criminal record and it appears he commits his cyber crimes outside the country.
“We are working together with our US counterpart to obtain more information of his activities there,” said a senior police source.
Describing Lin as “highly professional”, the source said Lin appeared on US authorities’ radar four years ago – in Thailand where he was alleged to be involved with hacking into US-linked corporations.
Cyber crime has evolved from the past when men and women hacked into computer systems of established entities for their five minutes of fame.
“Cyber criminals used to be after fame. The attacks were noisy, brought down systems and were highly visible,” said Nigel Tan, Symantec Corporation principal consultant for the Asia South region.
Symantec’s Global Intelligence Network has the largest, most sophisticated intelligence network worldwide, processing over eight billion e-mail messages daily and gathering malicious code data from 130 million systems.
Today’s hackers are mainly motivated by money. They move silently across borders in cyber space and the physical world, selling their ill-gotten wares in the underground economy.
“The attacks have now become more silent and they are motivated purely by financial gains. Their motivation is to sell whatever information they get,” Tan added.
Lin was arrested by the US Secret Service on Oct 21 at a diner in Brooklyn after being caught red-handed selling stolen credit card numbers for US$1,000 (RM3,000). He had just arrived a few hours earlier on a flight from Europe.
Secret Service agents seized his heavily encrypted laptop computer and found more than 400,000 credit, debit and bank account numbers which he had allegedly obtained by hacking into various computer systems.
In his post-arrest statement, Lin said the primary purpose of his trip to the US was to meet with an individual whom he believed was capable of regularly providing him with a large volume of stolen card numbers and personal identification numbers.
Credit card information topped the list of goods advertised for sale on the underground economy servers, accounting for 28% of all goods, according to the Symantec Intelligence Quarterly for April-June 2010.
Prices ranged from US$1 (RM3) to US$30 (RM90) depending on three main factors: the amount of information included with the card, rarity of the card type and bulk purchase sizes.
Credit cards that included security features such as CVV2 numbers, PINs and online verification service passwords were offered at higher prices.
The Federal Reserve Bank of Cleveland, Ohio was not Lin’s only victim, as it is alleged that he also breached the computer servers of major financial institutions and companies.
“The defendant possessed data illegally obtained from the computer network of FedComp, a data processor for various credit unions in the United States,” Justice Department prosecutors told US District Judge Dora L. Irizarry in a letter.
By hacking into FedComp, Lin gained access to the data of the Firemen’s Association of the State of New York Federal Credit Union and the Mercer County New Jersey Teachers’ Federal Credit Union, among other victims.
According to the prosecutors, the amount of stolen data found in Lin’s possession is staggering and has led them to describe him as an “extremely sophisticated and dangerous” computer hacker.
It underscored cyber criminals’ single-mindedness in searching and exploiting vulnerabilities in the computer systems of government institutions and corporations.
Lin admitted he made money by “finding and exploiting network vulnerabilities,” or trading and selling the information contained therein, according to the prosecutors.
Symantec warns that it is now easier than ever to launch a cyber attack, thanks to the advent of a so-called “attack tool kit” sold in the underground economy. The attack tool kit is changing the landscape of cyber criminals that was once dominated by IT savvy individuals.
Now anyone can purchase a cyber attack tool kit and use it to launch sophisticated attacks.
“Attack tool kits are easily available on the web for reasonable prices. A tool kit allows people to customise a piece of malicious code designed to steal data and other personal information,” said Tan.
“Such tool kits are easy enough to implement that even people with minimal technical knowledge can use them effectively,” he added.
Two of the most common platforms where such tool kits are sold are the Internet relay chat (IRC) servers (IRC) and web-based forums, according to Tan.
“Both feature discussion groups that participants use to buy and sell fraudulent goods and services.”
For as little as US$5 (RM16) to US$20 (RM63), one can purchase an attack tool kit, he said.
The tool kit is also sold on a monthly basis at a subscription rate of US$120 (RM378). This package comes with technical support.
“The market for these tool kits is now sophisticated enough that updated versions are released on a development schedule, advertising the inclusion of exploits for the latest vulnerabilities while retaining previous exploits,” Tan said.
The lowering of barriers for attackers to enter into cyber crime is reflected in the increase in malicious code that steals confidential information. New malicious codes more than doubled, year-on-year, between 2006 and 2008.
In 2009, it continued the upward trend, reaching 2.9 million, according to Symantec.
Efforts to combat cyber crimes on an international scale are being hampered by the lack of agreement in law enforcement procedures and cooperation across international jurisdictions.
In the meantime, malicious activity is moving to countries with emerging IT and broadband infrastructure.
As a result, it is likely that cyber crime will grow in emerging nations while levels remain relatively constant in established countries.
But from all accounts, Lin is no ordinary hacker. In August 2010, he allegedly hacked into the secure computer system of a major Department of Defence contractor which provides systems management for military transport and other highly sensitive military operations.
The Justice Department said he “potentially compromised” highly sensitive military logistics information.
If convicted, Lin faces a maximum prison sentence of between six-and-a-half years and eight years.
Via TheStar
MALAYSIAN Lin Mun Poo did more than get himself arrested when he allegedly hacked into the high security computer networks of the United States’ Federal Reserve Bank (FRB) and the Pentagon’s security contractor.
He put Malaysia on the map of “super hackers”, on par with those from China and Russia, raising concerns from US security and intelligence officials.
“How did a hacker in Malaysia manage to penetrate a computer network operated by the Federal Reserve Bank of Cleveland?” mused MSNBC.com, the website of the giant US cable news network NBC, when the news broke.
“To have the skills to break into highly sensitive systems like that is an impressive level of criminal activity,” MSNBC.com quoted Kurt Baumgartner of Kaspersky Lab, a computer security firm, as saying.
Last Monday, Lin, 32, pleaded not guilty to charges of hacking into the FRB and unlawful possession of stolen credit and debit card account numbers belonging to individuals. He was denied bail.
Little is known of Lin except that he hails from Ipoh where he has a business address. It turns out to be a pub cum karaoke lounge in a commercial district of Ipoh.
Malaysian police say Lin has no criminal record and it appears he commits his cyber crimes outside the country.
“We are working together with our US counterpart to obtain more information of his activities there,” said a senior police source.
Describing Lin as “highly professional”, the source said Lin appeared on US authorities’ radar four years ago – in Thailand where he was alleged to be involved with hacking into US-linked corporations.
Cyber crime has evolved from the past when men and women hacked into computer systems of established entities for their five minutes of fame.
“Cyber criminals used to be after fame. The attacks were noisy, brought down systems and were highly visible,” said Nigel Tan, Symantec Corporation principal consultant for the Asia South region.
Symantec’s Global Intelligence Network has the largest, most sophisticated intelligence network worldwide, processing over eight billion e-mail messages daily and gathering malicious code data from 130 million systems.
Today’s hackers are mainly motivated by money. They move silently across borders in cyber space and the physical world, selling their ill-gotten wares in the underground economy.
“The attacks have now become more silent and they are motivated purely by financial gains. Their motivation is to sell whatever information they get,” Tan added.
Lin was arrested by the US Secret Service on Oct 21 at a diner in Brooklyn after being caught red-handed selling stolen credit card numbers for US$1,000 (RM3,000). He had just arrived a few hours earlier on a flight from Europe.
Secret Service agents seized his heavily encrypted laptop computer and found more than 400,000 credit, debit and bank account numbers which he had allegedly obtained by hacking into various computer systems.
In his post-arrest statement, Lin said the primary purpose of his trip to the US was to meet with an individual whom he believed was capable of regularly providing him with a large volume of stolen card numbers and personal identification numbers.
Credit card information topped the list of goods advertised for sale on the underground economy servers, accounting for 28% of all goods, according to the Symantec Intelligence Quarterly for April-June 2010.
Prices ranged from US$1 (RM3) to US$30 (RM90) depending on three main factors: the amount of information included with the card, rarity of the card type and bulk purchase sizes.
Credit cards that included security features such as CVV2 numbers, PINs and online verification service passwords were offered at higher prices.
The Federal Reserve Bank of Cleveland, Ohio was not Lin’s only victim, as it is alleged that he also breached the computer servers of major financial institutions and companies.
“The defendant possessed data illegally obtained from the computer network of FedComp, a data processor for various credit unions in the United States,” Justice Department prosecutors told US District Judge Dora L. Irizarry in a letter.
By hacking into FedComp, Lin gained access to the data of the Firemen’s Association of the State of New York Federal Credit Union and the Mercer County New Jersey Teachers’ Federal Credit Union, among other victims.
According to the prosecutors, the amount of stolen data found in Lin’s possession is staggering and has led them to describe him as an “extremely sophisticated and dangerous” computer hacker.
It underscored cyber criminals’ single-mindedness in searching and exploiting vulnerabilities in the computer systems of government institutions and corporations.
Lin admitted he made money by “finding and exploiting network vulnerabilities,” or trading and selling the information contained therein, according to the prosecutors.
Symantec warns that it is now easier than ever to launch a cyber attack, thanks to the advent of a so-called “attack tool kit” sold in the underground economy. The attack tool kit is changing the landscape of cyber criminals that was once dominated by IT savvy individuals.
Now anyone can purchase a cyber attack tool kit and use it to launch sophisticated attacks.
“Attack tool kits are easily available on the web for reasonable prices. A tool kit allows people to customise a piece of malicious code designed to steal data and other personal information,” said Tan.
“Such tool kits are easy enough to implement that even people with minimal technical knowledge can use them effectively,” he added.
Two of the most common platforms where such tool kits are sold are the Internet relay chat (IRC) servers (IRC) and web-based forums, according to Tan.
“Both feature discussion groups that participants use to buy and sell fraudulent goods and services.”
For as little as US$5 (RM16) to US$20 (RM63), one can purchase an attack tool kit, he said.
The tool kit is also sold on a monthly basis at a subscription rate of US$120 (RM378). This package comes with technical support.
“The market for these tool kits is now sophisticated enough that updated versions are released on a development schedule, advertising the inclusion of exploits for the latest vulnerabilities while retaining previous exploits,” Tan said.
The lowering of barriers for attackers to enter into cyber crime is reflected in the increase in malicious code that steals confidential information. New malicious codes more than doubled, year-on-year, between 2006 and 2008.
In 2009, it continued the upward trend, reaching 2.9 million, according to Symantec.
Efforts to combat cyber crimes on an international scale are being hampered by the lack of agreement in law enforcement procedures and cooperation across international jurisdictions.
In the meantime, malicious activity is moving to countries with emerging IT and broadband infrastructure.
As a result, it is likely that cyber crime will grow in emerging nations while levels remain relatively constant in established countries.
But from all accounts, Lin is no ordinary hacker. In August 2010, he allegedly hacked into the secure computer system of a major Department of Defence contractor which provides systems management for military transport and other highly sensitive military operations.
The Justice Department said he “potentially compromised” highly sensitive military logistics information.
If convicted, Lin faces a maximum prison sentence of between six-and-a-half years and eight years.
Via TheStar
Malaysian Lin Mun Poo hacked US Federal Reserve
A sophisticated Malaysian cyber bandit hacked into the US Federal Reserve's computers, stealing nearly half a million credit and debit card numbers, US prosecutors in New York say. And I thought the US Federal Reserve is hack-proof.Lin Mun Poo, 32, was arrested on October 21 soon after entering the US and was indicted by grand jury on Thursday, the US attorney's office in Brooklyn said.
Poo, who is being held in pre-trial detention, allegedly hacked into the Cleveland, Ohio branch of the Fed, the US central bank, stole more than 400,000 card numbers, and breached the defences of other systems.
The US attorney's office said Poo "made a career of compromising computer servers belonging to financial institutions, defence contractors, and major corporations, among others, and selling or trading the information."
The 32-year-old was arrested by the US Secret Service a few hours after flying into John F Kennedy International Airport in New York.
He was caught by Secret Service agents while selling stolen credit card numbers for US$1,000 (RM3,120) at a restaurant in New York city.
"Secret Service agents seized his heavily encrypted laptop computer, which contained a massive quantity of financial account data and personal identifying information that he had allegedly obtained by hacking," the prosecutor's office said.
Brian Parr, the head of the Secret Service's New York office, said cyber crimes "not only affect our nation's financial infrastructure, but are also an ongoing threat to our national security."
Among the other alleged hacking by Poo, the Secret Service said he entered a Pentagon contractor's system "potentially compromising highly sensitive military logistics information."
Via: bigpondnews.com
Use Firesheep To Hack Facebook And Twitter Account
Logging in to your Facebook or online email accounts from an unsecured public Wi-Fi network? Think again, as a new add-on for the web browser Firefox allows even the most amateur hackers to hijack your account. Read also TM UniFi is hackable.
The Firesheep add-on allows anyone to easily break in to Facebook, Twitter and legions of other online accounts of individuals when they log in from unsecured public Wi-Fi found at places such as McDonald's, hotels and cafes.
For example, as a victim is logging in to their Facebook or Twitter account from any web browser, the attacker, using the Firefox add-on, can sniff out their credentials, allowing the attacker to hijack the victim's account without having any physical access to their computer.
Using the add-on, the attacker can then access the victim's account using the unsecured Wi-Fi just by clicking on the account.
The attacker is then able to pretend to be the victim by taking over their account.
Depending on the type of account, they are able to send emails or Facebook messages to those the victim is in touch with - and view all of the victim's existing messages.
Without special software that encrypts internet traffic it is impossible to avoid these types of attacks.
In the first couple of days of being available the Firesheep add-on was downloaded more than 129,000 times, said its developer, Eric Butler, a freelance web application and software developer based in Seattle.
Firesheep is not an official Firefox add-on. The reason it was released, Butler said, was to demonstrate how many sites were not using proper security practices.
"Websites have a responsibility to protect the people who depend on their services," he said on his blog.
"They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web."
Chris Gatford, a security consultant at Hacklabs, said the tool was embarrassing large websites, such as Facebook and Twitter, into moving them to secure their online applications.
"A lot of these web services should be moving to fix these vulnerabilities in light of this," he said.
Gatford said the flaw that the add-on was taking advantage of had "been around for a long time" and that there had been "several tools" that had the ability to do the same thing in the past.
But he said that the Firesheep add-on had made it "much easier" for anyone – not just security professionals or savvy computer users – to hijack people's Facebook, Twitter and various other online accounts being accessed from unsecured Wi-Fi.
"The great thing about Firesheep from a security professional's perspective is that it makes what we call stealing session cookies much easier to do and makes it much easier – and much easier for other people – to point out vulnerabilities in applications that they're using, such as Facebook and Twitter and various other clients," he said.
The tool works by looking at web traffic available on open Wi-Fi access points, Gatford said.
Many websites don't use what is known as HTTP over SSL (HTTPS) by default. It is the lack of HTTPS not being used consistently throughout the online application that is causing a users' credentials to leak, he said.
"Unfortunately when you're not using HTTPS you are exposing these credentials and this is what Firesheep does; it picks up some of these credentials flying around the airwaves, in this particular case the open Wi-Fi access point you are connected to, and alows the attacker point-and-click access to other people's accounts," he said.
Gatford said a lot of web applications were designed to use HTTP instead of HTTPS for "speed and performance" and that this may be one of the many reason why websites that require a log-in weren't using HTTPS.
In a statement to tech blog TechCrunch, Facebook said it was "making progress testing SSL access across Facebook" and said that it hoped to "provide it as an option in the coming months".
Since being available to download, a number of tools have been released to counter Firesheep's ability to hijack people's credentials. One tool, named FireShepherd, works by flooding a network with certain traffic that stops Firesheep's ability to work.
Recommended reading:
* Top 10 Hacker's Favourite Passwords
* What Is Remote Binary Planting Exploit
* Spider Labs released tool to hack Android smartphones
*
The Firesheep add-on allows anyone to easily break in to Facebook, Twitter and legions of other online accounts of individuals when they log in from unsecured public Wi-Fi found at places such as McDonald's, hotels and cafes.
For example, as a victim is logging in to their Facebook or Twitter account from any web browser, the attacker, using the Firefox add-on, can sniff out their credentials, allowing the attacker to hijack the victim's account without having any physical access to their computer.
Using the add-on, the attacker can then access the victim's account using the unsecured Wi-Fi just by clicking on the account.
The attacker is then able to pretend to be the victim by taking over their account.
Depending on the type of account, they are able to send emails or Facebook messages to those the victim is in touch with - and view all of the victim's existing messages.
Without special software that encrypts internet traffic it is impossible to avoid these types of attacks.
In the first couple of days of being available the Firesheep add-on was downloaded more than 129,000 times, said its developer, Eric Butler, a freelance web application and software developer based in Seattle.
Firesheep is not an official Firefox add-on. The reason it was released, Butler said, was to demonstrate how many sites were not using proper security practices.
"Websites have a responsibility to protect the people who depend on their services," he said on his blog.
"They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web."
Chris Gatford, a security consultant at Hacklabs, said the tool was embarrassing large websites, such as Facebook and Twitter, into moving them to secure their online applications.
"A lot of these web services should be moving to fix these vulnerabilities in light of this," he said.
Gatford said the flaw that the add-on was taking advantage of had "been around for a long time" and that there had been "several tools" that had the ability to do the same thing in the past.
But he said that the Firesheep add-on had made it "much easier" for anyone – not just security professionals or savvy computer users – to hijack people's Facebook, Twitter and various other online accounts being accessed from unsecured Wi-Fi.
"The great thing about Firesheep from a security professional's perspective is that it makes what we call stealing session cookies much easier to do and makes it much easier – and much easier for other people – to point out vulnerabilities in applications that they're using, such as Facebook and Twitter and various other clients," he said.
The tool works by looking at web traffic available on open Wi-Fi access points, Gatford said.
Many websites don't use what is known as HTTP over SSL (HTTPS) by default. It is the lack of HTTPS not being used consistently throughout the online application that is causing a users' credentials to leak, he said.
"Unfortunately when you're not using HTTPS you are exposing these credentials and this is what Firesheep does; it picks up some of these credentials flying around the airwaves, in this particular case the open Wi-Fi access point you are connected to, and alows the attacker point-and-click access to other people's accounts," he said.
Gatford said a lot of web applications were designed to use HTTP instead of HTTPS for "speed and performance" and that this may be one of the many reason why websites that require a log-in weren't using HTTPS.
In a statement to tech blog TechCrunch, Facebook said it was "making progress testing SSL access across Facebook" and said that it hoped to "provide it as an option in the coming months".
Since being available to download, a number of tools have been released to counter Firesheep's ability to hijack people's credentials. One tool, named FireShepherd, works by flooding a network with certain traffic that stops Firesheep's ability to work.
Recommended reading:
* Top 10 Hacker's Favourite Passwords
* What Is Remote Binary Planting Exploit
* Spider Labs released tool to hack Android smartphones
*
What Is Remote Binary Planting Exploit
The term Remote Binary Planting is becoming a hot keyword trends. Remote Binary Planting has been coined by computer security researchers of a exploit of planting malicious binary on a targeted computer.
The vulnerabilities of the "remote binary planting" is where the malicious binary is loaded from the current working directory, allowing for a remote, even Internet-based attack.
This vulnerability allows a remote attacker (hacker) to place a (preferably hidden) malicious DLL on a network shared folder alongside a media file and when users open this media file, the DLL will get silently loaded and executed by the operating system.
There also has been cases whereby the operating system was tricked to load the DLL without verifying it full installed path.
Why is it called Remote Binary Planting? This is because the same problem affects not only the libraries but also executables such as .EXE and .COM files.
More info at: ACROS SECURITY - Binary Planting
If you like this informative post, then please subscribe to my full RSS Feed.
The vulnerabilities of the "remote binary planting" is where the malicious binary is loaded from the current working directory, allowing for a remote, even Internet-based attack.
This vulnerability allows a remote attacker (hacker) to place a (preferably hidden) malicious DLL on a network shared folder alongside a media file and when users open this media file, the DLL will get silently loaded and executed by the operating system.
There also has been cases whereby the operating system was tricked to load the DLL without verifying it full installed path.
Why is it called Remote Binary Planting? This is because the same problem affects not only the libraries but also executables such as .EXE and .COM files.
More info at: ACROS SECURITY - Binary Planting
If you like this informative post, then please subscribe to my full RSS Feed.
How Microsoft Apps Can Be Exploited By Hackers
This is really nothing new. The article below reports that computer security researchers claims at least 41 Microsoft apps especially PowerPoint 2010 and Office 2010 are vulnerable and need patching. But Microsoft is not admitting it's their own application that has hidden bugs.
How can Microsoft owned application be at fault? Well, The lack of insight in their OS architecture allowed their own programs to be remotely exploited using DLL load hijacking.
Less than 24 hours after Microsoft said it couldn't patch Windows to fix a systemic problem, attack code appeared Tuesday to exploit the company's software.
On Monday, Microsoft confirmed reports of unpatched -- or zero-day -- vulnerabilities in a large number of Windows programs, then published a tool it said would block known attacks. At the same time, the company said it would not patch Windows because doing so would cripple existing applications.
Microsoft also declined to reveal whether any of its own applications contain bugs that attackers could exploit, saying only that it is investigating.
Many Windows applications don't call code libraries -- dubbed "dynamic-link library," or "DLL" -- using the full path name, but instead use only the file name, giving hackers wiggle room that they can then exploit by tricking an application into loading a malicious file with the same name as a required DLL.
If attackers can dupe users into visiting malicious Web sites or remote shares, or get them to plug in a USB drive -- and in some cases con them into opening a file -- they can hijack a PC and plant malware on it.
By Tuesday, at least four exploits of what some call "binary planting" attacks -- and what others dub "DLL load hijacking" attacks -- had been published to a well-known hacker site. Two of the exploits targeted Microsoft-made software, including PowerPoint 2010, the presentation application in Office 2010, and Windows Live Mail, a free e-mail client bundled with Vista but available as a free download for Windows 7 customers.
Other exploits aimed at leveraging DLL load hijacking bugs in uTorrent and Wireshark, a BitTorrent client and network protocol analyzer, respectively.
At the same time, a Slovenian security company claimed that it reported bugs in two Microsoft-made programs last March.
"We're going to publish a list of the vulnerable apps we found sometime soon," said Mitja Kolsek, the CEO of Acros Security. "However, since HD Moore's tool kit is already being used for finding vulnerable apps and at this point hundreds of good and bad guys already know about it, I can say that the two we fully disclosed to Microsoft were in Windows Address Book/Windows Contacts and Windows Program Manager Group Converter."
HD Moore is the U.S. researcher who kicked off a small wave of DLL load hijacking reports last week when announced he had found 40 vulnerable Windows applications. On Monday, Moore published an auditing tool that others can use to detect vulnerable software. When combined with an exploit added that same day to Metasploit, the open-source hacking tool kit that Moore authored, the tool's results produce what he called a "point-and-shoot" attack.
All four of the exploits that went public Tuesday appear to be based on Moore's Metasploit attack code.
Although the Windows Address Book -- renamed Windows Contacts with the launch of Vista in 2007 -- may be familiar to users, Program Manager Group Converter is probably not, Kolsek admitted. But both can be exploited.
"They're part of every Windows installation and are associated with certain file extensions, allowing for 'double-click-bang' remote attacks," Kolsek said. "To increase the likelihood of success, an attacker can create a shortcut with a PDF or Word document icon pointing to such files, which otherwise have different, less familiar icons."
Contrary to Kolsek's claim, Program Manager Group Converter, a holdover from pre-Windows 95 days, is included with Windows XP, but not with Vista or Windows 7.
Altogether, Acros uncovered 121 remote execution vulnerabilities in 41 different Microsoft applications, but reported details of only the pair in Address Book/Contacts and Program Manager Group Converter. The rest were left for Microsoft's own researchers to find, said Kolsek.
Like a number of other companies, notably the French firm Vupen Security, Acros has decided that it will no longer report its vulnerability discoveries to vendors without compensation. "We've been giving them away for 10 years now," said Kolsek, "and it wasn't doing anything for us."
In a long post to a new Acros blog, Kolsek added that there was no bad blood between his company and Microsoft over the former's refusal to identify 119 bugs in the software vendor's products. "It was a mere incompatibility of business interests," he said.
Wireshark's lead developer, Gerald Combs, said today that a fix for the DLL load hijacking bug would be released in the next few days. Microsoft and BitTorrent, the firm responsible for uTorrent, did not reply to requests for comment about their patching plans.
If you like this informative post, then please subscribe to my full RSS Feed.
How can Microsoft owned application be at fault? Well, The lack of insight in their OS architecture allowed their own programs to be remotely exploited using DLL load hijacking.
Less than 24 hours after Microsoft said it couldn't patch Windows to fix a systemic problem, attack code appeared Tuesday to exploit the company's software.
On Monday, Microsoft confirmed reports of unpatched -- or zero-day -- vulnerabilities in a large number of Windows programs, then published a tool it said would block known attacks. At the same time, the company said it would not patch Windows because doing so would cripple existing applications.
Microsoft also declined to reveal whether any of its own applications contain bugs that attackers could exploit, saying only that it is investigating.
Many Windows applications don't call code libraries -- dubbed "dynamic-link library," or "DLL" -- using the full path name, but instead use only the file name, giving hackers wiggle room that they can then exploit by tricking an application into loading a malicious file with the same name as a required DLL.
If attackers can dupe users into visiting malicious Web sites or remote shares, or get them to plug in a USB drive -- and in some cases con them into opening a file -- they can hijack a PC and plant malware on it.
By Tuesday, at least four exploits of what some call "binary planting" attacks -- and what others dub "DLL load hijacking" attacks -- had been published to a well-known hacker site. Two of the exploits targeted Microsoft-made software, including PowerPoint 2010, the presentation application in Office 2010, and Windows Live Mail, a free e-mail client bundled with Vista but available as a free download for Windows 7 customers.
Other exploits aimed at leveraging DLL load hijacking bugs in uTorrent and Wireshark, a BitTorrent client and network protocol analyzer, respectively.
At the same time, a Slovenian security company claimed that it reported bugs in two Microsoft-made programs last March.
"We're going to publish a list of the vulnerable apps we found sometime soon," said Mitja Kolsek, the CEO of Acros Security. "However, since HD Moore's tool kit is already being used for finding vulnerable apps and at this point hundreds of good and bad guys already know about it, I can say that the two we fully disclosed to Microsoft were in Windows Address Book/Windows Contacts and Windows Program Manager Group Converter."
HD Moore is the U.S. researcher who kicked off a small wave of DLL load hijacking reports last week when announced he had found 40 vulnerable Windows applications. On Monday, Moore published an auditing tool that others can use to detect vulnerable software. When combined with an exploit added that same day to Metasploit, the open-source hacking tool kit that Moore authored, the tool's results produce what he called a "point-and-shoot" attack.
All four of the exploits that went public Tuesday appear to be based on Moore's Metasploit attack code.
Although the Windows Address Book -- renamed Windows Contacts with the launch of Vista in 2007 -- may be familiar to users, Program Manager Group Converter is probably not, Kolsek admitted. But both can be exploited.
"They're part of every Windows installation and are associated with certain file extensions, allowing for 'double-click-bang' remote attacks," Kolsek said. "To increase the likelihood of success, an attacker can create a shortcut with a PDF or Word document icon pointing to such files, which otherwise have different, less familiar icons."
Contrary to Kolsek's claim, Program Manager Group Converter, a holdover from pre-Windows 95 days, is included with Windows XP, but not with Vista or Windows 7.
Altogether, Acros uncovered 121 remote execution vulnerabilities in 41 different Microsoft applications, but reported details of only the pair in Address Book/Contacts and Program Manager Group Converter. The rest were left for Microsoft's own researchers to find, said Kolsek.
Like a number of other companies, notably the French firm Vupen Security, Acros has decided that it will no longer report its vulnerability discoveries to vendors without compensation. "We've been giving them away for 10 years now," said Kolsek, "and it wasn't doing anything for us."
In a long post to a new Acros blog, Kolsek added that there was no bad blood between his company and Microsoft over the former's refusal to identify 119 bugs in the software vendor's products. "It was a mere incompatibility of business interests," he said.
Wireshark's lead developer, Gerald Combs, said today that a fix for the DLL load hijacking bug would be released in the next few days. Microsoft and BitTorrent, the firm responsible for uTorrent, did not reply to requests for comment about their patching plans.
If you like this informative post, then please subscribe to my full RSS Feed.
Spider Labs released tool to hack Android smartphones
Two security experts said on Friday they released a tool for attacking smartphones that use Google Inc's Android operating system to persuade manufacturers to fix a bug that lets hackers read a victim's email and text messages.
"It wasn't difficult to build," said Nicholas Percoco, head of Spider Labs, who along with a colleague, released the tool at the Defcon hacker's conference in Las Vegas on Friday.
Percoco said it took about two weeks to build the malicious software that could allow criminals to steal precious information from Android smartphones.
"There are people who are much more motivated to do these things than we are," he added.
The tool is a so-called root kit that, once installed, allows its developer to gain total control of Android devices, which are being activated by consumers at a rate of about 160,000 units per day, according to Google.
"We could be doing what we want to do and there is no clue that we are there," Percoco said.
The test attacks were conducted on HTC Corp's Android-based Legend and Desire phones, but he believed it could be conducted on other Android phones.
The tool was released on a DVD given to conference attendees. Percoco was scheduled to discuss it during a talk on Saturday.
Google and HTC did not immediately return calls for comment.
Some 10,000 hackers and security experts are attending the Defcon conference, the world's largest gathering of its type, where computer geeks mix with federal security officials.
Attendees pay $140 in cash to attend and are not required to provide their names to attend the conference. Law enforcement posts undercover agents in the audience to spot criminals and government officials recruit workers to fight computer crimes and for the Department of Defense.
Organizers of the conference say presenters release tools such as Percoco's root kit to pressure manufacturers to fix bugs.
Recommended reading:
* TM UniFi is hackable
* Shaoxing, China is a city of hackers
* How to use SkyGrabber to hack U.S. Predator drones
If you like this informative post, then please subscribe to my full RSS Feed.
"It wasn't difficult to build," said Nicholas Percoco, head of Spider Labs, who along with a colleague, released the tool at the Defcon hacker's conference in Las Vegas on Friday.
Percoco said it took about two weeks to build the malicious software that could allow criminals to steal precious information from Android smartphones.
"There are people who are much more motivated to do these things than we are," he added.
The tool is a so-called root kit that, once installed, allows its developer to gain total control of Android devices, which are being activated by consumers at a rate of about 160,000 units per day, according to Google.
"We could be doing what we want to do and there is no clue that we are there," Percoco said.
The test attacks were conducted on HTC Corp's Android-based Legend and Desire phones, but he believed it could be conducted on other Android phones.
The tool was released on a DVD given to conference attendees. Percoco was scheduled to discuss it during a talk on Saturday.
Google and HTC did not immediately return calls for comment.
Some 10,000 hackers and security experts are attending the Defcon conference, the world's largest gathering of its type, where computer geeks mix with federal security officials.
Attendees pay $140 in cash to attend and are not required to provide their names to attend the conference. Law enforcement posts undercover agents in the audience to spot criminals and government officials recruit workers to fight computer crimes and for the Department of Defense.
Organizers of the conference say presenters release tools such as Percoco's root kit to pressure manufacturers to fix bugs.
Recommended reading:
* TM UniFi is hackable
* Shaoxing, China is a city of hackers
* How to use SkyGrabber to hack U.S. Predator drones
If you like this informative post, then please subscribe to my full RSS Feed.
TM UniFi is hackable
Subscribers to Telekom Malaysia Bhd's high-speed broadband service UniFi are vulnerable to exploitation due to a router setting that leaves it open to outside attack.
A hacker could take control of the router remotely and could, for instance, surf using the owner's account, open ports that could leave the computer vulnerable to further attacks and spy on the user's Internet activities.
"rizvanrp," who posts on the LowYat Forum (bit.ly/bm6Eqe) discovered the vulnerability and went public with it on May 29. His discovery was also posted on Twitter.
According to him, the vulnerability is due to TM leaving each router's remote management capability switched on, thus making it possible for others to remotely access the router using a username and password that is now easily found on the Internet.
Having said that, to be able to access the router from outside the local network, the hacker would need to know the device's WAN IP (wide area network Internet protocol) address.
Or the hacker could gain access via the user's WiFi network by discovering the network password.
According to networking experts, while this is possible, it is quite unlikely that a hacker would be successful.
In his post, rizvanrp said that disabling the router's remote management function would stop anyone from outside the local network from accessing the router settings.
TM said it is aware of the situation and is preparing an official response.
A hacker could take control of the router remotely and could, for instance, surf using the owner's account, open ports that could leave the computer vulnerable to further attacks and spy on the user's Internet activities.
"rizvanrp," who posts on the LowYat Forum (bit.ly/bm6Eqe) discovered the vulnerability and went public with it on May 29. His discovery was also posted on Twitter.
According to him, the vulnerability is due to TM leaving each router's remote management capability switched on, thus making it possible for others to remotely access the router using a username and password that is now easily found on the Internet.
Having said that, to be able to access the router from outside the local network, the hacker would need to know the device's WAN IP (wide area network Internet protocol) address.
Or the hacker could gain access via the user's WiFi network by discovering the network password.
According to networking experts, while this is possible, it is quite unlikely that a hacker would be successful.
In his post, rizvanrp said that disabling the router's remote management function would stop anyone from outside the local network from accessing the router settings.
TM said it is aware of the situation and is preparing an official response.
David Kernell faces 20 years behind bars for email hacking
David Kernell, a college student who hacked into former Republican US vice presidential candidate Sarah Palin's email account and posted some of its contents on the internet has been found guilty.After four days of deliberations, a federal jury found David Kernell, the 22-year-old son of a Democratic Tennessee state legislator, guilty of obstruction of justice, a felony, and unauthorised access of a computer, a misdemeanor.
Kernell was cleared of a wire fraud charge, and the jury could not agree on a verdict on a charge of identity theft.
Judge Thomas Phillips declared a mistrial on the identity theft charge but did not set a date for sentencing.
The obstruction charge alone carries a prison sentence of up to 20 years, while the misdemeanor count is punishable by up to one year in jail.
Sarah Palin issued a statement on her Facebook page, thanking the jury and prosecutors and explaining the case's importance.
"Besides the obvious invasion of privacy and security concerns surrounding this issue, many of us are concerned about the integrity of our country's political elections. America's elections depend upon fair competition," the statement said.
"Violating the law, or simply invading someone's privacy for political gain, has long been repugnant to Americans' sense of fair play. As Watergate taught us, we rightfully reject illegally breaking into candidates' private communications for political intrigue in an attempt to derail an election."
A subdued Kernell had no comment, and he was released on bond while barred from using a computer except for school assignments and email.
Kernell's attorney had argued during the weeklong trial the hacking of Palin's email account amounted to nothing more than a college prank, but prosecutors said Kernell had hoped to derail the Republican's campaign.
Palin and her daughter Bristol each testified about the disruption the break-in had caused to both their personal lives and the campaign.
"If there's any unauthorised access to computers, the Department of Justice takes that very seriously," said prosecutor Mark Krotoski after the verdict was announced in a US District Court.
In September 2008, Kernell did a little research and some guesswork to answer security questions and gain access to Palin's personal email account. At the time, published reports had questioned whether the then-Alaska governor had improperly used her personal email to conduct official business.
Kernell said he found nothing incriminating, but posted some of the account's contents online, along with a new password he assigned it.
"The conduct was serious," Krotoski said. "He had every opportunity to pull out and not proceed."
Recommended reading:
* Daily Hot Keywords: Ann Kilkenny - Letter About Sarah Palin
* Top 10 Hacker's Favourite Passwords
Subscribe to:
Posts (Atom)