Never trust a subcontractor

It all started with a phone call. "The whole network at [customer redacted] is down and they have no power - they need your help."

My blood ran cold. The engineer calling me sounded panicked, and for good reason. [Customer redacted] has an enormous natural gas facility in South Texas, too far from civilization to get enough power off of the grid. We designed and built an onsite natural gas power plant for them - a big one, capable of supplying 40+MW of power at peak load. They could run the facility for a short while without the power plant, but not long - and shutting down the facility meant losing 7 figures per hour. By the time I was informed, they had 6 hours until they had to shut down.

As the guy who had designed and installed said network, I was naturally the guy to call when it had problems, which had never happened before. It was a pretty simple network, honestly - just switches, cat5 cables and fiber. Since this was the network all the PLCs, relays, meters and whatnot ran on, it was airgapped & isolated, no routers. Not much to go wrong.

I quickly get on the phone and walk the guy on their end through plugging in a laptop and running
some simple tests. Check lights on things, ping this, ping that. Everything seems good, though. The network is emphatically not down. So I send him a remote app and take control of his laptop to see for myself.

Log into switches, check things, nope, the network's not down. When I log into the HMI system, though, I see a big red error message: "Network Error: Cannot connect to database". The database server is up, though. I log into the database server (Windows Server 2012 running MSSQL) and that's where I find the problem: SQL isn't running. I try to start it and it immediately shuts back off.

Hacking Team Uses UEFI BIOS Rootkit

The dissection of the data from the Hacking Team leak has yielded another critical discovery: Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets’ systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.

They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops).  However, the code can very likely work on AMI BIOS as well.

A Hacking Team slideshow presentation claims that successful infection requires physical access to the target system; however, we can’t rule out the possibility of remote installation. An example attack scenario would be: The intruder gets access to the target computer, reboots into UEFI shell, dumps the BIOS, installs the BIOS rootkit, reflashes the BIOS, and then reboots the target system. We’ve found that Hacking Team developed a help tool for the users of their BIOS rootkit, and even provided support for when the BIOS image is incompatible.

HackingTeam become Hacked Team

An ‘enemy of the internet’ that helps governments spy on citizens has been hacked
The (ironically-named) Hacking Team is an Italian security firm with a history of supplying surveillance technology to governments around the world, including some unpleasant regimes. It’s now been hacked itself.

As CSO Online reports, the source of the hack isn’t clear yet, but a torrent file with 400GB of internal documents, product source code and email archives is now public. There’s no shortage of glee online about the development, particularly from privacy activists. Campaign group Reporters Without Borders lists Hacking Team on its Enemies of the Internet index. Most of the strong criticism directed at the company is down to its surveillance tool Da Vinci, which it says can be used to break encryption on emails, files and IP calls.

In the last, Hacking Company has denied any allegations of selling tools to the governments but the leaked emails show that company has done some pretty good business with the oppressive regimes in Sudan, Saudi Arabia, and Bahrain.

The unknown hackers have posted various file links on file sharing websites and replaced the company logo that read “Hacking Team” to “Hacked Team”  on Twitter. Many companies are known to develop highly sophisticated software and help the governments to monitor the people’s smartphones and personal computers.

Hackers obtained access to FreeBSD servers

On Sunday 11th of November, an intrusion was detected on two machines within the FreeBSD.org cluster. The affected machines were taken offline for analysis. Additionally, a large portion of the remaining infrastructure machines were also taken offline as a precaution.

We have found no evidence of any modifications that would put any end user at risk. However, we do urge all users to read the report available at http://www.freebsd.org/news/2012-compromise.html and decide on any required actions themselves. We will continue to update that page as further information becomes known. We do not currently believe users have been affected given current forensic analysis, but we will provide updated information if this changes.

As a result of this event, a number of operational security changes are being made at the FreeBSD Project, in order to further improve our resilience to potential attacks. We plan, therefore, to more rapidly deprecate a number of legacy services, such as cvsup distribution of FreeBSD source, in favour of our more robust Subversion, freebsd-update, and portsnap models.

Source: FreeBSD

Singaporeans get hard token baked into credit card

Two-factor authentication just got a whole lot more convenient for residents of Singapore, after Standard Chartered Bank's local outfit teamed with MasterCard to offer account-holders a credit card that is also a one-time-password-generating hard token.

MasterCard calls the device a 'Display Card' and says it includes “an embedded LCD display and touch-sensitive buttons”.

The hard token functionality seems not to have anything to do with the credit card, as Standard Chartered says it will be used with its online banking products when customers make “ higher-risk transactions such as payments or transfers above a certain amount, adding third party payees, or changing personal details.” If it behaves as other hard tokens do, punters enter a code with the keyboard, read the resulting one-time-password on the screen and then enter that code into the computing device they're using for online banking. Logon credentials for online banking service will still be required.

The card's been doing the rounds of Europe for a couple of years now, scoring a few wins with Turkish, Romanian and Belgian financial institutions.

But the win at Standard Chartered, a British outfit with global footprint, gives the technology useful profile.

Nagra ID security, the Swiss company behind the token-in-a-card, insists the device will sit happily in one's wallet and offers a three year warranty, which we believe makes it safe to sit on. The card is, in all other ways, a completely conventional credit card and can be embossed, branded and carry holographic security devices like any other credit card. ®

Source: TheRegister

Board of Computing Professionals Malaysia

There are currently an initiative to establish a Board of Computing Professionals Malaysia (BCPM), which will function to accredit ICT academic programmes, as well as to promote, facilitate and regulate the profession (very much like the Board of Engineers for engineering, and the Bar Council for the legal profession, etc.). This initiative is under the purview of the Ministry of Science and Innovation (MOSTI) and led by the National ICT Human Resource Task Force under the Ministry of Higher Education (MOHE) and within the ICT Human Capital Development Framework.

They invited all ICT practitioners and those related to the profession to participate in an on-line survey that will be open for responses from Sunday 28 Oct 2012 to Sunday 4 November 2012 (24:00). The survey aims to solicit feedback from the ICT community to determine the overall suitability and general acceptance to the proposal for the establishment of the BCPM. The survey site is avialable here.

The introduction to the survey and the instructions for filling the questionnaire will be provided at the stated site, as well as a link to another site that provides the general context to the proposal. Although we do not foresee any problem that may occur at the said site, should there be difficulties, an alternative site will be made available here.

HITB - Keeping Knowledge Free for Over a Decade

Some of you might remember the first HITB conference at Cititel Hotel, Kuala Lumpur back in 2003. That year HD Moore spoke about Metasploit back when it was just the Metasploit Framework. That very conference also marked the last public appearance for LSD Group aka The Hackers Who Broke Windows. Sounds like a decade ago? Well, you are right. Believe it or not, it has been TEN YEARS since HITB CREW first conference and what a ride it has been – ten great years, three continents, hundreds of speakers, thousands of attendees and a lifetime of stories.

Other Conference Activities:
HackWeekDay
Following the success of HackWEEKDAY held for the first time last year at the HITB Security Conference in Kuala Lumpur, HITB2012KUL will see the introduction of HackWEEKDAY – Hack-to-Hack

An all new 36 hour hackathon which will will run alongside our 10th year anniversary conference kicking off on the evening of October 9th (training day 2).

Registration is COMPLETELY FREE and we have space for 50 developers in total comprising a mix of .edu and professional developers.

CommsecVillage
The HITB CommSec Village is our new Community and Security area dedicated to highlighting various security related projects from the open source community and from various hackerspaces. These communities will have their own playground and demonstration area to show off their projects and a chance to interact with the conference attendees.

Capture The Flag
To celebrate the 10th year anniversary of HITBSecConf, the CTF Overlords and CTF Crews 1.0, 2.0 and the all-new 3.0 will be coming together to work on a 32 HOUR NON STOP CAPTURE THE FLAG COMPETITION which we’re calling CTF Weapons of Mass Destruction – Fallout Apocalypse!

In our previous CTF Weapons of Mass Destruction, Teams had a set of daemons / services running on their machines and they had to exploit rival teams’ daemons to steal their flags. Submit the flags to obtain offensive points and also unlock nuclear weapons that can be launched against rival teams. For defensive points, all the team had to do was to keep their daemons up and running.

New Scientist: Exclusive first interview with key LulzSec hacker

It was early May when LulzSec's profile skyrocketed after a hack on the giant Sony corporation. LulzSec's name comes from Lulz, a corruption of LOL, often denoting laughter at the victim of a prank. For 50 days until it disbanded, the group's unique blend of humour, taunting and unapologetic data theft made it notorious. But knowing whether LulzSec was all about the "lulz" or if it owed more to its roots as part of Anonymous, the umbrella group of internet subculture and digital activism, was pure speculation. Until now.

Who is "Sabu"?
I'm a man who believes in human rights and exposing abuse and corruption. I generally care about people and their situations. I'm into politics and I try my best to stay on top of current events.

We've seen you cast as everything from the greatest of heroes to the most evil of villains. How would you characterise yourself?

It is hard for me to see myself as either. I am not trying to be a martyr. I'm not some cape-wearing hero, nor am I some supervillain trying to bring down the good guys. I'm just doing what I know how to do, and that is counter abuse.

What was your first experience with "hacktivism"?

I got involved about 11 years ago when the US navy was using Vieques Island in Puerto Rico as a bombing range for exercises. There were lots of protests going on and I got involved in supporting the Puerto Rican government by disrupting communications. This whole situation was the first of its kind for the island and the people didn't expect things to go that route. Eventually, the US navy left Vieques.

How did you get involved with Anonymous?

When I found out about what happened to Julian Assange, his arrest in the UK and so on, I found it absolutely absurd. So I got involved with Anonymous at that point.

What operation really inspired you and why?

Earlier this year, we got wind of the Tunisians' plight. Their government was blocking access to any website that reported anti-Tunisian information, including Tunileaks, the Tunisian version of Wikileaks, and any news sites discussing them.

Tunisians came to us telling us about their desire to resist. "Disrupt the government of Tunisia," they said, and we did. We infiltrated the prime minister's site and defaced it externally. When Tunisia filtered off its internet from the world, it was the Tunisians who came online using dial-up and literally allowed us to use their connections to tunnel through to re-deface the prime minister's websites. It was the most impressive thing I've seen: a revolution coinciding both physically and online. It was the first time I had proof that what Anonymous was doing was real and it was working.

What would you like to say to people who say that you and other Antisec/Anonymous/LulzSec members are just troublemakers who have caused untold damage and loss to people for no apparent reason?

Would you rather your millions of emails, passwords, dox [personal information] and credit cards be exposed to the wild to be used by nefarious dealers of private information? Or would you rather have someone expose the hole and tell you your data was exploitable and that it's time to change your passwords? I'm sure we are seen as evil for exposing Sony and others, but at the end of the day, we motivated a giant to upgrade its security.

But what about hacks that were done "for lulz"?

Yes, some hacks under LulzSec were done for the lulz, but there are lessons learned from them all. In 50 days, you saw how big and small companies were handling their user data incorrectly. You saw the US federal government vulnerable to security issues that could have just as easily been exploited by foreign governments. You saw affiliates of the US government handling sensitive emails and they themselves ignored the FBI's better practice manuals about password re-use.

With the Public Broadcasting Service site, you saw the media vulnerable to fake articles. And yes, our Frontline hit [the group attacked the PBS's Frontline television programme website after perceived unfair treatment of Wikileaks] was political, but we also showed what could happen if an organisation were to hack 50 of the biggest media publications right now, online, and distribute a mass news article designed to blend in on each outlet's site. That kind of thing would cause some serious havoc. I mean, we're talking about the potential of crashing stocks or spreading damaging rumours. Everything we did had a duality: a lesson and some LOLs at the same time.

When did you realize you had hit the point of no return?

I was at the point of no return when I realised that I could make a change. Operation Tunisia was it for me. Then HBGary [a security firm attacked by LulzSec]. Now Antisec is the biggest movement in years, unifying all hackers and free thinkers across Anonymous and other groups. There's no going back.

How do you describe what Antisec is about?

Expose corruption. Expose censorship. Expose abuses. Assist our brothers and sisters during their operations in their own countries like the one we have going in Brazil now, Operation Brazil, which is about internet/information censorship. Expose these big multinational companies that have their hands in too much, that have too much power, and don't even take the time to secure your passwords and credit cards. And finally, discussion and education. We are not sitting idly by and letting our rights get thrashed. It's time to rise up now.

So what would an Antisec "win" look like?

There is no win. There's just change and education.

The popularity of LulzSec and Anonymous has inspired many to follow in your footsteps. What words of wisdom do you have for them?

Those who are with me in the fight do not have to be hackers. They can be reporters, artists, public speakers. This movement is about all of us uniting against corruption. But I don't ask anyone to take my risks. I don't want anyone to follow me down my path.

Are you afraid of being caught?

There is no fear in my heart. I've passed the point of no return. I only hope that if I am stopped, the movement continues on the right path without me.

Source: New Scientist

LulzSec Issues: 50 Days of Lulz

LulzSec has issued final data release saying they will now go underground while urging the antisec movement continue with what they have started.

The announcement follows 50 days of hacks and attacks launched by the group, the most significant of which being the revelation of how large the US Domestic spy program has grown and the release of documents from the State of Arizona revealing corruption and racism by government in the fight against illegal immigration which included the revelation that US Marines were being used as contract killers.

For the past 50 days we've been disrupting and exposing corporations, governments, often the general population itself, and quite possibly everything in between, just because we could. All to selflessly entertain others - vanity, fame, recognition, all of these things are shadowed by our desire for that which we all love. The raw, uninterrupted, chaotic thrill of entertainment and anarchy. It's what we all crave, even the seemingly lifeless politicians and emotionless, middle-aged self-titled failures. You are not failures. You have not blown away. You can get what you want and you are worth having it, believe in yourself.

Source pastebin


. /$$ /$$ /$$$$$$
.| $$ | $$ /$$__ $$
.| $$ /$$ /$$| $$ /$$$$$$$$| $$ \__/ /$$$$$$ /$$$$$$$
.| $$ | $$ | $$| $$|____ /$$/| $$$$$$ /$$__ $$ /$$_____/
.| $$ | $$ | $$| $$ /$$$$/ \____ $$| $$$$$$$$| $$
.| $$ | $$ | $$| $$ /$$__/ /$$ \ $$| $$_____/| $$
.| $$$$$$$$| $$$$$$/| $$ /$$$$$$$$| $$$$$$/| $$$$$$$| $$$$$$.$
.|________/ \______/ |__/|________/ \______/ \_______/ \_______/
//Laughing at your security since 2011!

.-- .-""-.
. ) ( )
. ( ) (
. / )
. (_ _) 0_,-.__
. (_ )_ |_.-._/
. ( ) |lulz..\
. (__) |__--_/
. |'' ``\ |
. | [Lulz] \ | /b/
. | \ ,,,---===?A`\ | ,==y'
. ___,,,,,---==""\ |M] \ | ;|\ |>
. _ _ \ ___,|H,,---==""""bno,
. o O (_) (_) \ / _ AWAW/
. / _(+)_ dMM/
. \@_,,,,,,---==" \ \\|// MW/
.--''''" === d/
. // SET SAIL FOR FAIL!
. ,'_________________________
. \ \ \ \ ,/~~~~~~~~~~~~~~~~~~~~~~~~~~~
. _____ ,' ~~~ .-""-.~~~~~~ .-""-.
. .-""-. ///==--- /`-._ ..-' -.__..-'
. `-.__..-' =====\\\\\\ V/ .---\.
. ~~~~~~~~~~~~, _',--/_.\ .-""-.
. .-""-.___` -- \| -.__..-

Friends around the globe,

We are Lulz Security, and this is our final release, as today marks something meaningful to us. 50 days ago, we set sail with our humble ship on an uneasy and brutal ocean: the Internet. The hate machine, the love machine, the machine powered by many machines. We are all part of it, helping it grow, and helping it grow on us.

For the past 50 days we've been disrupting and exposing corporations, governments, often the general population itself, and quite possibly everything in between, just because we could. All to selflessly entertain others - vanity, fame, recognition, all of these things are shadowed by our desire for that which we all love. The raw, uninterrupted, chaotic thrill of entertainment and anarchy. It's what we all crave, even the seemingly lifeless politicians and emotionless, middle-aged self-titled failures. You are not failures. You have not blown away. You can get what you want and you are worth having it, believe in yourself.

While we are responsible for everything that The Lulz Boat is, we are not tied to this identity permanently. Behind this jolly visage of rainbows and top hats, we are people. People with a preference for music, a preference for food; we have varying taste in clothes and television, we are just like you. Even Hitler and Osama Bin Laden had these unique variations and style, and isn't that interesting to know? The mediocre painter turned supervillain liked cats more than we did.

Again, behind the mask, behind the insanity and mayhem, we truly believe in the AntiSec movement. We believe in it so strongly that we brought it back, much to the dismay of those looking for more anarchic lulz. We hope, wish, even beg, that the movement manifests itself into a revolution that can continue on without us. The support we've gathered for it in such a short space of time is truly overwhelming, and not to mention humbling. Please don't stop. Together, united, we can stomp down our common oppressors and imbue ourselves with the power and freedom we deserve.

So with those last thoughts, it's time to say bon voyage. Our planned 50 day cruise has expired, and we must now sail into the distance, leaving behind - we hope - inspiration, fear, denial, happiness, approval, disapproval, mockery, embarrassment, thoughtfulness, jealousy, hate, even love. If anything, we hope we had a microscopic impact on someone, somewhere. Anywhere.

Thank you for sailing with us. The breeze is fresh and the sun is setting, so now we head for the horizon.

Let it flow...

Lulz Security - our crew of six wishes you a happy 2011, and a shout-out to all of our battlefleet members and supporters across the globe

------------------------------------------------------------------------------------------------------

Our mayhem: http://lulzsecurity.com/releases/
Our chaos: http://thepiratebay.org/user/LulzSec/
Our final release: http://thepiratebay.org/torrent/6495523/50_Days_of_Lulz

Please make mirrors of material on the website, because we're not renewing the hosting. Goodbye. <3

#OpMalaysia - Die Another Day

#OpMalaysia, another day - Anonops attacks has failed to get the Government full attention. The Malaysian Communications and Multimedia Commission (MCMC) issued a statement regarding the first attempt and claimed there was only a little impact on a Malaysian users as a result.

"Our monitoring of the situation showed that there was a reduced level of attacks by 4.00am this morning and upon further evaluation, so far we gauge that there has been little impact on Malaysian users as a result of this attack."

In reference to this statement, #OpMalaysia posted another statement on 17th of June to youtube says a second round of attacks against the Government of Malaysia is planned for the 4th of July at 13:37 GMT (21:37 MYT).

"We shall bring down the entire countries national infrastructure. We shall make this a day to be remembered. This is your second warning."

#OpMalaysia - Day 2

#OpMalaysia, day 2 - Its was a bored night, I did not find any interesting. The only thing make me stay is that to meet and watch almost of Malaysian Security Group tried to get involve and contribute 'something' that might help our country, it was like a Malaysian Security Group Reunion. As for me,  I'd like to understand how this hacker group conduct their attack, what are the techniques, what method, what tools and etc.

As for now, this group still looking for ideas how to achieve their mission as stated at codepad:

NO attacks againts .edu and/or media.
We protect free speech.

NO LOIC, NO TAKING DOWN, NO MATTER WHAT.
NO DEFACING, EXCEPT FOR THE FEW CASES MENTIONED BELOW.
NO TROLLING. DON'T BOTHER ASKING FOR DDOS TARGETS; THIS IS A NO-DDOS OPERATION.

BE CREATIVE! ONLY WITH YOUR HELP CAN WE HAVE SUCCESS!
YOU ARE INVITED TO DISCUSS. SUBMIT YOUR SUGGESTIONS!

=====================================================

PROBLEM:
Malaysia blocks filesharing sites.

GOAL:
* Help Malaysians get around filters
* Create media attention for the cause
* Inform Malaysians of the existence of the op and invite them to join us
* Make websites accessible again - either by disabling the filter or making the government disable it.
* It's just about giving the people back their freedom
* To tell people how ridicilous spending over 1.8 million to develop facebook page

#OpMalaysia channel logs - Day 2

Session Start: Thu Jun 16 19:16:43 2011
Session Ident: #OpMalaysia
 10[19:16] * Now talking in #OpMalaysia
 00[19:16] * Topic is 'NO DDOS, NO LOIC, NO TAKING DOWN - IDEAS AT http://codepad.org/VFi2mktC | DNS HOW TO VIDS http://goo.gl/8wsPi | HOW TO BYPASS FILTER: http://bit.ly/kL8yoK | ENGLISH ONLY PLEASE THANKS || Channels for DDoS: #OpV #Operationfreedom #opitaly '
 00[19:16] * Set by Nessuno on Thu Jun 16 05:29:03
#----- REMOVED -----#
[19:17]  ic ..
[19:17]  ofcorse still can hack everything is hackable otherwise it would not exist due to the paradox of it not having a way in which would mean there is no use for it caust you just bought a heavy brick
 10[19:17] * Joins: OpMalaysia977 (OpMalaysia977@AN-4ar.kbp.ipasrr.IP)
[19:17]  unbeatable skmm . hacker are loser
 09[19:17] * Payik  11,1grabs 8,1 aL-Pacino's  11,1underwear. pulls it over 8,1 aL-Pacino's  11,1Head..... Now you look much better.
[19:17]  so, how
[19:17]  The only thing you can't hack is the mother nature
[19:17]  updated: http://thestar.com.my/news/story.asp?file=/2011/6/16/nation/20110616104624&sec=nation
[19:17] <%Effexor> Title: MCMC: 41 Govt websites disrupted at various levels (at thestar.com.my)
[19:18]  so how's the opmalaysia going on ?
[19:18]  upgrading firewall will introduce new bug
 10[19:18] * Parts: mysql (tsol@Y.N.W.A)
[19:18]  clobella succesfull..we dont have to do anything..the gov does
[19:18] <@OnlyWork> If anybody needs any translation to assist the media were anonymous please ask
[19:18] <@OnlyWork> I am neutral, I am a translator
#----- REMOVED -----#
[19:33]  http://world.yes.my/?q=ytlc&id=511  <... nice updates
[19:33] <%Effexor> Title: Special Report: Operation Malaysia (Updated) | Yes World (at world.yes.my)
[19:33]  For more information about opMalaysia please pm devtar
[19:33]  yes i am 
[19:33]  long live Rilekscrew
[19:33]  haha
[19:33]  :D
#----- REMOVED -----#
[04:25] <&bishop> where are the guys?
[04:26] <&Cake> what guys
[04:26]  ouhh, i wanna sleep
[04:26]  bye
 02[04:26] * Quits: zenoh (Mibbit@AN-8ue.2nv.mpq0id.IP ) (Quit: http://www.mibbit.com ajax IRC Client )
[04:27] <&bishop> the malaysians
[04:27] <&bishop> it's their operation 
#----- REMOVED -----#
[04:38] <&bishop> they took.edu sites down.
[04:38] <&bishop> that is stupid
[04:39]  yup
[04:39]  just using the op as an excuse to do their personal shit
[04:39]  good for pentest market 
[04:39]  its about time
#----- REMOVED -----#
 02[05:44] * Quits: &bishop (bishop@love.under.will ) (A TLS packet with unexpected length was received. )
[05:45]  #OpBrazil is tomorrow help us
#----- REMOVED -----#
 10[07:12] * Parts: d0ct0r (d0ct0r@anon.y.mous) (Services forced part )
 10[07:14] * Joins: d0ct0r (d0ct0r@anon.y.mous)
 02[07:16] * Quits: setsuna00 (chiasengkiat@AN-2fq.6qh.b7n9eh.IP ) (Quit:  )
 10[07:18] * Joins: sluggo (Mibbit@AN-h92.d6n.j3pqkf.IP)
 02[07:19] * Quits: d0ct0r (d0ct0r@anon.y.mous ) (Z-Lined )
 02[07:20] * Quits: sluggo (Mibbit@AN-h92.d6n.j3pqkf.IP )
Session Close: Fri Jun 17 07:23:30 2011
#----- REMOVED -----#

#OpMalaysia - Day 1

Last night, most of Malaysian Security Community/Group join the anonops network for various reasons. The attacks started at 2330hrs Malaysian time. The hacker group is into co-ordinated attacks and keeps to its word when it comes to launching its attacks. These are likely independent hackers taking advantage of the publicity. Some say "sites may not have been hacked by Anonymous." CyberSecurity Malaysia, responsible for the nation's borders in cyberspace, confirmed that several websites were hacked. But it declined to say how many and which were the sites.

Well, these are some of the confirmed lists. Sites tagged with [Down] indicator means either it has been DDoS-ed or switched off by government. Confirm first whether the site are down or not by visiting this page http://www.isup.me:

1. - Malaysia Official Government Website [link] – [Down]
2. - SabahTourism.com [link] [Hacked][Leaked]
3. - CIDB [link] [Hacked] [Up]
4. - Land Public Transport Commision [link] [Suspected]
5. - Malaysian Meteorological Service [link] [Down]
6. - ASEANconnect [link] [Suspected]
7. - Hollywood-Artist.info [link] [Suspected]
8. - Ministry of Education [link] [Down]
9. – Suruhanjaya Pilihanraya Malaysia [link] [Down]
10. - Bomba [link][Down]
11. - TMNet [link][Down]
12. - Perbendaharaan Malaysia [link] [Down]
13. - Kementerian Kerja Raya Malaysia [link] [Down]
14. - Parlimen Malaysia [link] [Down]
15. - JobsMalaysia [link] [Down]
16. - Kementerian Penerangan, Komunikasi dan Kebudayaan [link] [Down]
17. - Portal KSM [link] [Down]
18. - Majlis Sukan Negara [link] [Down]
19. - gengblogger.com [link] [Hacked] 

#OpMalaysia channel logs:

Session Start: Wed Jun 15 20:08:36 2011
Session Ident: #OpMalaysia
 03[20:08] * Now talking in #OpMalaysia
 03[20:08] * Topic is ' 10Target:  7When OP takes place  10| Status:  4Up  10| Press Release:  14http://uleak.it/?3kn  10| When:  6June 15, 2011 7:30PM GMT  10| Flyer:  7http://uleak.it/?3kp  10| New to IRC or Hacking? Join  5#OpNewBlood or #Tutorials  10|Video:  11http://uleak.it/?3j7  10| VPN Guide:  11http://uleak.it/?3kq  '
 03[20:08] * Set by Anon_Tim on Wed Jun 15 10:54:50
[20:08]  i want to exploit it now
#----- REMOVED -----#
[21:00]  ptptn website would be best...haha
[21:00] <@morrissey> lol. who doesnt wish to get a 4flat? :P
[21:00]  i mean with daylight saving in, say the UK, it's 2pm now here but its 9pm in KL
[21:00]  haha
[21:01] <@OnlyWork> al wanted ptptn
 10[21:01] * Joins: WebAnon49361 (WebAnon49361@AN-4k9.7di.6jjkdg.IP)
[21:01]  so 4.30 it is
[21:01]  i wish had 4 flat in computer science :D
[21:01]  aiya dont attack ptptn nanti student susah woh :)
#----- REMOVED -----#
[21:01]  we can hack ptptn and burn the records, how is it sound?
[21:01] <@OnlyWork> and anono wont target financial side
#----- REMOVED -----#
[21:34]  hack ptptn please lmao
[21:34]  hahaha
 10[21:35] * Joins: Narakkk (Mibbit@AN-1hj.nid.7ssl5k.IP)
[21:35]  dont hack ptptn pls
 10[21:35] * Joins: noname (noname@AN-acb.532.7ssl5k.IP)
[21:35]  i got 70k loan
[21:35]  it's a final countdown
 10[21:35] * Joins: Aizad (textual@AN-vp2.5rh.5s204u.IP)
[21:35]  later increase become 1000k
[21:35]  LOL
[21:35]  LOL~
#----- REMOVED -----#
[23:30]  ========    attention the attack has begin!      =========
[23:31]  ========    attention the attack has begin!      =========
[23:31]  ========    attention the attack has begin!      =========
[23:31]  ========    attention the attack has begin!      =========
 10[23:31] * Joins: kreuger (Kreuger@AN-0k0.gaa.jsqf2k.IP)
[23:31]  ========    attention the attack has begin!      =========
#----- REMOVED -----#
[23:35]  cant connect to www.malaysia.gov.my
[23:35]  Malaysian police vows want to arrest anon members...rofl
[23:35]  u kill him
[23:35]  Yeah same
[23:35]  hahahha
[23:35]  they're scared already...
[23:36]  La primera ola pequeño ataque ha comenzado. Misión # 1: Stormrider
[23:36]  admin
[23:36]  who scared?
 10[23:36] * Joins: Anon97 (Sfrontierz@AN-9l5.u50.s7l9t5.IP)
 02[23:36] * Quits: Anon97 (Sfrontierz@AN-9l5.u50.s7l9t5.IP ) (Quit:  )
[23:36]  noted. cant access malaysia.gov.my
[23:36]  u mean police member?
 10[23:36] * Joins: Anon97 (Sfrontierz@AN-9l5.u50.s7l9t5.IP)
[23:36]  cuz
[23:36]  got ddos
[23:36]  Vv6: police lah
[23:36]  [23:36] * Dns resolving malaysia.gov.my
[23:36]  -
[23:36]  [23:36] * Dns unable to resolve malaysia.gov.my
[23:36]  -
#----- REMOVED -----#
[00:43]  What's the current target btw
[00:43]  !topic
 08[00:43] -Chuck:#OpMalaysia- Channel Topic:  10Target:  7When OP takes place  10| Status:  4Up  10| Press Release:  14http://uleak.it/?3kn  10| When:  6June 15, 2011 7:30PM GMT  10| Flyer:  7http://uleak.it/?3kp  10| New to IRC or Hacking? Join  5#OpNewBlood or #Tutorials  10|Video:  11http://uleak.it/?3j7  10| VPN Guide:  11http://uleak.it/?3kq 
[00:43]  yeah
[00:43]  ok this is funny https://www.facebook.com/mydragonforce/posts/231170146909664
[00:43] <~Effexor> Title: Di hack untuk kali... | Facebook (at www.facebook.com)
[00:43]  the new site
[00:43]  malaysia edition of piratebay
[00:43]  I am drunk, i sufffer from PMS, so be cautios
[00:43]  still on beta testing
 02[00:43] * Quits: SledgeAcidBurn (eddie@AN-u28.rmd.4tc11b.IP ) (Ping timeout: 121 seconds )
[00:43]  lol
[00:43]  ok thanks for the info
[00:43]  and I am lstening ti Ministry
 10[00:43] * Joins: mib_ufhywg (Mibbit@AN-h94.76m.p5m5r0.IP)
[00:44]  Hey, is http://www.your-freedom.net/ Safe? What do you think?
[00:44]  your bleeding bishop
[00:44]  wow malaysiabay its good :D
[00:44] <~Effexor> Title: Your Freedom - Bypass firewalls and proxies, stay anonymous (at www.your-freedom.net)
[00:44]  i am bleeding
[00:44]  1malaysia.gov.my is down??
[00:44]  lol bishop
[00:44]  http://www.samair.ru/proxy/socks.htm
[00:44] <~Effexor> Title: SOCKS servers lists (at www.samair.ru)
[00:44]  http://www.the8unit.com.my/news.php?id=%275 injeq~
[00:44]  !hive
[00:44] <~Effexor> Title: The 8 Unit (at www.the8unit.com.my)
 04[00:44] * joepie91 sets mode: -b *!*moar@staff.anonops.li
[00:44]  1malaysia.gov.my is down??
[00:44]  Sht_Tha_Fck_Up: do NOT use free VPNs
 04[00:44] * Chuck sets mode: +b *!*moar@staff.anonops.li
 04[00:44] * joepie91 was kicked by Chuck (Turn caps lock OFF! )
 10[00:44] * Joins: joepie91 (moar@staff.anonops.li)
[00:44]  http://www.downforeveryoneorjustme.com/malaysia.gov.my
[00:44]  !hive
[00:44] <~Effexor> Title: http://malaysia.gov.my Is Down -> Check if your website is up or down? (at www.downforeveryoneorjustme.com)
#----- REMOVED -----#
[00:59]  http://penang.uitm.edu.my/   <----- hackeddddddd
[00:59]  Title: H4ck3D By H3x4CreW RileksCreW 3viLc0d3s (at penang.uitm.edu.my)
[00:59]  Title: H4ck3D By H3x4CreW RileksCreW 3viLc0d3s (at penang.uitm.edu.my)
[00:59]  please dont ddos through proxy, you will dos the proxies not the site
#----- REMOVED -----#
[02:11]  stop using caps
 03[02:12] * ` is now known as D-Mist
[02:12]  xUmaRix: wak lu
[02:12]  http://www.cidb.gov.my/v6/?q=en/content/150%27%20OR%201;%20--
[02:12]  what is wak lu?
[02:12]  LULZ
[02:12]  DNS
[02:12]  can some1 ban the hibsec guy?
[02:12]  hi xUmaRix
[02:12]  SQL Injection :S http://www.cidb.gov.my/v6/?q=en/content/150%27%20OR%201;%20--
[02:12]  DNS ftw
#----- REMOVED -----#
 00[02:36] * bishop changes topic to 'IDEAS: http://piratenpad.de/hecz4sSj74 | Status: Up | Press Release: http://uleak.it/?3kn | When: June 15, 2011 7:30PM GMT | Flyer: http://uleak.it/?3kp | New to IRC or Hacking? Join #OpNewBlood or #Tutorials |Video: http://uleak.it/?3j7 | VPN Guide: http://uleak.it/?3kq | English Only Please '
 02[02:36] * Quits: kc (Mibbit@AN-v8g.uq1.chhu9g.IP ) (Quit: http://www.mibbit.com ajax IRC Client )
[02:36]  What are your targets supposed to be?
[02:36]  coordinate it!
 10[02:36] * Joins: opsony717 (opsony717@AN-qnc.qvr.fa4d8v.IP)
[02:36]  how about malaysia cop website
[02:37]  www.rmp.gov.my
[02:37]  .gov.my
 09[02:37] * WebAnon1921 slaps WebAnon1921 around a bit with a large fishbot
[02:37]  www.mod.gov.my running IIS 7.0
 03[02:37] * open-G0NE is now known as opensourcerer
[02:37]  we take down 1 by one.
[02:37]  YAH Take down the malaysian cop website!!!
#----- REMOVED -----#
[02:42] <@w33dy> PROBLEM: Malaysia blocks filesharing sites.
[02:42] <@w33dy> GOAL: * Help Malaysians get around filters
[02:42] <@w33dy>            * Create media attention for the cause
 10[02:42] * Joins: ab_nh (Mibbit@AN-9jl.cjh.p5m5r0.IP)
 02[02:42] * Quits: kambing (EpicAnon@AN-s7d.7s9.ndc0v8.IP ) (Quit:  )
 02[02:42] * Quits: se7en (se7en@AN-453.41i.qadka5.IP ) (Ping timeout: 121 seconds )
 02[02:42] * Quits: Sh1nky (Mibbit@AN-4pa.vpg.cpfies.IP ) (Quit: http://www.mibbit.com ajax IRC Client )
[02:42]  http://www.blm33.net/opmy.php
[02:42]  Umarix, you coordinate this attack.
[02:42] <@w33dy> POSSIBLE SOLUTIONS
[02:42] <@w33dy> =====================
[02:42] <@w33dy> 1. Unpublicized TOR nodes (these cannot be blocked because they are not publicly known, you can only use them when you have the IP)
[02:42] <@w33dy>     Howto: (insert link to howto here)
[02:42] <@w33dy>     
[02:42] <@w33dy> 2. Set up mirrors of filesharing sites
[02:42] <@w33dy>     -> Use something like httrack/wget to set up a mirror of thepiratebay etc on some spare server space? Suggestions welcome
 10[02:42] * Joins: Anonnite (Mibbit@AN-1dl.1bq.75uftt.IP)
[02:42] <@w33dy>     
[02:42] <@w33dy> 3. Set up alternatives 
[02:42] <@w33dy>     Basically, set up your own filesharing sites. Make them as accessible as possible
[02:42] <@w33dy>     Multiple domains, multiple IPs, etc.
[02:42]  changing DNS?
 10[02:42] * Joins: drusoft (drusoft@AN-fan.vsa.mpq0id.IP)
[02:42]  http://www.rmp.gov.my/ Server Error
[02:42] <@bishop> w33dy: put it on tha PAD
[02:42]  The server encountered an internal error and was unable to complete your request.
[02:43] <%Effexor> Title: Laman Web Rasmi Polis Diraja Malaysia (at www.rmp.gov.my)
[02:43]  +m?
[02:43]  using VPN and proxy servers.
#----- REMOVED -----#
[02:56]  do not try edu . that's not cool
[02:56] <@esc> legion: Has nothing to do with this op. :)
 04[02:56] * weezas was kicked by bishop (terminated )
 04[02:56] * legion was kicked by shift (wrong chan kiddo )
 02[02:56] * Quits: intan (asdasds@AN-coc.jri.nkkgq7.IP ) (Ping timeout: 121 seconds )
[02:56] <&shift> o/
[02:56]  no edu right ?
 02[02:56] * Quits: WebAnon24787 (WebAnon24787@AN-p53.t55.1gsc09.IP ) (Ping timeout: 121 seconds )
 10[02:56] * Joins: D-Mist (gdsa@AN-u0e.fje.jsqf2k.IP)
[02:56]  Attacking malaysia.gov.my won't work
 10[02:56] * Joins: weezas (weezas@AN-vmd.1me.r07okb.IP)
 10[02:56] * Joins: Alice (Mibbit@AN-k1v.3uq.krpp7c.IP)
[02:56]  yea haizz
[02:56]  http://www.skmm.gov.my/ 
[02:56]  hehe
[02:56] <@bishop> NO .edu, NO media
[02:56]  siorry
[02:56] <%Effexor> Title: MCMC | SKMM (at www.skmm.gov.my)
[02:56] <@bishop> NO .edu, NO media
[02:56]  Anon_Tim: y not?
[02:56]  attacking .gov.my nameserver ?
[02:56] <@bishop> NO .edu, NO media
#----- REMOVED -----#
[03:04] <&Cake> READ IT
[03:04]  :(
[03:04]  VPN ppl, VPN!
[03:04] <~Nessuno> DISCUSS TARGETS
[03:04] <&Cake> stick to topic
 10[03:04] * Joins: mib_zo1ks8 (Mibbit@AN-0vm.b5v.skvune.IP)
[03:04]  aim: freedom of speech..stay focus
[03:04] <@bishop> targets go here: http://piratenpad.de/hecz4sSj74
[03:04] <%Effexor> Title: PiratenPad: hecz4sSj74 (at piratenpad.de)
[03:04]  Else, we'll see Msians going to jail tomorrow
[03:04]  I thought this wasn't a LOIC operation
[03:04]  PENERANGAN.GOV.MY still up
 [03:04] <+joepie91> nessuno
[03:04] <+joepie91> pm
[03:04] <+wabbit> there should be plenty lmao
[03:04]  PENERANGAN.GOV.MY still up
#----- REMOVED -----#
 04[03:06] * Nessuno sets mode: +m
[03:06] <%Effexor> Title: Toll Equipment Monitoring System - TEMS (at 211.25.171.89)
[03:06] <%Effexor> Title: CyberSecurity Malaysia (at www.cybersecurity.my)
 10[03:06] * Joins: mr_hollow (Mibbit@AN-91l.ksd.ga0n5v.IP)
[03:06] <&Cake> tgkje, you attacking by yourself? GL kid
 02[03:06] * Quits: mib_s9msk8 (Mibbit@AN-8de.vsa.mpq0id.IP ) (Quit: http://www.mibbit.com ajax IRC Client )
 10[03:06] * Joins: Dark_Night (FuckYeah@Opitaly.it)
[03:06] <~Nessuno> WE NEED TO DISCUSS A CLEAR PLAN OF ACTION.  WE ARE NOT JUST ALL ABOUT DDOS
[03:06] <~Nessuno> WE NEED TO DISCUSS A CLEAR PLAN OF ACTION.  WE ARE NOT JUST ALL ABOUT DDOS
[03:06] <~Nessuno> WE NEED TO DISCUSS A CLEAR PLAN OF ACTION.  WE ARE NOT JUST ALL ABOUT DDOS
 04[03:06] * Nessuno sets mode: -m
[03:06]  :o
[03:06] <~Nessuno> got it?
[03:06] <+wabbit> yea
[03:06]  spam it? :D
[03:06]  Roger that
#----- REMOVED -----#
[03:09] <+joepie91> ok
[03:09] <+joepie91> guys
[03:09] <+joepie91> listen up
[03:09] <+joepie91> we need your help to think of methods
[03:09] <+joepie91> to make this operation work
[03:10] <+joepie91> and LOIC is NOT an option
 10[03:10] * Joins: brn (thc@AN-nmt.k7o.gccsid.IP)
 10[03:10] * Joins: Pepper-D (Mibbit@AN-282.c78.832d04.IP)
[03:10] <+joepie91> you can discuss here: http://piratenpad.de/hecz4sSj74 but please leave the pad when you are not working on it
[03:10] <@bishop> guys, cool down: http://30.media.tumblr.com/tumblr_lle2cfkzTF1qa8vdgo1_400.png
[03:10] <%Effexor> Title: PiratenPad: hecz4sSj74 (at piratenpad.de)
[03:10] <+joepie91> because there is a user limit
 10[03:10] * Joins: w3eedy (w33dy@AN-re0.3iv.o5kn42.IP)
 10[03:10] * Joins: omny (no@AN-3v4.a8g.s7l9t5.IP)
 02[03:10] * Quits: brn (thc@AN-nmt.k7o.gccsid.IP ) (Quit:  1Full Throttle: made in Brazil  )
 02[03:10] * Quits: JamesDoe (James@Chasing.your.tail ) (Quit: Leaving )
[03:10] <+joepie91> so, basically
[03:10] <+joepie91> do your best on finding ways to make this op a sucess
 02[03:10] * Quits: ImSeeker32 (WebAnon19930@AN-btg.0oo.pafme2.IP ) (Ping timeout: 121 seconds )
[03:10] <+joepie91> ways that do not involve loic
[03:10] <+joepie91> or ddos
[03:10] <+joepie91> or hacking sites
#----- REMOVED -----#
[03:13] <@OperationLol> I don't know what people meant  by Non LOIC mission.
[03:13] <@OperationLol> ?
[03:13] <@OperationLol> Like really.
[03:13] <@OperationLol> :P
[03:13]  I completely agree with you OperationLol
[03:13]  help  me plss y i cant open loic??
[03:13]  bypass blocked using hotspot shield. protect your i.p first. thanks.
[03:13]  If they want to discuss about it, they can just go to the forums, or facebook
[03:13] <@OperationLol> Yes,
 10[03:13] * Joins: opmalaysia881 (opmalaysia881@AN-1cu.9hb.nkkgq7.IP)
 02[03:14] * Quits: xUmaRix (rosmah@jolok.najibrazak.arse.mu ) (Ping timeout: 121 seconds )
[03:14] <~Nessuno> OperationLol LOIC will acheive fuck all
[03:14] <@OperationLol> Now heres the place were action takes place.
[03:14] <@OperationLol> Tell em to get a VPN
[03:14] <%Anon_Tim> Operation
[03:14]  http://www.1malaysia.com.my/test.php
[03:14]  how to get VPN?
[03:14] <%Effexor> Title: Untitled Document (at www.1malaysia.com.my)
[03:14] <@esc> Loic will achieve nothing. You can down their sites and thats all. Afterwards you'll still have the same problems.
[03:14]   :)
[03:14] <%Anon_Tim> This was meant to be a LOIC operation
[03:14] <%Anon_Tim> Attacking certain IPs
[03:14]  That's what hacktivism is about
[03:14]  lol ded1
[03:14]  they start already?
[03:14]  kecoh siy0t
[03:14]  what problem esc?
[03:14]  hah hacktivists
[03:15] <%Anon_Tim> We were going to release the IPs one by one
 02[03:15] * Quits: wtvengeance (wtvengeance@what.the.vengeance ) (Connection closed )
 02[03:15] * Quits: lilybet (Mibbit@AN-pjo.df0.ikj289.IP ) (Quit: http://www.mibbit.com ajax IRC Client )
[03:15] <%Anon_Tim> All of us attacking it at the same time 'till they're all down
[03:15] <+joepie91> LOIC will do absolutely fucking NOTHING
[03:15] <%Anon_Tim> We attack them, the whole server's down
#----- REMOVED -----#
[03:19] <@OperationLol> Sure pal
* Joins: elChe (elChe@FreedomOrNothing.nsa.gov) <--- Nice try
[03:19] <@esc> USA based VPNs are required to log by law.
#----- REMOVED -----#
[04:17] <&esc> press requests/interviews should be handled in #reporter
[04:17] <@joepie91> oh, it redirects you there?
[04:17]  So I woke up for nothing?
[04:17]  getting mariried to godop..fyi, ded1
[04:17] <&esc> press requests/interviews should be handled in #reporter
#----- REMOVED -----#
[04:24]  plan! plan!
[04:24]  some day, I believe malaysian will only allow to browse malaysian website. no more international web.
[04:24]  I am done
 02[04:24] * Quits: opc_69 (opc_69@AN-3g7.ski.9tq214.IP ) (Ping timeout: 121 seconds )
[04:24] <@joepie91> tm_press: stop the anti-propaganda, srsly
 03[04:24] * leman is now known as putra
[04:24]  komkom: najib has a twitter, go there and whining to him..
[04:24]  .
[04:24]  prabu^: lol
 10[04:24] * Joins: mib_hbsp2t (Mibbit@AN-bd4.egt.5s204u.IP)
[04:24]  yeah
[04:24] <@joepie91> I know how it is there
[04:24]  stop it
[04:24] <@joepie91> cut the bullshit
[04:24]  i dont care bout the 1.8m. the damage is done. 
 03[04:24] * agobot is now known as b0xn3t
[04:24]  better fuck the server right now
 03[04:24] * LunarEclipse is now known as Bijan
[04:24]  less talk 
[04:24]  here I come
[04:24] <@bishop> http://theos.in/windows-xp/free-fast-public-dns-server-list/  FREE DNS SERVERS
[04:24]  Damage? :O
[04:24] <%Effexor> Title: Free Fast Public DNS Servers List (at theos.in)
[04:24] <@bishop> http://theos.in/windows-xp/free-fast-public-dns-server-list/  FREE DNS SERVERS
[04:24]  u think najib will read it ?
[04:24]  fine, i'm changing my name
[04:24]  done, registered nick. 
 10[04:25] * Parts: mizy (jason.bourne@AN-689.3sh.ipasrr.IP)
 10[04:25] * Joins: mizy (jason.bourne@AN-689.3sh.ipasrr.IP)
[04:25] <@joepie91> bishop: was about to post that lol
[04:25]  he only hire other people to read
[04:25]  damage : 1.8m spent
[04:25] <@joepie91> => Service provider: Google
[04:25] <@joepie91> Google public dns server IP address:
[04:25] <@joepie91> 8.8.8.8
[04:25] <@joepie91> 8.8.4.4
[04:25] <@joepie91> => Service provider:Dnsadvantage
[04:25] <@joepie91> Dnsadvantage free dns server list:
[04:25] <@joepie91> 156.154.70.1
[04:25] <@joepie91> 156.154.71.1
[04:25] <@joepie91> => Service provider:OpenDNS
[04:25] <@joepie91> OpenDNS free dns server list / IP address:
[04:25] <@joepie91> 208.67.222.222
[04:25] <@joepie91> 208.67.220.220
[04:25] <@joepie91> => Service provider:Norton
[04:25] <@joepie91> Norton free dns server list / IP address:
[04:25] <@joepie91> 198.153.192.1
[04:25] <@joepie91> 198.153.194.1
[04:25] <@joepie91> => Service provider: GTEI DNS (now Verizon)
[04:25] <@joepie91> Public Name server IP address:
[04:25] <@joepie91> 4.2.2.1
[04:25] <@joepie91> 4.2.2.2
[04:25] <@joepie91> 4.2.2.3
[04:25] <@joepie91> 4.2.2.4
[04:25] <@joepie91> 4.2.2.5
[04:25] <@joepie91> 4.2.2.6
[04:25] <@joepie91> => Service provider: ScrubIt
[04:25] <@joepie91> Public dns server address:
[04:25] <@joepie91> 67.138.54.100
[04:25] <@joepie91> 207.225.209.66
[04:25]  gr4ci, open source is not necessarily free.. it just open source
[04:25] <@joepie91> set these IPs as your nameservers
[04:25] <@joepie91> lemme get a guide
#----- REMOVED -----#
[04:39] <%Effexor> Title: #OpMalaysia Anonymos (at pastehtml.com)
[04:39]  Ebb: I know :D 
[04:39]  gr4c1 - mind to share with us?
[04:39]  lmao! cheeky
 10[04:40] * Joins: d3ck4 (d3ck4@AN-nae.cqh.cffsad.IP)
[04:40]  what happen to cimb?
 10[04:40] * Joins: zer03 (zer03@AN-g0j.vsa.mpq0id.IP)
[04:40]  but they dont know that irc also is a place to people exchange idea
[04:40]  but dont forget. a nornal practice of a hacker is performing ddos as the last option
#----- REMOVED -----#

Cyber Threats: Operation Malaysia

F-Secure Corporation Chief Research Officer, Mikko Hypponen, tweeted about the threat at 4.42am Malaysian time.


The group, which calls itself Anonymous, said it will launch the attack at 7.30pm GMT on Wednesday (3.30am Thursday Malaysian time) and has named it “Operation Malaysia.”

The posted a mission statement to Pastebin on June 12 describing the reasoning behind their planned and upcoming attack on official Malaysian government websites. Anonymous warned, “


We fear that if you make further decisions to take away human freedom, we [will be] obligated to act fast and have no mercy.”

Anonymous revealed that target countries are selected based on input from users in those countries, however when asked whether or not there were Anonymous in Malaysia, they responded only that “[We] cannot give you that info.” It posted the threat in a graphic on this website.

Anonymous apparently comprises a vast number of hackers in various countries, who have been organised into cells that share common goals. They operate anonymously but in a co-ordinated fashion.

Reference: theepochtimes and TheStar Online

IT Spending Decisions Over The Next 12-18 months

ESG research indicates that, in 2011, the top two business initiatives that will have the greatest impact on IT spending are cost reduction and business process improvements. Close behind, in the top four is improving business intelligence and delivery of real-time analytics.


Real-time analytics is considered both an operational must-have and a strategic competitive advantage. With such increasing priority, the much-coveted data scientist needs access to a platform that supports data mining and complex analytics to scale; is agile in supporting evolving data types; can ingest massive volumes of new data sets quickly or recover just as quickly should the data load fail; and can present a prototyping environment to test models without breaking the bank. This last requirement is so crucial because, while budgets are growing modestly, IT is still required to do more with less. Once these models have been tested, they must be operationalized so that the business can benefit on a day to day basis. Shifting to a more real-time operational business model means analytics platforms with more advanced data management features as they become systems of record.


Source: ESG

IT Architect Jokes

Recently, I attended Cloud Computing Conference at Singapore. One interest me is the IASA presentation which I considered as a brilliant jokes. We may not realized this but I think it is a reality.

• Anyone who has more than 10 years of IT project implementation experience
• Has performed various IT roles such as developers, system analyst, project manager, network/server engineer, PMO, CTO, etc
• Failed in couple of large IT projects and burned millions of dollars without being put to jail

Stop Killing Innovation

I read an interesting post from RICHARD BEJTLICH that talked about "Innovation". I decided to share his post here, enjoy reading.

I hear and read a lot about how IT is supposed to innovate to enable "the business." Anytime I see "IT" in one part of a sentence and "the business" in another, a little part of me dies. Somewhere there is a Nirvana where "thought leaders" understand that there is no business without IT, that IT is as part of the business as the sales person or factory worker or janitor, and that IT would be better off not constantly justifying its existence to "the business." But I digress.


I want to address the "innovation" issue in this post. CIO magazine recently published an interview with Vinnie Mirchandani titled Taking Business Risks With Your IT Budget. I liked what Mr Mirchandani had to say, although I'm going to omit his multiple references to "cloud." Instead, consider how he sees innovation in IT:


More [CIOs] want to be [innovators], but organizations don’t let them...


In the 1980s, we talked about IT as a competitive advantage... In the 1990s, we didn’t hear much of that at all, and IT started reporting to CFOs. In the early 2000s, the CFO made IT a compliance function for auditing and security.


We’ve beaten the innovation out of CIOs at many companies. We want them to be risk mitigators, not innovators. People are afraid to be associated with any failure. They buy IT from vendors that are safe choices. They know they’re overspending, yet they do it anyway...


Mr Mirchandani doesn't say this, but he could have also mentioned that many managers expect CIOs to be "productivity engines," meaning they inherently shrink their budget every year. This drives cost reduction as the primary goal for an IT shop -- not innovation. It's like expecting the business development team to concentrate on decreasing the amount of money spent per new customer acquired, while not caring so much on the quantity or quality of the new customers -- if any!


So what to do?


The best thing they could do is get out from under the CFO. Go to your CEO and say, “I want to report to you.” Make sure the CFO doesn’t stand in the way. Some CIOs will get fired for doing that. Others will get a chance...


Cost pressure isn't limited to those who only report to the CFO, but he doesn't address that issue.


The shocking thing about corporate IT is that without realizing it, 85 percent to 90 percent of the IT spend is with a vendor, including outsourcers and the staff you buy from them...


When you’re spending 90 percent of your money with a vendor, you have only a sliver left for [internal] talent — yet it’s with your own internal talent that you can innovate. There’s very little left for CIOs to innovate with.


The more progressive CIOs are saying they’ve overdone it with outsourcing and are starting to hire their own enterprise architects and business analysts and other strategic resources.


To me this is the crux of the issue. Businesses cannot outsource innovation. Businesses can crush innovation pretty easily though.


I found one comment he made about the cloud to be very interesting:


CIOs resist it. It’s not secure, they say. It’s not always available. CIOs say cloud vendors go down too often.


I know CIOs who haven’t run a full disaster-recovery drill for years and turn around and say that the cloud isn’t production-ready.


So, my message to readers is this: if cost-out, five nines uptime, outsourced workforces, and other failed strategies are your goal, forget innovation. If you want innovation to thrive, try considering the alternatives.


Source: Richard Blog
Reference: CIO - Taking Business Risk with Your IT Budget

SECURITY METRICS - Attack Surface Metrics

Operational security metrics are the metrics we are most familiar with in our lives. When we measure the height, width, or length of an object we are using an operational metric. When we write the date, have a birthday, or ask the score of a game we are using operational metrics. An operational metric is a constant measurement that informs us of a factual count in relation to the physical world we live in.

They are operational because they are numbers we can work with consistently from day to day and person to person. It is difficult to work with relative or inconsistent measurements like choosing a specific hue of yellow to paint a room, starting work at sunrise, having the right flavor of strawberry for a milkshake, or preparing for the next threat to affect your organization’s profits because the factors have many variables which are biased or frequently changing between people, regions, customs, and locations.

For this reason, many professions attempt to standardize such things like flavors, colors, and work hours. This is done through reductionism, a process of finding the elements of such things and building them up from there by quantifying those elements. This way, colors become frequencies, work hours become hours and minutes, flavors become chemical compounds, and an attack surface becomes porosity, controls, and limitations. So we can now quantify the attack surface as "ravs".

Details at ISECOM

PHP Security Course

PHP Security Course – Advanced PHP Auditing at Source and Bytecode level

Two weeks after the Month of PHP Security closes Stefan Esser will teach an advanced PHP security course at the SyScan Singapore security conference.

The course will cover advanced methods and techniques for PHP applications audits at source code and at bytecode level. The students will get to know the most common PHP security problems and how to find them at source code and bytecode level. Throughout the course several free and open source software tools will be introduced and used in order to visualize application structure, find security problems with static and dynamic analysis on source code and bytecode level and also to break PHP bytecode encryption.

THC and The Nokia Rom Images

THC and The Nokia Rom Images - 2006-09-06

In mid july Nokia charged THC with copyright infringement and threatened with a lawsuit. THC took down thc.org to prevent further cost and a legal disaster.

A month earlier THC discovered significant security flaws in Nokia's Operating System. To proof it THC published ROM images of 3 phones. THC did not publish the source code or tools but one thing became apparent: To extract the ROM images core security features had to be breached. THC's ability to load kernel modules and gain access to the core of the OS (including the GSM stack) was something Nokia did not like.

At the time of the release THC was not aware of any copyright protected material inside the roms. The question has to be asked if Nokia chosed the right method by threatening THC with a lawsuit or if an email could have achieved the same. Was their concern really copyright infringement? The software in the rom-images could not be used, not be ported and not be run on any other mobile phone. In addition all software is already available on every phone. Phones that are given away by the mobile operators for 1 Euro or sometimes even for free. So if everyone has access to the software anyway what is the point in threatening THC? What was their real intend? We might never find out. But what we know is that they managed to silence THC for a month.

If this is professional practice? We do not know. It is certainly the practice that Nokia chose. We also know that no attempt was made by Nokia to inquire about the security vulnerability. We also know that Nokia did not provide any updates for their customers.

Making sure that the hardware we purchase is secure is not a crime. In fact taking a look at what we buy should be our duty. We should not trust big corporates who claim in TV advertisements how secure and safe our data is. We have to test it and proof them wrong whenever we can.

In fact researchers should demand that manufactures like Nokia must provide full documentation of their hardware. The buyer becomes the owner of the mobile phone and thus has the right to know how to program the hardware. Nokia does not provide any of such information. Free software or a different operating system can not be used because of limited access to documentation. This is a classic example of a hardware giant allowing only his own software to be used. This is what some people would consider a Monopoly and an abuse of power.

THC is deeply concerned that Nokia did not choose the diplomatic route.

Source: http://freeworld.thc.org/thc-rom/

Operation Aurora

Operation Aurora is a cyber attack which began in mid-2009 and continued through December 2009.^[1] The attack was first publicly disclosed by Google on January 12, 2010, in a blog post.^[2] In the blog post, Google said the attack originated in China.

The attack has been aimed at dozens of other organizations, of which Adobe Systems,^[3] Juniper Networks^[4] and Rackspace^[5] have publicly confirmed that they were targeted. According to media reports, Yahoo, Symantec, Northrop Grumman and Dow Chemical^[6] were also among the targets.

As a result of the attack, Google stated in its blog that it plans to operate a completely uncensored version of its search engine in China "within the law, if at all", and acknowledged that if this is not possible it may leave China and close its Chinese offices.^[2] Official Chinese media responded stating that the incident is part of a U.S. government conspiracy.^[7]

The attack was named "Operation Aurora" by Dmitri Alperovitch, Vice President of Threat Research at cyber security company McAfee. Research by McAfee Labs discovered that “Aurora” was part of the file path on the attacker’s machine that was included in two of the malware binaries McAfee said were associated with the attack. "We believe the name was the internal name the attacker(s) gave to this operation," McAfee Chief Technology Officer George Kurtz said in a blog post.^[8]

According to McAfee, the primary goal of the attack was to gain access to and potentially modify source code repositories at these high tech, security and defense contractor companies. “[The SCMs] were wide open,” says Dmitri Alperovitch, McAfee’s vice president for threat research. “No one ever thought about securing them, yet these were the crown jewels of most of these companies in many ways — much more valuable than any financial or personally identifiable data that they may have and spend so much time and effort protecting."^[9]

Source: Wikipedia