Goatse Security ( GoatSec ) is a group of nine-person gray hat hackers who specialize in exposing security flaws. This is a division of the Internet anti-blogging trolling organization known as the American Gay Gay Associations (GNAA). The group got its name from the Goatse.cx shock site, and he chose "Gaping Holes Exposed" as his slogan.
In June 2010, Goatse Security acquired an email address of approximately 114,000 Apple iPad users. This led to the FBI investigation and the filing of criminal charges against two members of the group.
Video Goatse Security
Pendirian
GNAA has several security researchers in its membership. According to Goatse Security spokesman Leon Kaiser, GNAA can not fully exploit their talents because the group believes that no one will take security data published by GNAA seriously. In order to create a medium where GNAA members can publish their security findings, GNAA created Security Goatse in December 2009.
Maps Goatse Security
Browser vulnerability discovery
To protect its web browser from inter-protocol exploits, Mozilla blocks some ports that are not normally accessible by HTML forms. In January 2010, GNAA found that the Mozilla block did not include port 6667, which caused the Mozilla browser to be vulnerable to cross-protocol scripts. GNAA makes JavaScript-based exploits to overwhelm IRC channels. Although EFnet and OFTC were able to block attacks, Freenode struggled to counter attacks. Goatse Security exposes vulnerability, and one of its members, Andrew Auernheimer, aka "weev," posts information about the exploit on the Encyclopedia Dramatica.
In March 2010, Goatse Security discovered an integer overflow vulnerability in Apple's web browser, Safari, and posted an exploit on the Encyclopedia Dramatica. They found that one can access the blocked port by adding 65536 to the port number. This vulnerability is also found in Arora, iCab, OmniWeb, and Stainless. While Apple fixed the error for Safari's desktop version in March, the company let the error stay on the mobile version of the browser. Goatse Security claims that a hacker can exploit a mobile Safari loophole to gain access and cause damage to Apple iPad.
Email address leakage AT & amp; T/iPad
In June 2010, Goatse Security found vulnerabilities in the AT & amp; T. AT & T was the only 3G service provider for Apple iPad in the United States at the time. When signing up for AT & amp; T from iPad, AT & amp; T takes the ICC-ID from the iPad SIM card and associates it with the email address provided when registering. To make it easy to log in from iPad, AT & amp; receive ICC-ID SIM card and fill in email address address with the given address when registering. Goatse Security realizes that by sending an HTTP request with a valid ICC-ID embedded in it to the AT & amp; website, the website will disclose the email address associated with the ICC-ID.
On June 5, 2010, Daniel Spitler, aka "JacksonBrown", began discussing this vulnerability and possible ways to use it, including phishing, on IRC channels. Goatse Security builds a PHP-based brute force script that will send HTTP requests with random ICC-IDs to AT & amp; T until the valid ID-ICC is entered, which will return an ICC-ID-compliant email address. This script is dubbed as "iPad 3G Slurper Account."
Goatse Security then attempted to find an appropriate source of news to disclose the leaked information by weev trying to contact News Corporation and Thomson Reuters executives, including Arthur Siskind, on AT & T's security issues. On June 6, 2010, weev sent an email with several ID- ICC is restored to verify its claim. The chat log of this period also reveals that attention and publicity may be an incentive for the group.
Contrary to what was first claimed, the group initially revealed a security hole for Gawker Media before notifying AT & T and also exposing data to 114,000 iPad users, including celebrities, government and military. This tactic again provoked a significant debate about the proper disclosure of IT security flaws.
weev has stated that Goatse Security uses common industry standard practices and says that, "We try to be good people". Jennifer Granick of the Electronic Frontier Foundation also defended the tactics used by Goatse Security.
On June 14, 2010, Michael Arrington from TechCrunch awarded Crunchie awards to the group for public service. This is the first time Crunchie has been awarded outside the annual Crunchies awards ceremony.
The FBI then opened an investigation into the incident, leading to a criminal complaint in January 2011 and an attack on Andrew "weev" Auernheimer's home. The search was related to AT & amp; T and Auernheimer were then detained and released on bail on state drug charges, then dropped. After being released on bail, he violated a silencing order to protest and deny the legality of his house search and denial of access to public defenders. He also requested donations through PayPal, to finance legal fees. In 2011, the Justice Department announced that it would be charged with one count of conspiracy to access the computer without authorization and one count of fraud. A joint defendant, Daniel Spitler, was released on bail.
On November 20, 2012, Auernheimer was found guilty of one count of identity fraud and one count of conspiracy to access the computer without authorization, and tweeted that he would appeal the verdict. Alex Pilosov, a friend who was also present for power, tweeted that Auernheimer would remain free on bail until punishment, "which will be at least 90 days."
On November 29, 2012, Auernheimer wrote an article in Wired Magazine entitled "Forgot Disclosure - Hackers Must Keep Your Own Security Hole," advocating exposing zero-day exploits only to individuals who would "use it for the benefit of social justice."
On April 11, 2014, the Third Circuit issued an opinion on emptying Auernheimer's conviction, on the grounds that a place in New Jersey is not appropriate. The judges did not answer substantive questions about the legality of site access. He was released from prison on April 11.
Other achievements
In May 2011, the DoS vulnerability affecting some Linux distributions was disclosed by Goatse Security, after the group found that long URLs of Advanced Packaging Tools would cause compiz crashes.
In September 2012, Goatse Security is credited by Microsoft to help secure their online services.
References
External links
- Official website
Source of the article : Wikipedia
0 Comments