Pierluigi Paganini
December 30, 2016
You are a popular talented hacker that has already participated in several hacking campaigns, could you tell me more about.
Well, unlike most hackers out there, I do not publicly participate in campaigns or operations under this current alias. When I usually do my work, I attach no alias to the attack, so it’s very difficult to find the root cause or person. The reason for this is for of course my security, but it also proves a point that it isn’t about fame or notoriety, but it’s more about the hack itself. I don’t wish to publicly discuss any big operations I have done, but I am willing to share one “campaign” (as you call it) publicly. Earlier in 2016, The University of Southern California (https://www.usc.edu/ ) had a major flaw in its website. I identified this flaw as the Tiki Wiki CMS Calendar 14.2 Remote Code Execution (EDB-ID: 39965) vulnerability, found here on exploit-db: https://www.exploit-db.com/exploits/39965/ . They had a directory called “Old” in their public_html on their main website, in which they stored the old, vulnerable version of the Calendar application. Due to this, I was able to exploit the RCE vulnerability in the calendar & gain a shell onto their website. I tried contacting the University through their website, in which after a week there was no reply. So I decided to publicly to put the shell on their website for sale, in which it was sold for an amount I do not wish to disclose. I am publicly willing to mention this particular attack since I personally did no damage to their website, and I do not know the current condition of the shell I put on their. I have since checked the vulnerable calendar application & it looks like https://www.usc.edu/ deleted the Old directory with the vulnerability, so I think it’s safe to say it is now patched. But an important lesson was learned for many reading, DO NOT put old applications in a public directory on your website if you are not using them.
Could you tell me which his your technical background and when you started hacking? Which are your motivations?
Like most hackers out there, I started at a young age with just a fascination of computers. Before I did any “hacking” you could say, at the age of 12 I was into video editing & special effects. Me being interested in this lead me to want to learn more about computers, and how they worked. After Effects CS5 is a video-editing program from Adobe, and I always wanted to use it so make my skills a lot better in video editing. However, the hefty price tag prevented me. I then started looking into ways on how I could get the program for free & a couple virus’ later, I managed to successfully crack the program. The amount of joy & excitement I got from being able to successfully break something in which a whole team of adults tried to prevent from happening, was an amazing feeling. I always believed this first instance, led me to where I able to day and motivated me to keep “hacking” or “breaking stuff” for the fun of it.
What was your greatest hacking challenge? Which was your latest hack? Can you describe me it
The greatest hacking challenge I faced, was an attack against a really secure target. When I was doing some information gathering on them, I noticed the amount of detailed they went through to prevent any attacks. This was from closing majority of the ports of their servers to purchasing an enterprise grade WAF (Web Application Firewall) to protect their site. As a hacker, it is, of course, more challenging than if the server didn’t have this. However, you must of course as a hacker, always have the mindset that you only have to find one flaw in their system to get in, and they have to try and patch all of them. So off I went against this target. I would say this target took to the longest & was my one of my most unsuccessful attacks I’ve ever done. It took around 8 days just to figure out how to make sure the WAF did not interfere with my attacks & after I figured this out by some work another hacker did previously which was public, I managed to use a dictionary attack against local FTP user. I never expect dictionary attacks to work ever, but I run them in the background since my computer is online 24/7 anyways. It turns out they trusted so much in their WAF, they forgot to choose a unique password for one of their local users, and I gained access to an FTP directory. However, this directory was only a home directory for the user (a directory only for storing personal files & programs for a particular user) & no damage or real exploit was present in what I’d found so far. I soon moved onto another target after this, but I will always remember this particular attack as the most challenging. As for my latest hack, I do not wish to disclose that sadly.
What are the 4 tools that cannot be missed in the hacker’s arsenal and why? Which are the most interesting hacking communities on the web today, why?
All physical tools in a hacker’s arsenal can be different, and all have their different levels of effectiveness. When mentioning must have tools in this kind of field, I never mention physical tools, as these can often become outdated or not useful anymore. However, the tools that will always work for a hacker, are tools such as curiosity. Curiosity is one of the biggest tools you can have & hackers who have this don’t give up if something fails, they push on & on. This is what separates most hackers. Other mental tools such as an ethical compass, I always suggest to newcomers to really focus on. Although I may do some legally questionable things, I think morally & ethically I am fairly nice. With the Attack against USC, I gave them time to contact me back about a vulnerability they had, and when they didn’t, I myself didn’t do damage but sold it away to someone who hopefully had some ethical compass to himself also. A hacker must have to focus & always use these (what I like to call) “mental tools” in every stage of an attack. Without it, most of the “hacker’s mindset” is gone. These concepts are very helpful in teaching to new people also coming into this particular work. As for the most interesting hacking communities on the web today, I think the most interesting is, of course, the “twitter scene” as most like to call it. The “twitter scene” is basically a community comprising mostly of underage hackers, who either have a very limited knowledge & skills, or none at all. Although there are a lot of exceptions and a lot of people are very talented, you will often find people in this scene on a day to day basis making fun (or “clowning” as they like to put it) on each one another.
Did you participate in hacking attacks against the IS propaganda online? When? How? Where do you find IS people to hack? How do you choose your targets?
Back in late 2015 when the “War against ISIS” sort of came to light on the internet, a lot of people were on board and did target a lot of ISIS members online. Often taking down chat rooms & getting ISIS twitter accounts suspended. Originally at this time, I participated in simply suspending twitter accounts & overseeing a lot of website attacks. However, after a month or so, this operation died out & led to my permanent leave of helping with online “Operations” by hacking groups such as Anonymous. After I left, I focused more on learning & doing solo attacks under different alias’.
We often hear about cyber weapons and cyber attacks against critical infrastructure. Do you believe it is real the risk of a major and lethal cyber attack against a critical infrastructure?
Yes. Cyber weapons & cyber attacks are happening more frequently as time passes by. We are now seeing governments and large militaries focus on these types of attacks nowadays to gain advantages & information. Some even Speculate that the Stuxnet Virus was created by Israel & the US in a partnership, to target Iran’s nuclear facilitates. This was a huge attack which affected many machines, & was quite dangerous. This type of attack set a clear precedent for future cyber attacks. The best thing we can do is make this issue aware to the public, and touching up all of our security to prevent attacks like this from happening. But as a security enthusiast myself, I know there’s is most likely always a flaw present. People often don’t understand the amount of damage a cyber attack against a power grid, or in Stuxnet case, a nuclear facility, could actually do to affect infrastructure. Because no major attack has happened against a huge first world country like the US, nobody is aware of the potential dangers. I hope someday the public isn’t fully aware of these dangers from a cyber attack, but from the governments announcing it’s existence & it’s potential risks.
[adrotate banner=”9″]
(Security Affairs – Hacker, @Firox_ )
[adrotate banner=”13″]
APT / November 18, 2024
