Goatse Security

Goatse Security

Goatse Security logo
Also known as GoatSec[1][2]
Years active 2009[3]—ongoing
Category Hacking
Member(s) weev[4][5]
Sam Hocevar[4][6][7]
Daniel Spitler[4][8]
Leon Kaiser[2][4]
Product(s) Clench[9][10]
Affiliated Group(s) Gay Nigger Association of America (GNAA)[2][5]
Website(s) http://security.goatse.fr/
Computer security portal
Internet portal

Goatse Security (GoatSec) is a loose-knit, nine-person[11] grey hat hacker group[12] that specializes in uncovering security flaws.[3][13] It is a division of the anti-blogging Internet trolling organization known as the Gay Nigger Association of America (GNAA).[2] The group derives its name from the Goatse.cx shock site,[5] and it chose "Gaping Holes Exposed" as its slogan.[14] In June 2010, Goatse Security obtained the Email addresses of approximately 114,000 Apple iPad users. This led to an FBI investigation and the filing of criminal charges against two of the group's members.

Contents

Founding

The GNAA had several security researchers within its membership. According to Goatse Security spokesperson Leon Kaiser, the GNAA could not fully utilize their talents since the group believed that there would not be anyone who would take security data published by the GNAA seriously. In order to create a medium through which GNAA members can publish their security findings, the GNAA created Goatse Security in December 2009.[2][3]

Browser vulnerabilities

In order to protect its web browser from inter-protocol exploitation, Mozilla blocked several ports that HTML forms would not normally have access to. In January 2010, the GNAA discovered that Mozilla's blocks did not cover port 6667, which left Mozilla browsers vulnerable to cross-protocol scripts. The GNAA crafted a JavaScript-based exploit in order to flood IRC channels. Although EFnet and OFTC were able to block the attacks, Freenode struggled to counteract the attacks. Goatse Security exposed the vulnerability, and one of its members, Andrew Auernheimer, aka "weev," posted information about the exploit on Encyclopedia Dramatica.[15][16][17]

In March 2010, Goatse Security discovered an integer overflow vulnerability within the Apple Safari and posted an exploit on Encyclopedia Dramatica.[18] They found out that a person could access a blocked port by adding 65,536 to the port number.[19][20] This vulnerability was also found in Arora,[21] iCab,[22] OmniWeb,[23] and Stainless.[24] Although Apple fixed the glitch for desktop versions of Safari in March, the company left the glitch unfixed in mobile versions of the browser.[18][25] Goatse Security claimed that a hacker could exploit the mobile Safari flaw in order to gain access and cause harm to the Apple iPad.[18][25]

AT&T/iPad e-mail address leak

In June 2010, Goatse Security uncovered a vulnerability within the AT&T website.[26][27] AT&T was the only provider of 3G service for Apple's iPad in the United States.[28] When signing up for AT&T's 3G service from an iPad, AT&T retrieves the ICC-ID from the iPad's SIM card and associates it with the Email address provided during sign-up.[26][29] In order to ease the log-in process from the iPad, the AT&T website receives the SIM card's ICC-ID and pre-populates the Email address field with the address provided during sign-up.[26][29] Goatse Security realized that by sending a HTTP request with a valid ICC-ID embedded inside it to the AT&T website, the website would reveal the Email address associated with that ICC-ID.[26][29]

On June 5, 2010, Daniel Spitler, aka "JacksonBrown", began discussing this vulnerability and possible ways to exploit it, including phishing, on an IRC channel.[8][30][31] Goatse Security constructed a PHP-based brute force script that would send HTTP requests with random ICC-IDs to the AT&T website until a legitimate ICC-ID is entered, which would return the Email address corresponding to the ICC-ID.[26][29] This script was dubbed the "iPad 3G Account Slurper."[31]

Goatse Security then attempted to find an appropriate news source to confine the leaked information with. weev attempted to contact News Corporation and Thomson Reuters executives, including Arthur Siskind, about AT&T's security problems.[32] On June 6, 2010, weev sent Emails with some of the ICC-IDs recovered in order to verify his claims.[30][32] Chat logs from this period also reveal that attention and publicity may have been incentives for the group.[33]

The tactics used by members of Goatse Security caused a significant debate regarding the proper disclosure of IT security flaws.[34] weev has maintained that Goatse Security used common industry standard practices and has said that, "We tried to be the good guys".[34][35] Jennifer Granick of the Electronic Frontier Foundation has also defended the tactics used by Goatse Security.[34]

On June 14, 2010 Michael Arrington of TechCrunch awarded the group a Crunchie award for public service. This was the first time a Crunchie was awarded outside the annual Crunchies award ceremony.[36][37]

The FBI then opened an investigation into the incident,[38] leading to a criminal complaint in January 2011[39] and a raid on Andrew Auernheimer's house. The search was related to the AT&T investigation and Auernheimer was subsequently detained and released on bail[40] on state drug charges,[41] later dropped.[42] After his release on bail, he broke a gag order to protest and to dispute the legality of the search of his house and denial of access to a public defender. He also asked for donations via PayPal, to defray legal costs.[12][43] In 2011 the Department of Justice announced that he will be charged with one count of conspiracy to access a computer without authorization and one count of fraud.[42] A co-defendant, Daniel Spitler, was released on bail.[44][45] As of May, 2011 he remains released on bail.

References

  1. ^ Tate, Ryan (2010-06-09). "AT&T Fights Spreading iPad Fear". Valleywag. Gawker Media. http://valleywag.gawker.com/5559725/att-fights-spreading-ipad-fear. Retrieved 2010-10-17. 
  2. ^ a b c d e Kaiser, Leon (2011-01-19) (Transcript). Interview: Goatse Security on FBI Charges Following AT&T iPad Breach. Interview with Mick Jason. DailyTech. http://www.dailytech.com/Interview+Goatse+Security+on+FBI+Charges+Following+ATT+iPad+Breach/article20693.htm. Retrieved 2011-01-21. 
  3. ^ a b c Dowell, Andrew (2010-06-17). "Programmer Detained After FBI Search". The Wall Street Journal (Dow Jones & Company, Inc.). http://online.wsj.com/article/SB10001424052748704198004575310634055906968.html. Retrieved 2010-10-11. 
  4. ^ a b c d "Team". Goatse Security. Goatse Security. 2010-06-14. http://security.goatse.fr/members. Retrieved 2010-09-22. 
  5. ^ a b c Chokshi, Niraj (2010-06-10). "Meet One of the Hackers Who Exposed the iPad Security Leak". The Atlantic (The Atlantic Monthly Group). http://www.theatlantic.com/technology/archive/2010/06/meet-one-of-the-hackers-who-exposed-the-ipad-security-leak/57969/. Retrieved 2010-09-16. 
  6. ^ Keizer, Gregg (2010-06-17). "iPad hacker arrested on multiple drug charges after FBI search". Computerworld (Computerworld Inc.). http://www.computerworld.com/s/article/9178158/iPad_hacker_arrested_on_multiple_drug_charges_after_FBI_search. Retrieved 2010-09-16. 
  7. ^ Mick, Jason (2010-06-14). "AT&T Apologizes to iPad Customers, We Reveal Hackers' Locales". DailyTech (DailyTech LLC.). http://www.dailytech.com/ATT+Apologizes+to+iPad+Customers+We+Reveal+Hackers+Locales/article18699.htm. Retrieved 2010-09-16. 
  8. ^ a b Bilton, Nick; Wortham, Jenna (2011-01-18). "Two Are Charged With Fraud in iPad Security Breach". The New York Times (The New York Times Company). http://www.nytimes.com/2011/01/19/technology/19ipad.html. Retrieved 2011-01-21. 
  9. ^ "Clench, our way of saying "screw you" to SSL PKI forever". Goatse Security. Goatse Security. 2010-09-08. http://security.goatse.fr/clench-our-way-of-saying-screw-you-to-ssl-pki-forever. Retrieved 2010-10-29. 
  10. ^ Lawson, Nate (2010-09-08). "Clench is inferior to TLS+SRP". root labs rdist. Nate Lawson. http://rdist.root.org/2010/09/08/clench-is-inferior-to-tlssrp/. Retrieved 2010-10-29. 
  11. ^ Eunjung Cha, Ariana (2010-06-12). "Apple's iPad security breach reveals vulnerability of mobile devices". Washington Post. http://www.washingtonpost.com/wp-dyn/content/article/2010/06/11/AR2010061106239.html. Retrieved 6 April 2011. 
  12. ^ a b AT&T iPad 'hacker' breaks gag order to rant at cops The Register, John Leyden. July 7, 2010
  13. ^ Tate, Ryan (2010-06-10) (audio / transcript). Apple's iPad Breach Raises Alarms. Interview with Melissa Block. All Things Considered. National Public Radio. http://www.npr.org/templates/story/story.php?storyId=127747618. Retrieved 2010-09-16. 
  14. ^ Ragan, Steve (2010-06-10). "AT&T loses 114,000 e-mail addresses via scripting error". The Tech Herald (WOTR Limited). http://www.thetechherald.com/article.php/201023/5716/AT&T-loses-114-000-e-mail-addresses-via-scripting-error. Retrieved 2010-09-28. 
  15. ^ Constantin, Lucian (2010-01-30). "Firefox Bug Used to Harass Entire IRC Network". Softpedia (Softpedia). http://news.softpedia.com/news/Firefox-Bug-Used-to-Harass-an-Entire-IRC-Network-133613.shtml. Retrieved 2010-09-19. 
  16. ^ Goodin, Dan (2010-01-30). "Firefox-based attack wreaks havoc on IRC users". The Register (Situation Publishing). http://www.theregister.co.uk/2010/01/30/firefox_interprotocol_attack/. Retrieved 2010-09-19. 
  17. ^ Goodin, Dan (2010-06-09). "Security gaffe exposes addresses of elite iPaders". The Register (Situation Publishing). http://www.theregister.co.uk/2010/06/09/ipad_security_breach/. Retrieved 2010-09-19. 
  18. ^ a b c Keizer, Gregg (2010-06-14). "AT&T 'dishonest' about iPad attack threat, say hackers". Computerworld (Computerworld Inc.). http://www.computerworld.com/s/article/9178027/AT_T_dishonest_about_iPad_attack_threat_say_hackers. Retrieved 2010-09-18. 
  19. ^ Ragan, Steve (2010-06-14). "Goatse Security tells AT&T: ‘You f---ed up’". The Tech Herald (WOTR Limited): p. 2. http://www.thetechherald.com/article.php/201024/5734/Goatse-Security-tells-AT&T-You-f-ed-up?page=2. Retrieved 2010-10-06. 
  20. ^ "CVE-2010-1099". National Vulnerability Database. NIST. 2010-03-24. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1099. Retrieved 2010-10-06. 
  21. ^ "CVE-2010-1100". National Vulnerability Database. NIST. 2010-03-24. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1100. Retrieved 2010-10-06. 
  22. ^ "CVE-2010-1101". National Vulnerability Database. NIST. 2010-03-24. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1101. Retrieved 2010-10-06. 
  23. ^ "CVE-2010-1102". National Vulnerability Database. NIST. 2010-03-24. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1102. Retrieved 2010-10-06. 
  24. ^ "CVE-2010-1103". National Vulnerability Database. NIST. 2010-03-24. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1103. Retrieved 2010-10-06. 
  25. ^ a b Goldman, David (2010-06-14). "Hackers say iPad has more security holes". CNNMoney.com (CNN). http://money.cnn.com/2010/06/14/technology/att_ipad_hack/. Retrieved 2010-09-18. 
  26. ^ a b c d e Keizer, Gregg (2010-06-10). "'Brute force' script snatched iPad e-mail addresses". Computerworld (Computerworld Inc.). http://www.computerworld.com/s/article/9177921/_Brute_force_script_snatched_iPad_e_mail_addresses. Retrieved 2010-09-18. 
  27. ^ Tate, Ryan (2010-06-09). "Apple's Worst Security Breach: 114,000 iPad Owners Exposed". Valleywag. Gawker Media. http://valleywag.gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed. Retrieved 2010-09-16. 
  28. ^ Ante, Spencer E. (2010-06-10). "AT&T Discloses Breach of iPad Owner Data". The Wall Street Journal (Dow Jones & Company, Inc.). http://online.wsj.com/article/SB10001424052748704575304575297210807737710.html. Retrieved 2010-09-26. 
  29. ^ a b c d Buchanan, Matt (2010-06-09). "The Little Feature That Led to AT&T's iPad Security Breach". Gizmodo. Gawker Media. http://gizmodo.com/5559686/. Retrieved 2010-09-22. 
  30. ^ a b Criminal Complaint. United States District Court – District Court of New Jersey, Docket: MAG 11-4022 (CCC). Filed with the court January 13, 2011
  31. ^ a b Voreacos, David (2011-01-18). "U.S. Announces Charges for Alleged Hack Into AT&T Servers Via iPad Users". Bloomberg.com (Bloomberg L.P.). http://www.bloomberg.com/news/2011-01-18/u-s-to-announce-charges-on-alleged-hack-into-at-t-servers-via-ipad-users.html. Retrieved 2011-01-21. 
  32. ^ a b McMillan, Robert (2010-12-15). "AT&T IPad Hacker Fought for Media Attention, Documents Show". PC World (PC World Communications, Inc.). http://www.pcworld.com/businesscenter/article/213858/atandt_ipad_hacker_fought_for_media_attention_documents_show.html. Retrieved 2010-12-16. 
  33. ^ Foresman, Chris (2011-01-19). "Goatse Security trolls were after "max lols" in AT&T iPad hack". Ars Technica. http://arstechnica.com/apple/news/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack.ars. Retrieved 2011-01-22. 
  34. ^ a b c Worthen, Ben; Spencer E. Ante (June 14, 2010). "Computer Experts Face Backlash". WSJ.com. http://online.wsj.com/article/SB10001424052748703885104575303032919382858.html?mod=WSJ_hpp_sections_tech. 
  35. ^ Leydon, John (7 July 2010). "AT&T iPad 'hacker' breaks gag order to rant at cops". The Register. http://www.theregister.co.uk/2010/07/07/ipad_hack_follow_up/. Retrieved 16 February 2011. 
  36. ^ Arrington, Michael (14 June 2010). "We’re Awarding Goatse Security A Crunchie Award For Public Service". Tech Crunch. http://techcrunch.com/2010/06/14/were-awarding-goatse-security-a-crunchie-award-for-public-service/. Retrieved 31 March 2010. 
  37. ^ Patterson, Ben (14 June 2010). "AT&T apologizes for iPad breach, blames hackers". Yahoo! News. http://news.yahoo.com/s/ytech_gadg/20100614/tc_ytech_gadg/ytech_gadg_tc2564. Retrieved 31 March 2010. 
  38. ^ Tate, Ryan (June 9, 2010). "Apple's Worst Security Breach: 114,000 iPad Owners Exposed". Gawker.com (Gawker Media). http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed. Retrieved June 13, 2010. 
  39. ^ United States District Court - District Court of New Jersey, Docket: MAG 11-4022 (CCC). Filed with the court January 13, 2011
  40. ^ Perna, Gabriel (June 17, 2010). "Arrested Hacker's Web Site Reveals Extremist Views". International Business Times (International Business Times). http://www.ibtimes.com/articles/29267/20100617/goatse-hacker-blog-shows-extremist-views.htm. Retrieved July 11, 2010. 
  41. ^ Dowell, Andrew (June 17, 2010). "Programmer Detained After FBI Search". The Wall Street Journal. http://online.wsj.com/article/SB10001424052748704198004575310634055906968.html?mod=WSJ_PersonalTechnology_LEFTTop. 
  42. ^ a b "Criminal charges filed against AT&T iPad attackers - Computerworld". January 18, 2011. http://www.computerworld.com/s/article/9205403/Criminal_charges_filed_against_AT_T_iPad_attackers. 
  43. ^ weev. "Hypocrites and Pharisees". Goatse.fr. http://security.goatse.fr/hypocrites-and-pharisees. 
  44. ^ Voigt, Kurt (21 January 2011). "No bail for 2nd iPad e-mail address theft suspect". MSNBC.com. Associated Press. http://www.msnbc.msn.com/id/41196595/ns/technology_and_science-security/. Retrieved 15 February 2011. 
  45. ^ Porter, David (28 February 2011). "Suspect in iPad Data Theft Released on Bail in NJ". ABC News. Associated Press. http://abcnews.go.com/Technology/wireStory?id=13023509. Retrieved 2 March 2011. 

External links

Hacking in 2010s
Incidents
Groups/Individuals
Anonymous • Goatse Security • LulzRaft • LulzSec (Sabu • Topiary) • TeaMp0isoN • The Jester
Worms/Viruses