Lulzsec (Lulz Security) the group of hackers claiming responsibility for the latest (today) hack on Sony have themselves been targeted by hackers. Using a hack call DDoS (Distributed denial of service attack) the hackers have tried to force the lulzsecurity.com website down – so far to no avail.
What’s interesting about this story is the types of ‘hacks’ that are in play here. There are basically three types of hacks – one’s where people find a hole in computer security, one’s where people ‘trick’ non-vigilant users and one’s where people just try and temporarily destroy web or web app access. A DDoS falls into the third category – hackers are currently running a DDoS attack to stop users accessing the Lulz Security website.
What is a DDoS attack?
Basically it’s hundreds (sometimes thousands) of individual computers all sending requests to the Lulz Security website every single second. That volume of requests means that when a regular user tries to get to the website they can’t because all the available resources for the website is being taken up by the attackers. There is a lot of planning that goes into a DDoS attack – they hundreds of computers are all talking to each other and all talking to the target website, but in order for them to talk to each other (and be controlled remotely) a piece of software needs to live on these computers. That is the real power of this type of attack – your computer could be one of the computers involved and you would never know…
Taking lessons from Lulz Security.
Whilst hackers are trying this hack to get to the Lulz Security they aren’t succeeding, why? Lulz Security tweeted, “I’m loving how people think they can take down lulzsecurity.com – cloudflare backup pages storing 100% of our Sony releases. Nice try!”. Lulz Security are using a service called CloudFlare. This service stores another version of the website somewhere else on the internet and tracks the users who are trying to access Lulz Security. This means that while the actual website isn’t currently available a backup is and real users can still see and access of the website.
The lesson that Sony can take from this attack is that – security has to come first, there is no point having a website unless you can stand the test of hackers. The reason why there have been so many hacks on Sony is because security isn’t front of mind with them – form injection (the computer security type of hack) shouldn’t be possible on a website the size of Sony, it can’t happen on by blog so it shouldn’t happen on Sony’s website. Then after the form injection, hackers got access to the database which stored passwords in plain text, again why? How we all know how easy it is to hack Sony I imagine there will be more and more attacks until Sony get their act together, and looking at the results of the hacks they really need to get their act together quickly…
Uh… DDoS isn’t a method of hacking someone, much like murdering someone isn’t a method of robbing them.
Hacking implies entering a site or system without consent of the owner. The main type of DDoS is sending more requests than the server can cope with. Completely different
In the programming sense hacking isn’t simply entering a system it’s building something on top of/in place of an already used system i.e ‘hacking the kinect’ isn’t getting into the kinect it’s building on top of. In this sense hackers requesting against a network replicates a system in place and, I would argue, tests the validity of the network, a pillar of what hacking (actually cracking) is.