Researchers: There's Gold in Them Thar Hacks

LAS VEGAS – Black Hat 2008 – Wondering how you can make a few bucks -- or a few hundred thousand -- hacking the Web? Researchers from WhiteHat Security yesterday offered up a few ideas.

In a session entitled, "Get Rich or Die Tryin' -- Making Money on the Web, the Black Hat Way," WhiteHat CTO and founder Jeremiah Grossman and Trey Ford, director of software solutions at the research firm, gave some entertaining examples of simple ways to hack the Web -- and make money at it. (See Hacking Without Exploits.)

"We're hoping this session will be fun -- and maybe make some of you question your ethics," quipped Grossman.

The researchers started out by describing a simple script that allows the attacker to manipulate the results of online polls conducted by local newspapers and community groups. Grossman showed how renowned researcher Robert Hansen (a.k.a. RSnake) used this method to help a chihuahua win a no-prize "best dog" contest in a local newspaper -- and was subsequently pwned by another attacker who hacked the same contest on behalf of a different dog.

Ford demonstrated a method whereby an attacker can create "artificial scarcity" of tickets or other assets online, essentially creating a denial-of-service attack that denies all but the attacker access to the desired seats or tickets. "This is a method that is worth something to scalpers who want to drive the prices of their tickets up," he said.

Grossman described ways in which attackers can simply and quickly solve the CAPTCHAs that are used to ensure that a user's response is not generated by a computer. In a dynamic, underground economy, he showed how attackers can buy resolved CAPTCHAs at a price as low as $2 per 1,000.

But simple hacks can also be used to generate a lot more than a couple of dollars, the researchers said. Ford described how one hacker wrote a script that automated the purchase of items using e-coupons to the tune of $50,000, then had them mailed to a non-existent address, where they were intercepted by a conspiring mail carrier.

Grossman recalled the recent case in which a 22-year-old man set up some 58,000 brokerage accounts using a variety of false names and addresses, in order to harvest the micro deposits made to open the accounts. (See Man Arraigned for Setting Up 58,000 Brokerage Accounts.)

He also outlined several attacks against banks, including methods of spoofing the bank's application service provider and some simple ways to fool an online banking system by using negative numbers during a funds transfer.

Ford recounted a recent case at the QVC shopping channel, in which a woman discovered that if she started an order, and then canceled at the right moment during the transaction, she could receive items without being billed for them. "She then did the capitalistic thing: She sold them all on eBay and profited about $412,000."

The two researchers also described methods for scamming "affiliate networks," which pay computer users for posting online ads or links on their home pages or blogs. One attacker made more than $900,000 in two months using well known cookie-stuffing techniques, Grossman said.

In another case, hackers in Ukraine found a method for accessing press releases on the popular Businesswire service before they were issued to the public. The hackers made more than $300,000 by placing sell orders on the stocks of the involved companies before the releases were published, Grossman stated.

All of these exploits proved viable, and some of them proved to be legal, though law enforcement often found ways to nab the victims, the researchers noted. The bottom line: Businesses should be wary of leaving these simple vulnerabilities in their systems.

"Business logic flaws outnumber the more well publicized flaws, such as cross-site scripting and SQL injection -- you just don't hear about them as often," Grossman stated. "The key is to test often, and test everywhere. Not all vulnerabilities can be identified in the design phase, by analyzing code, or even during the [quality assurance] process. You need to do some profiling to look for these kinds of flaws."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.