Comments on: Cyber Crime Toolkits Go On Sale

By: Sir Henry

Sir Henry — Fri, 14 Dec 2007 19:21:24 +0000

@fazed:

I am intrigued to know more about your predicament with the police. Do tell…

By: dre

dre — Wed, 31 Oct 2007 06:04:51 +0000

@Sandeep Army and govt agencies MUST have THE BEST security professionals and programmers who can make rootkits and what not rather than buying off a 3rd party rootkit and anti-root kit

How many armies and government agencies are there in the world? There is no way that they can hire the best, as much as they would like to or need to. Even the top 15 most powerful governments can’t afford much at all in terms of security professional talent - although they may still have advanced spy, assassin, or propaganda / mass-manipulation organizations and devices.

Nuclear Grabber and other kits, which cost anywhere from US$25 to US$3k - have been used to steal money from many European banks on several occasions. How many elite government spies are capable of doing that for a similar cost and risk equations? How many elite government security professionals are capable of doing that for the same cost and risk equation?

By: fazed

fazed — Tue, 30 Oct 2007 17:40:02 +0000

I am at the moment creating
a web application attack toolkit,
as I said in a comment on the next
post the police stole my computer so
I have lost it at the moment but have
some of it stored on this laptop.
anyways this toolkit has a web frontend
that made it very easy to use..
hope to get the computer back soon.. :S

By: Sandeep Nain

Sandeep Nain — Sun, 28 Oct 2007 04:56:22 +0000

and I reckon, govt agencies must be looking at these cybercrime toolkits but not because they wanna use it and get support as well…

but they will actually be looking at how to prevent govt. systems from the attacks which can be generated using these toolkits.

By: Sandeep Nain

Sandeep Nain — Sun, 28 Oct 2007 04:51:45 +0000

@Dre, I understood your point and what i want to communicate here is:

Sony can afford to not to have their own rootkit or not having good enough security professionals but Army and govt agencies MUST have THE BEST security professionals and programmers who can make rootkits and what not rather than buying off a 3rd party rootkit and anti-root kit.

I hope this is much clear now…

By: dre

dre — Sun, 28 Oct 2007 04:27:38 +0000

@Sandeep: nononono… Sony didn’t get owned by a rootkit… they tried to build one… you missed the whole point of my argument

By: Sandeep Nain

Sandeep Nain — Sun, 28 Oct 2007 04:20:16 +0000

Yes you are right DRE that sony is probably as large as any govt or military outfit but the security requiremenets differ… A loophole in sony’s it security may be a threat to the company itself but thats it. Can you imagine somebody getting a root access to US Army’s main servers?? its a NATIONAL THREAT.. so they can’t afford to trust a 3rd party software like rootkits to be installed on their systems. its just LAME. they probbaly think of getting anti-root kit stuff.

By: dre

dre — Sun, 28 Oct 2007 01:58:24 +0000

Well look at Sony. They are as large as many governments and military outfits - yet they failed to “roll their own” rootkit. In some cases, Sony would have been better off buying Haxdoor or equivalents at the time. So I think this does hold true for those who need offensive computing but can’t afford the expertise at varying levels. Of course, they could hire experts to modify these tools.

Who else do they turn to? ImmunitySec, CORE, and modifying Metasploit? My guess is that many intelligence agencies are also getting their hands on these cybercrime toolkits to be used in cyberwarfare. I wouldn’t say it’s a stretch to call such a tactic Science Fiction.

By: Sandeep Nain

Sandeep Nain — Fri, 26 Oct 2007 04:32:12 +0000

I believe these government and military agencies have enough funds andd resources that they can build these kits by themselves rather than buying from hackers… as i’m sure govt won’t trust these sources.. and they should not…

and definitely anti-rootkit stuff will be a revolution.

By: dre

dre — Thu, 25 Oct 2007 23:48:32 +0000

well in some cases you have governments and military who need to purchase these tools as weapons for offensive computing efforts. these are people who almost certainly need rootkits to protect themselves but also need their hands held when deploying them.

fortunately for those in the know - anti-rootkit technology has stepped up again. i saw gabe lawrence speak at the toorcon 9 seminars in san diego this past weekend. his talk mostly centered around linux rootkit technology, but he also covered Windows and virtualization rootkits. his current project, 99lb, looks very promising.