Now Anyone Can Hack A Website Thanks To Clever, Free Programs

The interface for Havij; via Imperva.com

How hard is it hack into a website and steal information? You might think only basement-dwelling computer geeks who write in code all night and eat nothing but pizza can do it.

Not so.

With the recent resurgence of hacktivism and Internet-savvy collectives like Anonymous, it’s getting easier. What’s truly shocking is just how easy.

Can Hackers Destroy The Internet?
Report: Anonymous Turns To Denial Of Service Attacks As A Last ResortRobert VamosiContributor

Rob Rachwald claims it took him 15 minutes to teach his 11-year-old how to carry out an SQL injection attack, one of the most common methods for stealing private data from web-databases. SQLi essentially tricks a database into revealing data that should be hidden, by “injecting” certain commands. That used to be done manually; now it can be automated, thanks to new tools like Havij and sqlmap.

“The tools are getting smarter,” says Rachwald, who directs security strategy at cyber security firm Imperva. As a result, “the pool of hackers is increasing.”

Havij, for example, was created just a year ago, but it’s already become one of the most popular tools for carrying out automated SQLi attacks, allowing users to steal anything from passwords, to email addresses to credit card numbers from a website. The most popular targets are small and medium-sized businesses that allow online transactions: think local gyms, pet-sitting services and charities.

But big companies can be vulnerable too, and there are plenty of examples:

LulzSec, a splinter group from Anonymous, grabbed headlines last year when it stole the staff and admin passwords from PBS, then published a fake storyabout Tupac Shakur through its content management system. The group then revealed the hack had been easy, thanks in part to using Havij to collect and store the stolen data.

Earlier this week Ohio man John Anthony Borell pleaded not-guilty to stealing the private details of nearly 500 police officers from the Salt Lake CityPolice Department. Prosecutors claim Borell was part of another splinter group called CabinCr3w, which used an automated script to carry out the attack. That “automated script” could easily have been Havij or sqlmap.

Supporters of Anonymous also used Havij in an (unsuccessful) attempt to steal private data from the Vatican last August.

Anyone can download Havij for free and simply type in the URL of their target, a vulnerable website. The program then reconstructs, and categorizes the hidden data it finds into a helpful list of headings like “passwords” or “CC numbers.” It lets you to tick off the features you want to take (for selling be spammers, or just posting online for the world to see) from other less-useful data. All done via a simple interface and in just a few clicks.


Some 88% of all SQL injection attacks between January and March of this year were carried out by either Havij or sqlmap, according to new research from Imperva, with the majority of attacks using Havij. The name, incidentally, is Farsi for “carrot,” and charmingly used as slang for male genitalia. “Somebody somewhere tried to have a sense of humor,” Rachwald says dryly.

Sqlmap, also free and billed as an off-the-shelf, penetration-testing tool, uses a command-line interface and requires a little more programming experience to use. But it can also automate the process of taking private data.

Sometimes attackers won’t know whether a site is vulnerable or not. But (surprise) that problem is also easily solved with more automated tools like Acunetix and Nikto. Acunetix, which is marketed to organizations who want to test their own websites for vulnerabilities, offers a free version on its site, while Nikto is open sourced and also freely available. Once downloaded, either program can quickly scan a site for security holes, before something like Havij comes in to mine the spoils.

In late 2010, Anonymous grabbed headlines for launching so-called DDoS attacks on PayPal and MasterCard, spamming them with junk traffic which (largely thanks to botnets) knocked them temporarily offline. Fast-forward to a year and a half later and those kinds of stunts don’t make as much noise anymore. That’s why Anonymous and its various offshoots have shifted their focus to stealing data.

“If you really want to hurt a company you expose their data,” says Rachwald, adding that two thirds of the attacks on 30 web-applications (websites) that Imperva had tracked over the last three months were automated. He’s also noticed increased discussion about Havij on hacker forums.

This might explain another recent statistic. The majority — or 61% — of IT security professionals are worried about future attacks from Anonymous and hacktivists, according to survey results released earlier this week by cyber security company Bit9. Anonymous came top of the list of attackers they though were most likely to target their organization, followed by “cyber criminals” and “nation states.” The professionals aren’t worried about the malicious spammers and veteran cyber thieves as much as they are about the teenager or 20-something next door who’s just learned how to use a free hacking tool.

The rise of armchair hackers like these is just another example of how new online tools have helped make skills that once took years to master, far more accessible. Websites can still protect themselves from these guys, but there will certainly be more of them.

10 things you need to do while you're unemployed

If you're unemployed and worried that employers will turn you down for taking on unimpressive work during the recession or for the large employment gaps on your resume—you needn’t panic. A new survey just released by the careers website CareerBuilder.com reveals that the vast majority of employers are sympathetic to such circumstances.

But this doesn’t mean you can sit around and wait for a sympathetic employer to offer you work. Employers and CareerBuilder experts recommended a variety of activities you should engage in to build, expand, and strengthen your skills during period of unemployment, in order to increase your marketability.

Seventy-nine percent would recommend doing this. Why? “The key is to get people to see your work and to see what you’re capable of doing,” says Andy Teach, the author of From Graduation to Corporation: The Practical Guide to Climbing the Corporate Ladder One Rung at a Time. “If you do a great job, even if it’s for a temporary job, whoever hired you is more likely to recommend you for a permanent position.”

 

 Sixty-one percent of the hiring managers surveyed recommended taking a class during a period of unemployment. “You never stop learning in your career, so the more technical competence you have, the better,” Teach says. “When you take a class in your field, you are also showing that you are serious about your work and that you take initiative.” Another advantage to taking a class: It’s a great networking opportunity.

Sixty percent of the hiring managers said volunteer work makes you more marketable. “When you volunteer for something, you are telling potential employers something about you as a person,” Teach says. It shows that you are passionate about something and care about helping others—and it demonstrates that money isn’t the most important thing to you, he adds. “When companies are hiring, they are looking not only for people who can get the job done but also for people with character and integrity.”

Twenty-eight percent suggested doing this—but starting a business can be pricy and time consuming. If you have the means to do it, it’s a great résumé booster and a wonderful marketing tool.

“The beauty of having your own business is that you can work part-time or full-time depending on whether or not you are able to land a job working for someone else,” Teach says. “You are also going to learn skills that are transferrable if you do end up working for someone else again.

”Eleven percent of the surveyed employers said a professional blog can be a good way to market yourself to employers. Why? You get people to see you as an expert in your field. “You are also conveying your passion, gaining knowledge, and separating yourself from others,” Teach says. “Potential employers will see you as having taken the initiative during your job search to blog about something you truly care about: your career.”

CareerBuilder experts say information technology, engineering, health care, sales, and customer service are among the top areas for hiring nationwide, according to CareerBuilder’s job listings. Follow the news and job openings in these fields.

If you're unemployed and worried that employers will turn you down for taking on unimpressive work during the recession or for the large employment gaps on your resume—you needn't panic. A new survey just released by the careers website CareerBuilder.com reveals that the vast majority of employers are sympathetic to such circumstances.

But this doesn't mean you can sit around and wait for a sympathetic employer to offer you work. Employers and CareerBuilder experts recommended a variety of activities you should engage in to build, expand, and strengthen your skills during period of unemployment, in order to increase your marketability.

Seventy-nine percent would recommend doing this. Why? “The key is to get people to see your work and to see what you’re capable of doing,” says Andy Teach, the author of From Graduation to Corporation: The Practical Guide to Climbing the Corporate Ladder One Rung at a Time. “If you do a great job, even if it’s for a temporary job, whoever hired you is more likely to recommend you for a permanent position.”

 Sixty-one percent of the hiring managers surveyed recommended taking a class during a period of unemployment. “You never stop learning in your career, so the more technical competence you have, the better,” Teach says. “When you take a class in your field, you are also showing that you are serious about your work and that you take initiative.” Another advantage to taking a class: It’s a great networking opportunity.

Sixty percent of the hiring managers said volunteer work makes you more marketable. “When you volunteer for something, you are telling potential employers something about you as a person,” Teach says. It shows that you are passionate about something and care about helping others—and it demonstrates that money isn’t the most important thing to you, he adds. “When companies are hiring, they are looking not only for people who can get the job done but also for people with character and integrity.”

Twenty-eight percent suggested doing this—but starting a business can be pricy and time consuming. If you have the means to do it, it’s a great resume booster and a wonderful marketing tool.

“The beauty of having your own business is that you can work part-time or full-time depending on whether or not you are able to land a job working for someone else,” Teach says. “You are also going to learn skills that are transferable if you do end up working for someone else again.”

Eleven percent of the surveyed employers said a professional blog can be a good way to market yourself to employers. Why? You get people to see you as an expert in your field. “You are also conveying your passion, gaining knowledge, and separating yourself from others,” Teach says. “Potential employers will see you as having taken the initiative during your job search to blog about something you truly care about: your career.”

CareerBuilder experts say information technology, engineering, health care, sales, and customer service are among the top areas for hiring nationwide, according to CareerBuilder’s job listings. Follow the news and job openings in these fields.

CareerBuilder experts say information technology, engineering, health care, sales, and customer service are among the top areas for hiring nationwide, according to CareerBuilder’s job listings. Follow the news and job openings in these fields.

Whether it’s an idea for a marketing campaign, new revenue stream, cost savings, etc., the candidates who show up at an interview with ideas demonstrate that they are passionate, knowledgeable, and excited about the opportunity. These job seekers always stand out from the crowd, CareerBuilder experts say.

A resume handed to the hiring manager directly from someone within the company is more likely to get noticed, CareerBuilder experts say. Build and expand your network of contacts through social media and professional organizations. Let friends, family and professional contacts know that you’re looking for a job, and ask for their help in finding connections to the organizations you’re interested in.

According to CareerBuilder, two thirds of workers reported that they don’t follow up with the employer after submitting their resume for consideration. It’s important to take that extra step to let the employer know you’re interested, and make sure you always send a thank you after an interview. Handwritten notes will set you apart from the pool of candidates, but e-mails are acceptable, too As long as you’re actively pursuing a job, you’ll likely be spending a significant amount of time editing and sending out your resume. Remember to use key words. Why? CareerBuilder experts said most employers use electronic scanning devices to screen and rank candidates. You’ll want to tailor your resume for each position you apply for, and include specific words from the job posting. Do this and your resume will come up higher in employer searches.