Sign in / up

back to article Dial S for SQLi: Now skiddies can order web attacks via text message

Hackers are touting a tool that allows any idiot with a smartphone to conveniently order up mass SQL injection attacks against websites. From what we can tell, you can either rent an instance of the crooks' Katyusha Scanner Pro for $200 per month, or install a copy on your own system for $500. This software uses the Anarchi …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Doctor Syntax Silver badge

    "... highlighting the importance of regular infrastructure security audits," Recorded Future concludes.

    Is Recorded Future in the business of providing regular infrastructure audits, I wonder.

    I'd have thought a simpler approach would be to make the site secure in the first place and then leave well alone but I suppose site owners just can't resist tinkering and installing the latest sieve plugin to whatever framework they run.

    1 5 Reply
    1. Sway
      Reply Icon

      Setting up and leaving it is the worst advice you could ever give, every thing on the internet needs maintenance.

      3 0 Reply
  2. Anonymous Coward
    Anonymous Coward

    You think that's bad?

    I decided to have a play about with Kali the other day to retest my home wifi network (I do it occasionally just for fun)

    All the usual suspects that I shall not name failed however there was one that I had to install separately which took a bit of knowledge about packages and bash though nothing too taxing as there were step by step instructions (they didn't work btw but as I know Linux I could adjust to get it going)

    So basically it forces the capture of a handshake (trivial and didn't take too long) then it kills my router and duplicates it without any encryption and uses nginx to serve up a page for login to the internet by entering my router wifi password which my phone was happy to show as "you need to log into to access the internet". The next thing is that it's checking the password against the handshake till I enter the correct one and once I do hey presto there's my password for me to see.

    Now of course I wouldn't switch to a non-secure version of my own network but I'm sure there are many that would and with a bit of alteration you could quite easily change the login request to be facebook/apple/hotmail/gmail or whatever you wanted. Take it out and about with open free wifi and then you have an even bigger problem.

    I understand the need for network testing tools but what I don't see is the need to make it easy. It's wrong and shouldn't be done. In my case it's freely available information which I suppose is different to trying to make money out of it but it's still there for all to see regardless.

    0 1 Reply
    1. Version 1.0 Silver badge
      Reply Icon
      Coat

      Gotta love Kali - I take my laptop with me every time I visit the clinic for a checkup in the US, I figure I might as well check them too ... I always seem to come out of it much better than they do. They always ask me why I don't use their on-line medical account ... I tell them I can't remember the(ir) password.

      2 0 Reply
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Yes yes. Very good.

      That already exists.

      http://www.fruitywifi.com/index_eng.html

      http://www.wifipineapple.com

      Its nice when the penny drops for old timers. It shows that they're not daft just incredibly slow.

      1 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        You think I don't know what a wifipineapple is? They have been around for ages.

        Please feel free to go buy one and get on a nice watch list.

        You missed the point, yeah I could go get a specific device to cause mischief or I could home brew my own with ready made simple scripts.

        This old timer and I would never describe myself as that chuckles at your use of scripts and hardware that does it for you. Try configuring all the components yourself, it's lots of fun, takes a lot of patience and the ability to learn.

        0 0 Reply
  3. Anonymous Coward
    Anonymous Coward

    I'm guessing this is LAMP stack rather than MS SQL...

    0 3 Reply
  4. Jan 0 Silver badge

    Wow, 21st Century Telegrams!

    Do I need a BSA Bantam* to execute commands?

    *The GPO should have invested in Gold Stars to ensure near instantaneous delivery.

    Where's the "Shite bike in a pool of oil" icon when you need it?

    1 1 Reply
  5. Version 1.0 Silver badge

    Meanwhile, back at the ranch ...

    I send a lot of time keeping these bastards out of my systems but I think it's good for all of us that they are trying to get in - because otherwise nobody would every bother auditing security.

    2 0 Reply
  6. John Smith 19 Gold badge
    Coat

    Comrades.....

    Time to play a tune on the Stalin organ?

    0 1 Reply
  7. Far out man

    What have Tascam to do with diet pills? Thought that they made recording equipment?

    0 0 Reply
  8. Anonymous Coward
    Anonymous Coward

    Katyusha

    .....known for inflicting panic in Nazi forces with its stealthy and devastating attacks.

    If you heard these things going off, stealthy is not a word I'd use. Terrifying yes.

    https://www.youtube.com/watch?v=Cnzfh-uGvaY

    3 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Katyusha

      Unguided rockets may make less noise than an equivalent large gun when fired and can "saturate" the target area firing many rockets quickly, which may make the target "panic", hard to emulate with older guns (newer ones have a far higher rate of fire). The sound they make on arrival may be also a bonus (like some dive bombers had devices to produce a shrieking sound).

      1 0 Reply
    2. CrazyOldCatMan Silver badge
      Reply Icon

      Re: Katyusha

      If you heard these things going off, stealthy is not a word I'd use. Terrifying yes.

      Hence the German name for them - which translates to "Stalin's Organ".

      Strictly an area denial weapon since the rockets were unguided. Not to be used if your forces were close to the enemy - unless you were a Soviet Commissar and didn't care about the peasants you were throwing at the enemy..

      One thing they were certain of - there's always more peasants. And, as long as they can pick up the rifles dropped by their predecessors, you don't even need to arm them particularly well.

      1 0 Reply
      1. Peter2 Silver badge
        Reply Icon

        Re: Katyusha

        Strictly an area denial weapon since the rockets were unguided

        Yes and no. There are two possible routes towards hitting a target. The first is the western method, which is to spend a large amount on a small number of highly accurate weapons, which culminated in the laser guided bomb in the 1990's which should in theory land within a meter of the aim point.

        The Russians took a different view, which was that "quantity becomes quality at some point" and just threw so many (cheap) unguided rockets at an area that by law of odds your certain to hit both the target, and most other things in the same grid square of the map. The WW2 Wehrmacht would probably bitterly agree that this is acceptably effective, and if Wikipedia's article on the latest Katyusha type vehicle is to be believed the "9A52-4 Tornado" throws 69 * 72 = 4968 cluster bombs per rocket * 6 rockets = 29808 cluster bombs per single vehicle salvo per launch in the general direction of the enemy.

        0 0 Reply
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Katyusha

        "And, as long as they can pick up the rifles dropped by their predecessors, you don't even need to arm them particularly well."

        As "wonderfully" exemplified in the film Enemy at the Gates.

        0 0 Reply
  9. handleoclast
    Headmaster

    Anarchi scanner?

    Oooh, that sounds really dangerous. A scanner created by bomb-throwing anarchists!!!

    The URL the link points to, however, is for www.arachni-scanner.com, which has somewhat different, spiderish, connotations.

    A thinko, perhaps?

    Or maybe the scanner really is created by dangerous, bomb-throwing spiders.

    0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like