15 year old six counties male arrested for Talk Talk hacking

[thebigfella]

Encrypting databases is all fine and dandy, but what if partners and third parties need access? For all I know TalkTalk could have outsourced their finance, payroll, help desk, marketing, big data analysis field engineering, etcetera, all of whom need access to the customer database

Then you build a secure solution to allowing them access.

[thebigfella]

maybe I remember it differently, but at 15 you didn't get caught - you were invincible.

the numpties at TT are admitting to no encryption of customer data, so the fact that they may have fallen to a DDOs with and SQLi is a bloody disgrace. That they asked for 80k in Bitcoin is hilarious, and that they showed Krebs the db table copies is even funnier.

a bit of social engineering, and a AWS / GCE account go a long way. you would have said that the odds were on the side of brute force with low primes, but that they (TT) are saying they have no obligation to encrypt data is going to see them burn... SQLi it is.

People are going to jail, and it really shouldn't be the 15 year old (who will be absolutely hired when he gets out, initiative goes a long way these days)

Again, you're buying into this mythlogy that every two-bit hacker is employable. They aren't because what most of them do is so automated that they'd have little clue how to properly defend against even those basic attacks they perpetrate. The skills to defend against these attacks are very different.

Agreed, the term hack is thrown around too loosely and people assume its like the movies. I'd say a few scripts downloaded from the net, a bit of loose talk about lax security at TT and mostly luck. This is if he actually is responsible too.

[Orior]

Encrypting databases is all fine and dandy, but what if partners and third parties need access? For all I know TalkTalk could have outsourced their finance, payroll, help desk, marketing, big data analysis field engineering, etcetera, all of whom need access to the customer database

Then you build a secure solution to allowing them access.

And that is when the wrong decision is made, because the CIO/CFO thinks it is too expensive.

[5 Sams]

He's obviously not that smart if the cops are able to go straight to his house and scoop him.

[Syferus]

Encrypting databases is all fine and dandy, but what if partners and third parties need access? For all I know TalkTalk could have outsourced their finance, payroll, help desk, marketing, big data analysis field engineering, etcetera, all of whom need access to the customer database

You give them encryption keys or a specifc view on the data that has the information they need and the rest unavailable. Encryption isn't about stopping use, it's about preventing unauthorised people seeing data they shouldn't.

[imtommygunn]

Was there not talk of some boy getting phoned up and they had specific details? Initally I thought it sounded a bti wider than something one kid would have done unless he sold data on??

Encrypting data is all fine but usually there's an end point where it's not encrypted so it can fall down somewhere... These systems should only have access with logins, https certificates etc.

I'd be interested to see how the kid did it though doubt we will ever know.

I doubt he got all this through sql injection or the like. Spoofing / brute force or something like that.

[ziggysego]

You boys are the sort I would have bullied n school.
Start talkin in lay mans terms ffs.

He found the key to open the magic door to TT's box of customer's secrets.

[Muzz]

Ah come on now lads - there is no way this lad acted alone.  He was probably part of a wider online community and multiple people attached TT. 

He has probably got caught not because of his actions but because he talked about it or tried to sell the data.

As Tommy has said - customers bank accounts were cleared out and people phoned asking for money.  Did this 15 year old do this on his mobile sitting in his bedroom?  Doubtful.

There will easily be a lot of people involved in this but one young lad stupid enough to over step the mark and give his involvement away.

[heganboy]

this is the way to go:

http://www.google.com/patents/US8630422

[Syferus]

Ah come on now lads - there is no way this lad acted alone.  He was probably part of a wider online community and multiple people attached TT. 

He has probably got caught not because of his actions but because he talked about it or tried to sell the data.

As Tommy has said - customers bank accounts were cleared out and people phoned asking for money.  Did this 15 year old do this on his mobile sitting in his bedroom?  Doubtful.

There will easily be a lot of people involved in this but one young lad stupid enough to over step the mark and give his involvement away.

He probably hangs around on the usual IRC channels these 'hackers' do but this could easily be done by one kid, there is no need for there to be anyone else involved. He may have passed the information on or if he was sorta smart - doubtful seeing he was caught so fast - sold the data on the black market.

If anything having to coordinate with someone else would probably be a handicap in this sort of situation.

[Muzz]

All will be revealed but even TT would have firewalls etc. that would need to have been bypassed unless they really did not have any security what so ever.  In that case can hardly be called a hack.

Was there any reports of DDOS?  A lot of comments and releases so far have not really confirmed or denied what actually happened.  All we know is that the database was not encrypted. 

[heganboy]

Rapid7 press guy said that

TalkTalk also mentions seeing a DDoS attack prior to the actual breach. The tactic of inundating an application with traffic to hide the real attack going on at the same time is very common nowadays. By distracting the target, the attacker buys more time to focus on the assets they are really after.

[Muzz]

There's no way that this guy could have carried out the DDoS attack on his own then.

[imtommygunn]

I'd be surprised were he on his own. Has to be more involved. Could be a scapegoat I suspect with a lot of smarter people in on it.

A DDoS attack wouldn't be particularly hard but I think knowing where the database is, what to get etc etc you'd need to be in some way informed to do.

[Lecale2]

The boy has been named by The Telegraph.

http://www.telegraph.co.uk/news/uknews/crime/11957474/TalkTalk-cyber-attack-Arrested-schoolboy-named-as-Aaron-Sterritt-15-from-Ballymena.html