Packet Storm

Last updated
Packet Storm
Type of site
 Computer security
Created byThe Packet Storm Team
URL packetstormsecurity.com
CommercialYes
Launched1998;26 years ago (1998)

Packet Storm Security is an information security website offering current and historical computer security tools, [1] exploits, [2] and security advisories. It is operated by a group of security enthusiasts that publish new security information [3] and offer tools for educational and testing purposes. [4]

Contents

Overview

The site was originally created by Ken Williams who sold it in 1999 to Kroll O'Gara [5] and just over a year later, it was given back to the security community. [6] While at Kroll O'Gara, Packet Storm awarded Mixter [7] $10,000 in a whitepaper contest dedicated to the mitigation of distributed denial of service attacks. [8] Today, they offer a suite of consulting services [9] and the site is referenced in hundreds of books. [10]

In 2013, Packet Storm launched a bug bounty program to buy working exploits that would be given back to the community for their own testing purposes. [11] [12] Later that year, they worked with a security researcher to help expose a large scale shadow profile issue with the popular Internet site Facebook. [13] [14] [15] [16] [17] [18] After Facebook claimed that only 6 million people were affected, additional testing by Packet Storm exposed that the numbers were not accurately reported. [19] [20] [21] [22]

Related Research Articles

<span class="mw-page-title-main">TESO (Austrian hacker group)</span> Hacker group

TESO was a hacker group, which originated in Austria. It was active from 1998 to 2004, and during its peak around 2000, it was responsible for a significant share of the exploits on the bugtraq mailing list.

Kroll is a financial and risk advisory firm established in 1932 and based in New York City. In 2018, Kroll was acquired by Duff & Phelps. In 2021, Duff & Phelps decided to rebrand itself as Kroll, a process it completed in 2022.

The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, misconfigurations, product names, and impact metrics. NVD supports the Information Security Automation Program (ISAP). NVD is managed by the U.S. government agency the National Institute of Standards and Technology (NIST).

The Pwnie Awards recognize both excellence and incompetence in the field of information security. Winners are selected by a committee of security industry professionals from nominations collected from the information security community. Nominees are announced yearly at Summercon, and the awards themselves are presented at the Black Hat Security Conference.

<span class="mw-page-title-main">Antisec Movement</span> Hacking (computer security)

The Anti Security Movement is a movement opposed to the computer security industry. Antisec is against full disclosure of information relating to software vulnerabilities, exploits, exploitation techniques, hacking tools, attacking public outlets and distribution points of that information. The general thought behind this is that the computer security industry uses full disclosure to profit and develop scare-tactics to convince people into buying their firewalls, anti-virus software and auditing services.

Operation Aurora was a series of cyber attacks performed by advanced persistent threats such as the Elderwood Group based in Beijing, China, with associations with the People's Liberation Army. First disclosed publicly by Google on January 12, 2010, by a weblog post, the attacks began in mid-2009 and continued through December 2009.

BlueHat is a term used to refer to outside computer security consulting firms that are employed to bug test a system prior to its launch, looking for exploits so they can be closed. Their role involves searching for weaknesses or security gaps that could be exploited, and their aim is to rectify and close these potential vulnerabilities prior to a product or system launch. In particular, Microsoft uses the term to refer to the computer security professionals they invited to find the vulnerability of their products, such as Windows.

The Jester is a self-identified grey hat hacktivist. He claims to be responsible for attacks on WikiLeaks and Islamist websites. He claims to be acting out of American patriotism.

Genocide2600 was a hacker group or collective which was active from the 1980s into early 2000. The group's name was explained as a statement designed to show people that they had become desensitized to being shocked by the horrors seen throughout the world such as murder and other atrocities. It was the hope of the founder "Genocide" that the very name or word Genocide would cause people to flinch or experience some sort of revulsion and therefore, wake up a little.

NCC Group is an information assurance firm headquartered in Manchester, United Kingdom. Its service areas cover software escrow and verification, cyber security consulting and managed services. NCC Group claims over 15,000 clients worldwide. The company is listed on the London Stock Exchange.

<span class="mw-page-title-main">ImmuniWeb</span> Swiss application security company

ImmuniWeb is a global application security company headquartered in Geneva, Switzerland. ImmuniWeb develops machine learning and AI technologies for SaaS-based application security solutions provided via its proprietary ImmuniWeb AI Platform.

A bug bounty program is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.

HackerOne is a company specializing in cybersecurity, specifically attack resistance management, which blends the security expertise of ethical hackers with asset discovery, continuous assessment, and process enhancement to find and close gaps in the digital attack surface. It was one of the first companies to embrace and utilize crowd-sourced security and cybersecurity researchers as linchpins of its business model; pioneering bug bounty and coordinated vulnerability disclosure. As of December 2022, HackerOne's network had paid over $230 million in bounties. HackerOne's customers include The U.S. Department of Defense, General Motors, GitHub, Goldman Sachs, Google, Hyatt, Lufthansa, Microsoft, MINDEF Singapore, Nintendo, PayPal, Slack, Twitter, and Yahoo.

Credential stuffing is a type of cyberattack in which the attacker collects stolen account credentials, typically consisting of lists of usernames or email addresses and the corresponding passwords, and then uses the credentials to gain unauthorized access to user accounts on other systems through large-scale automated login requests directed against a web application. Unlike credential cracking, credential stuffing attacks do not attempt to use brute force or guess any passwords – the attacker simply automates the logins for a large number of previously discovered credential pairs using standard web automation tools such as Selenium, cURL, PhantomJS or tools designed specifically for these types of attacks, such as Sentry MBA, SNIPR, STORM, Blackbullet and Openbullet.

MLT, real name Matthew Telfer, is a cybersecurity researcher, former grey hat computer hacker and former member of TeaMp0isoN. MLT was arrested in May 2012 in relation to his activities within TeaMp0isoN, a computer-hacking group which claimed responsibility for many high-profile attacks, including website vandalism of the United Nations, Facebook, NATO, BlackBerry, T-Mobile USA and several other large sites in addition to high-profile denial-of-service attacks and leaks of confidential data. After his arrest, he reformed his actions and shifted his focus to activities as a white hat cybersecurity specialist. He was the founder of now-defunct Project Insecurity LTD.

BASHLITE is malware which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.

DoublePulsar is a backdoor implant tool developed by the U.S. National Security Agency's (NSA) Equation Group that was leaked by The Shadow Brokers in early 2017. The tool infected more than 200,000 Microsoft Windows computers in only a few weeks, and was used alongside EternalBlue in the May 2017 WannaCry ransomware attack. A variant of DoublePulsar was first seen in the wild in March 2016, as discovered by Symantec.

<span class="mw-page-title-main">Rafay Baloch</span> Pakistani ethical hacker and security researcher (born 1993)

Rafay Baloch is a Pakistani ethical hacker and security researcher. He has been featured and known by both national and international media and publications like Forbes, BBC, The Wall Street Journal, The Express Tribune and TechCrunch. He has been listed among the "Top 5 Ethical Hackers of 2014" by CheckMarx. Subsequently he was listed as one of "The 15 Most Successful Ethical Hackers WorldWide" and among "Top 25 Threat Seekers" by SCmagazine. Baloch has also been added in TechJuice 25 under 25 list for the year 2016 and got 13th rank in the list of high achievers. Reflectiz, a cyber security company, released the list of "Top-21 Cybersecurity Experts You Must Follow on Twitter in 2021" recognizing Rafay Baloch as the top influencer. On 23 March 2022, ISPR recognized Rafay Baloch's contribution in the field of Cyber Security with Pride for Pakistan award. In 2021, Islamabad High court designated Rafay Baloch as an amicus curia for a case concerning social media regulations.

<span class="mw-page-title-main">BlueKeep</span> Windows security hole

BlueKeep is a security vulnerability that was discovered in Microsoft's Remote Desktop Protocol (RDP) implementation, which allows for the possibility of remote code execution.

References

  1. ↑ "Linux Systems Being Hit By SSH-Key Attacks". informationweek.com. Retrieved 2008-08-27.
  2. ↑ "Compiling Exploit Code: A Network-Security Must". infoworld.com. 24 March 2006. Retrieved 2006-03-24.
  3. ↑ "Mozilla Claims Firefox 1.5 Hole Poses Minor Risk". infoworld.com. 8 December 2005. Retrieved 2005-12-08.
  4. ↑ "About Packet Storm". packetstormsecurity.com. Retrieved 2009-12-06.
  5. ↑ Wayner, Peter (1999-08-17). "Security Firm To Revive Computer-Defense Site". The New York Times . Retrieved November 14, 2017.
  6. ↑ "Packetstorm Rides Again". theregister.co.uk. Retrieved 2001-07-16.
  7. ↑ "Hacker Discloses New Internet Attack Software". cnet.com. Retrieved 2017-11-14.
  8. ↑ "Security Websites Hit By Big DDoS Attack". informationweek.com. Retrieved 2009-02-10.
  9. ↑ "Packet Storm Security Consulting". packetstormsecurity.com. Retrieved 2013-07-17.
  10. ↑ "Packet Storm Search In Google Books" . Retrieved 2013-07-17.
  11. ↑ "Did ZDI snub your 0-day attack? Packet Storm will buy it for $7k". theregister.co.uk. Retrieved 2013-01-18.
  12. ↑ "Packetstorm opens bug bounty programme with $7,000 top reward". v3.co.uk. Retrieved 2013-01-16.
  13. ↑ "Firm: Facebook's shadow profiles are 'frightening' dossiers on everyone". ZDNet . Retrieved 2013-07-17.
  14. ↑ "Anger mounts after Facebook's 'shadow profiles' leak in bug". ZDNet . Retrieved 2013-07-17.
  15. ↑ "Facebook's Creepy Data-Grabbing Ways Make It The Borg Of The Digital World". techcrunch.com. 24 June 2013. Retrieved 2013-07-17.
  16. ↑ "Facebook 'dossier' find raises contact list privacy questions". csoonline.com. 25 June 2013. Retrieved 2013-07-17.
  17. ↑ "Facebook Login, Home, Friends, Search: Company Accused of Leaving Out Important Details in Information Leak Scandal". designntrend.com. Archived from the original on 2013-07-04. Retrieved 2013-07-17.
  18. ↑ Oremus, Will (26 June 2013). "With Friends Like These". Slate. slate.com. Retrieved 2013-07-17.
  19. ↑ "Facebook: Math Of The Aftermath". packetstormsecurity.com. Retrieved 2013-07-17.
  20. ↑ Guarini, Drew (2013-06-27). "Experts Says Facebook Leak Of 6 Million Users' Data Might Be Bigger Than We Thought". huffingtonpost.com. Retrieved 2013-07-17.
  21. ↑ "Firm: Facebook 'bug' worse than reported; non-users also affected". ZDNet . Retrieved 2013-07-17.
  22. ↑ "Facebook Bug Leaked More Info Than Company Reported?". net-security.org. 27 June 2013. Retrieved 2013-07-17.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.