Project Insecurity

Project Insecurity is a Computer Security organization founded by Matthew Telfer which has a primary focus as an education resource, a vulnerability identification and remediation team, and an Exploit Development Team.[2] Unlike most Ethical Hacking organizations, Project Insecurity takes the non-conventional approach of hiring former cyber-criminals in attempt to give them a chance at exhibiting reformed behavior. The Founder and CEO (Matthew Telfer) is also a former cyber-criminal himself. Some other notable members who have a history of malicious criminal activity include Dominik Penner from NullCrew and Kane Gamble from Crackas With Attitude, a group responsible for hacking the CIA, US Department of Justice, and the FBI. Matthew Telfer's stance on this is that those who have hacked maliciously have a deeper understanding of such concepts, and that their talent should not be put to waste.[3]

Project Insecurity
Private
IndustryComputer Security
FounderMatthew Telfer
Headquarters
London[2]
,
United Kingdom
ProductsComputer Security Tools, Exploits, and Educational Content
ServicesEducation, Exploit Development, Vulnerability Analysis and Remediation
Websitehttps://insecurity.sh/

Project Insecurity have released a number of noteworthy security flaws since their formation in 2017. These flaws were disclosed to the affected software vendors in a responsible manner, and some examples of large sites that were vulnerable include Google, Twitter, PayPal, Bank of America, Kaspersky, AT&T, Tesla, Verizon Media, and Sony, among many other websites.[4][5]

Project Insecurity are known by their company slogans, "Security is an illusion", and "We're in security to prevent insecurity[6]

Formation

Project Insecurity first entered the public sphere in 2017[1] and shortly after, they became a registered Limited Company within the United Kingdom.[7] During 2017 and 2018, Project Insecurity released a large number of Computer Exploits and Educational Tools and Resources[8]

Timeline of Released Work

In a two-year period from 2017 until 2019, Project Insecurity released a large number of Private Exploits.

When the organization originally surfaced, an assortment of security exploits were publicly disclosed; primarily exposing flaws in Content Management Systems and Forum Board Software. Some examples of these include XenForo, MyBB, phpBB, X-Cart, OsCommerce, concrete5, and Invision Power Board.[3] Project Insecurity also released the exploit code for Hangzhou XiaongMai Technologies CCTV Cameras,[9] demonstrating how it was possible for hackers to take control of over two million vulnerable devices and use them as part of a Botnet. These devices were believed to have been used to partially power the Mirai Botnet, resulting in what was (at the time) the most powerful Denial of Service attack in the history of the internet.[10]

In late 2017, Corben Leo of Project Insecurity published several exploits affecting the Pulse Connect Secure VPN client developed by Juniper Networks, this client is primarily used within intranet environments, but many sites used this and were affected, notably Twitter.[5] Around this same time period, Project Insecurity released several exploits affecting popular plugins for WordPress and Joomla.

In April 2018, Project Insecurity released two exploits affecting live chat systems used by various Internet Service Providers and Financial corporations around the world. Nuance Communications and LiveChat were the affected software vendors, both of which appeared to be vulnerable to bugs of a similar nature. These bugs allowed a malicious hacker to glean information on employees relating to the affected companies, such as the name, email, and employee ID of the chat agent, alongside other information such as the backend systems in use, allowing a malicious hacker to potentially gain a foothold within these networks. Some of the affected companies included Google, PayPal, Bank of America, Verizon, Sony, Tesla, Orange, Kaspersky, BitDefender, AT&T, and many other large corporations[4] . One of the founders of this exploit was Kane Gamble, who was convicted and given a two-year prison sentence shortly after these exploits were disclosed. Kane's sentencing was unrelated to any activities involving Project Insecurity and was instead due to his involvement with Crackas With Attitude, a group responsible for purportedly hacking the CIA, FBI and Department of Homeland Security.[11] Prior to his sentencing, Kane Gamble had been attempting to show that he had reformed his character, not only working alongside Project Insecurity to help secure the above affected systems, but also by reporting vulnerabilities to companies such as T-Mobile USA of his own accord.[12]

In May 2018, Project Insecurity member Six gained access to an administrative portal for EE, the largest telecommunications provider in the UK. This allowed him to view more than two million lines of their source code, including private developer API keys and Amazon Web Services secret keys.[13]

In August 2018, Project Insecurity released a series of critical exploits for OpenEMR, the most popular Electronic Medical Record system in existence. There was over 25 vulnerabilities released in total, some of which would allow a malicious hacker to obtain full access to any machine running OpenEMR. This meant that such a flaw could be leveraged to expose the personal information of more than 100 million people worldwide, including 30-million US Citizens. This information was very sensitive in nature, and it included details about particular medical conditions that people are suffering from, alongside personally identifiable information such as their names, addresses, photographs, social security numbers, and more.[14][15][16]

Also released in August 2018, Project Insecurity published an "APT-Ready" flaw affecting almost every Internet service provider in Canada, along with many in the United States. Project Insecurity pointed out that such a flaw could have been used by a rogue government to possibly manipulate the 2019 Canadian General Elections, and stated that the vulnerability could have potentially revealed the personal details of almost 80% of Canada's entire population. This issue was made possible through a flaw in SOLEO IP-RELAY.[17][18] Some of the affected sites included Bell Canada, SaskTel, Rogers Communications, Telus, Shaw Communications, EastLink, and a number of other websites.[19]

References
  1. "PROJECT INSECURITY (@insecurity) | Twitter". twitter.com.
  2. https://www.linkedin.com/company/project-insecurity
  3. "Project Insecurity". Project Insecurity. 2017. Retrieved 2018-05-05.
  4. "live-chat-widgets-leak-employee-details-from-high-profile-companies". Bleeping computer. 2018. Retrieved 2018-05-05.
  5. "Files From Project Insecurity" (PDF). Packetstorm Security. 2017. Retrieved 2018-05-05.
  6. "in.security (@insecurity_ltd) | Twitter". twitter.com.
  7. "PROJECT INSECURITY LTD - Overview (free company information from Companies House)". beta.companieshouse.gov.uk.
  8. "Project Insecurity - the web-hackers wiki". insecurity.shoutwiki.com.
  9. "XiongMai-uc-http-1.0.0-Local-File-Inclusion-Directory-Traversal". PacketStorm Security. 2017. Retrieved 2018-05-05.
  10. "Files From Project Insecurity". Packetstorm Security. 2017. Retrieved 2016-09-20.
  11. "Kane Gamble, British hacker, admits targeting heads of CIA, FBI". Washington Times. 2018. Retrieved 2018-05-05.
  12. "British teen who tried to hack CIA chief finds 'critical' T-Mobile flaw exposing customer accounts". International Business Times. 2018. Retrieved 2018-05-05.
  13. "UK cell giant EE left a critical code system exposed with a default password". ZDNET. 2018. Retrieved 2018-05-14.
  14. https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf
  15. at 23:01, Shaun Nichols in San Francisco 7 Aug 2018. "Hey, you know what a popular medical record system doesn't need? 23 security vulnerabilities". www.theregister.co.uk.
  16. "Health details of 100 million patients vulnerable to OpenEMR security flaw". www.scmagazineuk.com.
  17. "Flaw in SOLEO IP Relay Service potentially exposed over 30 million Canadian records". Security Affairs. August 20, 2018.
  18. "Canadian Telcos Patch an APT-Ready Flaw in Disability Services". threatpost.com.
  19. "project-insecurity published a vulnerability from Soleo on..." HackerOne.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.