Wednesday, August 17, 2011

BART Police Website Hacker Claims to Be French Girl Doing First Hack

Posted By on Wed, Aug 17, 2011 at 3:15 PM

click to enlarge Vive la lulz.
  • Vive la lulz.

The purported hacker who infiltrated the BART's Police Officers Association website today claims to be a French girl ("Humiliating, huh?") who executed her first hack, SF Weekly has learned. SF Weekly chatted online with someone who claimed to be the mind behind today's attack. She provided us with the security hole she used, saying the whole thing was incredibly simple. 

Lamaline_5mg -- her online handle -- doesn't claim to be part of Anonymous, the Internet-based movement that masterminded Monday's BART protest. She even took issue with referring to the attack as a hack: "They had zero security," she wrote. "Listen, don't ask questions. I'll tell you what's important to know first."

Did we mention she's also a little bit bossy?

Lamaline wrote that she figured out how to get into BART's website by a one-page PDF tutorial and googling "site:bartpoa.com inurl:.asp?". She said she "exploited a gaping hole" in the site's security to find all the BART officers' names, e-mails, and addresses. Here's the list of information, and here was her creation, though the URL no longer works:

http://bartpoa.com/forms/contact_form.asp?i=0%27%20UNION%20ALL%20SELECT%201,2,3,4,5,%28%27%3C%28%20%27%2buserId%29,%28firstname%2b%27%20%27%2blastname%29,%28address%2b%27%20city:%27%2bcity%29,9,10,11,12,13,14,15,16,%28email%2b%27%20--Password:%20%27%2buserpwd%2b%27%20%29%3E%27%29,18,19,20,21,22,23,24,25,26,27,28,29,30%20FROM%20%2

"The way she explained sounds pretty plausible, and that's pretty trivial," says Pete Fein, an Anonymous member who facilitated the online discussion, though he reiterates he had nothing to do with the hack. "If you can write a little code and she found that technique in a PDF, that's really straightforward."

Lamaline first told us her motivation came from outrage at BART turning off  cellphone reception at downtown stations: "People trying to stand for themselves in peaceful protest ends up being such a big deal that the police has to shut down cellphone and WiFi access.This is exactly like the beginning of the tahrir protests."

But then she changed her tune, claiming she did it just for the "lulz," or for the kicks, in Internet parlance.
"I got pissed. I learned some stuff. They didn't have protections. I won."

All right, then.

You can see a full transcript of our chat on the next page.

  • Pin It

Tags: , , ,

About The Author

Lauren Smiley

Comments

Subscribe to this thread:

Add a comment

Popular Stories

  1. Most Popular Stories
  2. Stories You Missed

Like us on Facebook

Slideshows

  • Arcade Fire at Shoreline
    Arcade Fire opened their US tour at Shoreline Amphitheater to a full house who was there in support of their album "Reflector," which was released last fall. Dan Deacon opened the show to a happily surprised early audience and got the crowd actively dancing and warmed up. DEVO was originally on the bill to support Arcade Fire but a kayak accident last week had sidelined lead singer Mark Mothersbaugh and the duration of the west coast leg of the tour. Win Butler did a homage to DEVO by performing Uncontrollable Urge.
  • Comic Con 2014

    Comic book enthusiasts, Cosplayers, TV and movie fans, and celebrities descended to sunny San Diego for the annual gathering at Comic-Con International.

    Whether hitting up a panel to check out The Simpson's announcement of a cross over with Family Guy or Futurama. Or hearing a new movie with Sam Raimie based on a video game or accidentally rubbing shoulders with Daniel Radcliffe (Harry Potter) in cosplay, being a cosplayer, San Diego Comic-Con is the place to be. Photographs by Christopher Victorio