As already suggested, I considered the original 2011 Cyber Attacks Timeline graph by Thomson Reuters not enough complete since it did not show some important attacks occurred during this tremendous 2011. This is the reason why I decided to draw an enhanced version which shows, according to my personal opinion (and metric), the list of 2011 major cyber attacks both for size and impact. Moreover in this version I added the cost of the breaches (where possible), and the alleged kind of attack perpetrated.
All the data were taken from the bulletins or statements released by the victims, or from the tweets released by the attackers.
Costs were calculated, where possible, using the indications from the Ponemon’s insitute: the average cost of a Data Breach is US $214 for each compromised record, if the targeted company decided to respond immediately the cost is around UD $268 for each compromised record, which drops to US $ 174 if the company takes longer to react.
The Total Cost is an incredible number: nearly US $ 18 billion.
Useless to say, Sony achieves rank #1 with US $ 13.4 billion. In this unenviable chart, Epsilon gains the second place with an estimated cost for its breach, of US $ 4 billion.
The others breaches, although not comparable with the previous ones, if summed, allow to achieve the grand total.
Even if smaller in size, and apparently in importance, I decided to insert in the chart also the attack to Comodo Certificates, happened in March, the 24th. In this annus horribilis, it came immediately after the RSA affaire and it has decreed, together with the RSA breach, the fall of the modern bastions of Strong Authentication (in few days tokens and certificates have proved to be vulnerable). Moreover I consider the message of the author a memorable declaration of Cyberwar. On the trail of the RSA breach the wave of attacks towards US contractors is noteworthy as well.
Hackers focused on Media Sites (Fox, PBS, Sony, Sony BMG), with a clear message against censorship (and probably the neverending problem of copyright). Interesting the second attack to PBS made to show the poor skill of LuzSecs by Warv0x, one of their enemies. In the last part of June Videogame industry was the preferred target (also Epic suffered a breach) with different intentions: LulzSec attacked Nintendo and Bethesda (the second attack resulted in data breach for the victim), but offered to avenge Sega (the manufacturer of Dreamcast), after the disastrous breach.
Direct attacks to governments focused essentially on LOIC based DDoS, albeit some infamous breaches to related sites (as in case of Infoguard/FBI and NATO) lead to Data Breaches.
Last but not least, please notice the intense activity from LulzSec in their intense “50 days of living dangerously”, just before the sudden dissolution of the group happened on June, the 25th.
- What do RSA, Epsilon and Sony breaches have in common? (paulsparrows.wordpress.com)
- It was only a matter of time… (paulsparrows.wordpress.com)
- More Random Thoughts on the RSA Breach (paulsparrows.wordpress.com)
- 2011 CyberAttacks Timeline (paulsparrows.wordpress.com)
David has shown me another example of the strict connection between real warfare and mobile warfare come from Afghanistan. Few days after the revelations about the Internet in Suitcase project funded by the Obama Administration and aimed to deploy a “shadow” Internet and an hidden mobile phone network to be used by dissidents, an indipendent, but somehow similar project has been implemented in Afghanistan. It is called FabFi and it is essentially an open-source, FabLab-grown system using common building materials and off-the-shelf electronics to transmit wireless ethernet signals across distances of up to several miles. Said in few words, the main component of this home made network can be built out of trash.
The Afghan city of Jalalabad has built a high-speed DIY Internet network with main components built out of trash found locally. A FabFi node can be buolt out of approximately $60 worth of everyday items such as boards, wires, plastic tubs, and cans that will serve a whole community at once.
SInce January 2009, the Jalalabad FabLab demonstrated the capability of the FabFi system by bringing high-speed internet to a village, hospital, university, and a non-governmental organization in Jalalabad, Nangarhar Province, Afghanistan. These low-cost, locally-produced networks can be easily spread across isolated villages and towns, placing them in touch with the outside world and facilitating socio-economic development from the ground up.
Jalalabad’s longest link is currently 2.41 miles, between the FabLab and the water tower at the public hospital in Jalalabad, transmitting with a real throughput of 11.5Mbps (compared to 22Mbps ideal-case for a standards compliant off-the-shelf 802.11g router transitting at a distance of only a few feet). The system works consistently through heavy rain, smog and a couple of good sized trees.
The project is important from a double perspective: from a technological point of view it allows high speed connectivity for war zones, or rather zones lacking conventional broadband. From a sociological point of view it confirms the strict relationship between Internet and Democracy, and, (in)directly it also confirms that the Internet is a fundamental weapon for fights in favor of the democracy, what we called the Mobile Warfare.
I could not help noticing, by tweeting with my colleague David:
@cencio4 if you make a parallelism with real warfare, it is like building home made weapons for guerrilla.
And, as a matter of fact, in order to further emphasize the parallelism, he replied:
@paulsparrows that’s exactly what rebels did in Libya with parts of helos on Mad Max-like vehicles
Take the examples of Afghanistan and Libya, invert respectively the terms Internet Connectivity and Weapons, and result is exactly the same.
- Consumerization of Warfare (paulsparrows.wordpress.com)
- Internet In A Suitcase (paulsparrows.wordpress.com)
- Shareable: Afghans Build Open-Source Internet From Trash (mbcalyn.wordpress.com)
Somewhat unexpected after 50 days of, apparently unstoppable chaos, the LulzSec Hacker group decided to haul down the flag of war and navigate to calmer shores, in which they will likely not attack other vessels in the sea of Internet.
The alleged dissolution of the group, leading the cyber-attacks at the CIA, U.S. Senate, Nintendo, Sony, SOCA, NATO and others, was announced in a statement, entitled 50 days of lulz in which the group has taken responsibility for the events, reviving the glory days of the AntiSec Movement, while claiming not to be permanently tied to the identity of LulzSec.
For the past 50 days we’ve been disrupting and exposing corporations, governments, often the general population itself, and quite possibly everything in between, just because we could. All to selflessly entertain others – vanity, fame, recognition, all of these things are shadowed by our desire for that which we all love. The raw, uninterrupted, chaotic thrill of entertainment and anarchy. It’s what we all crave, even the seemingly lifeless politicians and emotionless, middle-aged self-titled failures. You are not failures. You have not blown away. You can get what you want and you are worth having it, believe in yourself.
Probably this decision was also a consequence of the increasing attention attracted by the group, not only by CIA and FBI (which arrested an alleged 19 years old member of the group, Ryan Cleary, whose real involvement however, is yet to be shown), but also by other hackers: @th3j35t3r, @On3iroi, Web Ninjas and Warv0x (who hacked PBS a second time, just to show that “…LulzSec are just a bunch of script kiddies…”. Against those, in the last days, LulzSec was fighting a war with no holds barred, as in a modern cyberversion of a spaghetti western: on one side the so called good guys trying to unmask the identity of the bad guys with IRC logs leakages, DDOS attacks and anti-LulzSec PHP scripts; on the other side the bad guys claiming the futility of enemy attacks, their poor detective capabilities, and also their “horrible coding” (read this pastebin with the LulzSec fixed version of the PHP script used to scan their domains). At this link the possibile identities of the LulzSec members.
As their last goodbye the LulzSec released a final torrent with data taken from AOL, AT&T, NATO & others.
The motivations of the group can be shared or not, but one thing is certain: the ease with which classified information has been leaked should make us think ….
- The end of LulzSec? Hacking group says it is disbanding, after 50 days of attacks (nakedsecurity.sophos.com)
Are you an hardcore Playstation gamer hit by the infamous PSN Breach? (the infamous PSN Breach not the (In)famous PS3 hit… Or rather are you a Citi Card Holder afraid that your card, not yet replaced, has been compromised?
You can sleep peaceful sleep since you may check right now, for free, if your credit card has been compromised. Simply surf to:http://www.ismycreditcardstolen.com/
Insert your Credit Card and check. All for free!
Done? Ok!, now click on the “About” link on the page to discover that this is a mere provocation done by some coders to educate users about the dangers of phishing which will revamp after the numerous breaches of sensitive data which are characterizing this 2011.
In any case better to be careful when playing with CC numbers, most of all from mobile devices… If you still have any concerns about the leakages by Lulzec and Anonymous, you can always check if your email addresses and passwords are safe…
Thanks to my colleague Massimo Biagiotti for reporting the CC link!
- How To Buy A Stolen Credit Card (npr.org)
Update June 29: 2011 Cyber Attacks (and Cyber Costs) Timeline (Updated)
I found this interesting graph from an original Thomson Reuters post, showing the timeline of the major 2011 CyberAttacks.
The graph shows all the main Cyber Events of this tremendous 2011 up to June, the 16th. Actually to be perfect it should include also the infamous Epsilon Data Breach, happened on March, the 30th. Probably it had a major impact on the U.S. rather than in Europe, but it is clear that the aftermaths of this breach will last for years in terms of spear-phishing attacks tarteting the affected users.
Moreover, to be “ultra perfect”, it shpould also include the other attacks discovered against U.S. Defense Contractors (L-3 on April, the 6th, and Northrop Grumman on May, the 26th) should be considered as well.
Even if some attacks are missing, the graph is useful (and meaningful) to show the easiness with which our data are at risk.
Of course after June, the 16th, another cyber-attack leading to a breach was perpetrated against Sega (to be added to the list of Game Publisher), affecting 1.3 million users.
Following the Sega Breach, in these last two days, after the #Antisec Manifesto and the consequent teaming between LulzSec and Anonymous, several government sites have been hit by massive DDoS attacks, including SOCA in UK, some sites affiliated to PM Silvio Berlusconi in Italy, and some Government Sites in Brazil.
Update 06/22/2011: Other tweets of Cyberwar: it lools like the Operation #OptItaly is going on. Currently the site http://www.renatobrunetta.it is under DDoS attack and does not reply correctly to connection requests (it takes too much to load and sometimes the page is not open).
It looks like that the #AntiSec Operation has landed in Italy. The Anonymous boats have bulleted their ammunitions against some Web Sites affiliated with PM Silvio Berlusconi and, although the operation started more than ten hours ago, the situation is not completelely back to normal.
Yesterday evening the web sites were invested with an impressive wave of DDos attacks: all the sites were unavailable and right now, http://www.governoberlusconi.it is still not responding.
This is the first (known) example of the #AntiSec (Anti-Security) operation in Italy issued by the hacker group Lulzsec (famous for the repeated attacks to Sony, Nintendo, CIA and FBI-affiliated). The #AntiSec manifesto declares a real cyber war, whose top priority is to steal and leak any classified government information, including email spools and documentation (with banks and other high-ranking establishments declared as Prime Targets) “teaming up with the Anonymous collective and all affiliated battleships.”
For the chronicle the first act of this cyberwar has been a massive DDoS attack against SOCA on June, the 20th, and yesterday a fake declaration was posted on pastebin indicating the next release of the 2011 UK Census.
Moreover, yesterday a joint operation between FBI and Scoltland Yard arrested Ryan Cleary, an 19 years old boy in Essex, claimed to be the head of the LulzSec group. After an initial silence the LulzSec tweets were back indicating the boy arrested was a “simple” Admin of a server used for IRC (here a full story with an amusing perspective from the famous tabloid The Sun) and was in no way affiliated to the group.
The revenge of the group was merciless: LulSec replied leaking personal information of two hackers claimed to have supported FBI and Scotland Yard (defined “FBI & other law enforcement clowns”) for the investigations.
The war is just beginning no holds barred.
- LulzSec Teams With Anonymous, In Operation AntiSec (news.slashdot.org)
- SOCA website scalp claimed by LulzSec in apparent DDoS attack (nakedsecurity.sophos.com)
- Police arrest teen from Lulz Security for DDOS attack (infoworld.com)
It looks like the consumerization of warfare is unstoppable and getting more and more mobile. After our first post of Jume the 16th, today I stumbled upon a couple of articles indicating the growing military interest for consumer technologies.
Network World reports that the National Security Agency is evaluating the use of COTS (Commercial Off-The-Shelf) products for military purposes and is evaluating several different commercially available smartphones and tablets, properly hardened and secured. The final goal is to have four main devices, plus a couple of infrastructure support services. Meanwhile, trying to anticipate the NSA certification process, U.S. Marines are willing to verify the benefits of a military use of smartphones and consequently issued a Request For Information for trusted handheld platforms.
In both cases, the new technologies (smartphones and tablets) are preferred since they are able to provide, in small size and weight, the capability to rapidly access information in different domains (e.g., internet, intranet, secret), geolocation capabilities which are useful in situation awareness contexts, and , last but not least, the capability to connect with different media (eg, personal area network [PAN], wireless local area network [LAN], wide area network [WAN]).
Nevertheless, in a certain manner, the two approaches, albeit aiming to the same objective, are slightly different. NSA is evaluating the possibility to harden COTS in order to make them suitable for a military use, but since this process of hardening, certification and accreditation may take up to a couple of years, which is typically the life cycle of a commercial smartphone or tablet (it sounds quite optimistic since one year is an eternity for this kind of devices), the RFI issued by the Marines Corps is soliciting for system architectures and business partnerships that facilitate low-cost and high-assurance handhelds, where high-assurance means at least meeting the common criteria for evaluated assurance level (EAL) of 5+ or above. From this point of view the Marines’ approach seems closer to (and hence follows) the approach faced by the U.S. Army which is already testing iPhones, Android devices and tablets for us in war (a total of 85 apps, whose development took about $4.2 million, we could nearly speak about a Military iTunes or Military Android Market!).
But the adoption of consumer technologies does not stop here and will probably soon involve also the use of technologies closely resembling the Cloud. As a matter of fact, the NSA plans to develop in the near future a secure mobile capability, referred to as the “Mobile Virtual Network Operator,”, which will be be able to establish a way to provide sensitive content to the military and intelligence “in a way that roughly emulates what Amazon does with Kindle”, as stated by said Debora Plunkett, director of the NSA’s information assurance directorate, speaking at the Gartner Security and Risk Management Summit 2011 (but the NSA will not be the first to pilot this kind of technology since the NATO is already adopting Cloud Computing).
Probably this is only one side of the coin, I’m willing to bet that the consumerization of warfare will soon “infect” armies belonging to different countries and consequently the next step will be the development of weapons (read mobile military malware) targeted to damage the normal behavior of the military smartphones and tablets. On the other hand the Pentagon has developed a list of cyber-weapons, including malware, that can sabotage an adversary’s critical networks, so it is likely that these kind of weapons will soon affect mobile devices…
- NSA wants bulletproof smartphone, tablet security (infoworld.com)
- Consumerization of Warfare (paulsparrows.wordpress.com)
- NSA Reveals Cloud Plans, May Open-Source Some of Its Software (readwriteweb.com)
The last malware inside the Android Market, dubbed Plankton, has been discovered by the same team which discovered DroidKungFu led by Xuxian Jiang, Assistant Professor at North Carolina State University. Although the brand new malware does not root the device, it has the bad habit to hide itself inside familiar apps related to the popular game Angry Birds. The suspected apps were removed on 6/5/2011, but since the malware leverages a new evasion technique which allowed it to stay in the market for more than 2 months without being detected by current mobile anti-malware software, but being downloaed more than 100.000 times.
Plankton is included in host apps by adding a background service: when the infected app runs, it will bring up the background service which collects information, including the device ID as well as the list of granted permissions to the infected app, and send them back to a remote server discovered by Sophos to be hosted in the Amazon Cloud.
The server replies with a URL that is used to download an additional JAR file with custom code that is loaded by the downloader.
Once the JAR file is downloaded, Plankton uses a technique for loading additional code from non-Market websites demonstrated by Jon Oberheide about a year ago, providing a potential attacker with a method of circumventing checks of application functionality by Google or by another Android Market provider.
The downloaded code launches another connection to the Command server and listens for commands to execute.
Although this malware does not root the phone, its approach of loading additional code does not allow security software on Android to inspect the downloaded file in the usual “on-access” fashion, but only through scheduled and “on-demand” scans. This is the reason why the malware was not discovered before.
As a consequence the pressure on Google is building on two fronts: on one side, users are demanding better security and on the other side security vendors are asking for better operating system interfaces to make security software more effective against the ever-increasing tide of Android malware.
- Plankton malware drifts into Android Market (nakedsecurity.sophos.com)