Archive
1-15 January 2013 Cyber Attacks Timeline
So here we are with the first Cyber Attacks Timeline for 2013 covering the first half of January.
Apparently the new year has begun with an intense activity by Cyber Crooks. Hacktivists and Cyber Criminals had many time to spend in front of their keyboards during the holiday break, and as a consequence the number of breaches with more than 10.000 accounts compromised is incredibly high. WWF China, the City of Steubenville, Ohio and The German Chamber of Commerce are only three examples of institutions that suffered massive breaches during the beginning of this year.
But the massive breaches are not the only remarkable events of this period: the waves of DDoS Attacks against US banks continued (and promise to extend also in the next weeks), Kaspersky Lab discovered a new massive Cyber Espionage Campaign dubbed “Red October”, and also the Japan Farm Ministry was hit by yet another Cyber Attack, allegedly originating from China…
If this is only the beginning… 2013 promises to be pretty much troubled for system administrators…
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
Anonymous leaks 3500 Private Docs From Italian Police
On the wake of similar operations carried on by Hacktivists against Law Enforcement Agencies all over the World, the Italian Cell of the infamous collective Anonymous has decided to cross the line targeting the Italian Police with a clamorous Cyber Attack under the label of #Antisec movement.
On October, the 23rd, the Hactkivists have leaked more than 3500 private documents, claiming to own an additional huge amount of sensitive information such as lawful interception schemes, private files and e-mail accounts.
The Italian Police has indirectly confirmed the attack, downplaying its effects with a scant statement (in Italian) that (easily predictable) has raised a furious reaction by the Hacktivists. According to the above mentioned statement, no server was compromised, but the leaked data were just the consequence of several “illegitimate accesses” to private emails belonging to police officers (as to say that several compromised accounts are less severe than a hacked server).
Strictly speaking, this latest attack is not a surprise since in the past months, mainly after the infamous 50 days of Lulz of the LulzSec collective, Governments and Law Enforcement Agencies all over the world have become the preferred targets for Hacktivists under the Antisec shield. From a broader perspective this trend was apparently decreasing during 2012 because of several factors: the discovery of the double identity of Sabu (an hacktivist during the day and an FBI informant during the night), the arrest of W0rmer and ItsKahuna (two members of the CabinCr3w collective who left behind them a long trail of cyber-attacks against law enforcement agencies, and, last but not least, the arrest of the members of the Team Poison Collective.
Unfortunately This cyber-attack changes the rules and brings the things back in time to Summer 2011. It looks similar to LulzSec’s Operation Chinga La Migra, targeting Arizona Border Patrol, and to another (nearly contemporary) cyber attack that allowed LulzSecBrasil (??) to leak 8 Gb of data from the Brazilian Police.
Hopefully this cyber-attack will change the rules in Italy, it has dramatically demonstrated the real risk for public institutions and the need for a greater level of security. As a consequence it cannot be absolutely underestimated.
1-15 September 2012 Cyber Attacks Timeline
Here it is the usual compilation for the Cyber Attacks in the first half of September, a period which has apparently confirmed the revamping of hacktivism seen in August.
Several operations such as #OpFreeAssange (in support of Julian Assange), #OpTPB2 against the arrest of The Pirate Bay Co-Founder Gottfrid Svartholm Warg, and #OpIndipendencia in Mexico have characterized the first half of September. Curiously the hacktivists have also characterized this period for a couple of controversial events: the alleged leak of 1 million of UDIDs from FBI (later proven to be fake) and the alleged attack to GoDaddy (later proven to be a network issue, that is the reason why I not even mentioned it in this timeline). Other actions motivated by hacktivists have been carried on by Pro-Syrian hackers.
From a Cyber Crime perspective, there are two events particularly interesting (even if well different): the alleged leak of Mitt Romney’s tax returns and yet another breach against a Bitcoin Exchange (Bitfloor), worthing the equivalent of 250,000 USD which forced the operator to suspend the operations.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).
Antisec Steals 12M Apple Device IDs from FBI (Exploiting a Java Vulnerability) UPDATED
Update 4 Sep 23:38 GMT+2: The FBI issued a tweet denying that it ever had the 12 million Apple IDs in question:
Statement soon on reports that one of our laptops with personal info was hacked. We never had info in question. Bottom Line: TOTALLY FALSE
—
FBI PressOffice (@FBIPressOffice) September 04, 2012Here the complete Statement from the FBI Press Office.
Original Post: Few hours ago, the @AnonymousIRC Twitter account has announced yet another resounding cyber attack carried on in name of the #Antisec movement:
1,000,001 from a total of 12,000,000 iOS devices, courtesy of FBI pastebin.com/nfVT7b0Z #Anonymous #AntiSec
—
(@AnonymousIRC) September 04, 2012In a special edition of their #FFF refrain (literally quoting the authors of the attack: “so special that’s even not on friday”), the Hacktivists claim to have obtained from FBI 12,000,000 Apple Devices UDIDs (UDID is the short form for Unique Device Identifier, the unique string of numbers that univocally identifies each iOS device), and have consequently published 1,000,001 of them in pastebin post.
In the same post they explain how they were able to obtain them:
During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of “NCFTA_iOS_devices_intel.csv” turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts. no other file on the same folder makes mention about this list or its purpose.
Did you notice the misplaced detail? Actually I could not help but notice that the UDIDs were obtained exploiting a Java vulnerability, the AtomicReferenceArray vulnerability (CVE-2012-0507). A detail is not so important in other circumstances, if it had not disclosed only few days after the controversies following the discovery of a potentially devastating 0-day for Java, and the subsequent issues deriving from the release of a vulnerable patch.
There could be no worse moment for this event to happen, and I am afraid it will contribute to add fuel to the raising concerns regarding Java security… Hard days for Java… And for the FBI
March 2012 Cyber Attacks Timeline (Part I)
The first half of March is gone, and here it is the Timeline of the main Cyber Attacks for this period, a timeline which shows, once again, a month characterized by Hacktivism, and in particular by cyber attacks carried on in retaliation for the arrests of the LulzSec members, among which, particularly meaningful, is the one perpetrated against a Security Firm: Panda Security.
As far as hacktivism is concerned, March has also seen the rise of a new hacking collective called The Consortium, who hacked Digital Playground, an adult porn site, acquiring 72,000 user accounts.
Other remarkable events include the attacks to several Vatican Websites, the theft of Michael Jackson’s catalogue from Sony, and the Cyber attack to British Pregnancy Advisory Service which allowed the alleged attacker, to illegally obtain 10,000 records.
Last but not least, James Stavridis, the NATO Admiral, has fallen indirect victim of a Social Poisoning Cyber Attack allegedly perpetrated by chinese hackers, as also BBC has fallen victim of a sophisticated Cyber Attacks from Iran.
The references are after the jump and, as always, the timeline does not include the events related to Middle East Cyberwar, object of a dedicated timeline.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated) and follow @pausparrows on Twitter for the latest updates.
- http://www.thehackersnetwork.in/2012/03/mozilla-firefox-official-website-blog.html
- http://www.cyberwarnews.info/2012/03/01/redhackers-hack-police-net-and-ankara-police-directorate/
- http://news.cnet.com/8301-1009_3-57389119-83/antisec-dumps-monsanto-data-on-the-web/
- http://hackmageddon.com/2011/07/12/monsanto-hack-info-of-2500-employees-leaked/
- http://www.cyberwarnews.info/2012/03/04/electronics-giant-epson-hacked-and-data-leaked-by-anonymous-hacker-anonyintra/
- http://thehackernews.com/2012/03/siemens-and-canons-databases-exploited.html
- http://www.cyberwarnews.info/2012/02/17/chinese-cpu-maker-loongson-hacked-and-data-leaked-by-muldaria48/
- http://www.cyberwarnews.info/2012/03/02/mypakistan-com-pk-hacked-and-accounts-leaked-by-xdev-b4lc4nh4ck/
- http://www.cyberwarnews.info/2012/03/02/1400-steam-user-accounts-leaked/
- http://www.cyberwarnews.info/2012/03/04/panama-film-website-hacked-and-accounts-dumped-for-acta/
- http://www.theregister.co.uk/2012/03/02/linode_bitcoin_heist/
- http://datalossdb.org/incidents/5787-17-715-user-profiles-incl-names-usernames-e-mail-addresses-and-unencrypted-passwords-for-pvsonline-and-ip-marketplace-dumped-on-the-internet
- http://it.slashdot.org/story/12/03/05/1243235/github-hacked
- http://www.ibtimes.com/articles/308264/20120302/anonymous-hackers-religion-website-proxy-twitter.htm
- http://www.cyberwarnews.info/2012/03/04/republic-of-trinidad-and-tobago-ministry-of-finance-hacked-and-data-leaked/
- http://www.guardian.co.uk/music/2012/mar/05/michael-jackson-back-catalogue-stolen?newsfeed=true
- http://thehackernews.com/2012/03/ddos-attack-on-limes-internet-system.html
- http://news.softpedia.com/news/Hackers-Hit-English-Defence-League-Site-Offline-256693.shtml
- http://www.cyberwarnews.info/2012/03/05/2700-saudi-based-accounts-leaked/
- http://datalossdb.org/incidents/5774-874-employers-and-job-seekers-e-mail-addresses-with-plaintext-passwords-dumped-on-the-internet
- http://www.cyberwarnews.info/2012/03/05/european-union-hacked-by-abluka-org/
- http://nakedsecurity.sophos.com/2012/03/12/digital-playground-passwords/
- http://www.ibtimes.com/articles/314162/20120314/anonymous-hackers-hacks-porn-conent-email-proxy.htm
- http://community.websense.com/blogs/securitylabs/archive/2012/03/05/mass-injection-of-wordpress-sites.aspx
- http://datalossdb.org/incidents/5789-admin-usernames-with-plaintext-passwords-as-well-as-250-e-mail-addresses-of-town-and-state-employees-and-contacts-some-with-postal-addresses-phone-numbers-and-or-plaintext-passwords-dumped-on-the-internet
- http://datalossdb.org/incidents/5790-30-names-e-mail-addresses-plaintext-passwords-and-telephone-numbers-dumped-on-the-internet
- http://news.softpedia.com/news/11-Romanian-Science-and-Research-Sites-Defaced-by-Anonymous-256564.shtml
- http://www.zdnet.com/blog/security/anonymous-hacks-panda-security-in-response-to-lulzsec-arrests/10542
- https://www.facebook.com/PandaUSA/posts/10150581593176701
- http://news.softpedia.com/news/RedHack-Leaks-Data-from-Turkish-National-Police-256902.shtml
- http://www.cyberwarnews.info/2012/03/07/turkish-police-station-hacked-and-accounts-leaked/
- http://www.scmagazine.com.au/News/292592,allphones-hacked-staff-passwords-exposed.aspx
- http://www.montrealgazette.com/story_print.html?id=6262311&sponsor=
- http://anonops.blogspot.in/2012/03/anonymouss-last-actions-vatican-website.html
- http://datalossdb.org/incidents/5745-1-755-e-mail-addresses-and-plaintext-passwords-including-admin-accounts-dumped-on-the-internet
- http://www.anonnews.org/press/item/1386/
- http://www.cyberwarnews.info/2012/03/10/1135-credit-cards-hacked-by-aadil-rana-j0e-r00t/
- www.securelist.com/en/blog/676/Elections_2012_and_DDoS_attacks_in_Russia
- http://news.softpedia.com/news/TeaMp0isoN-Leaks-Data-from-UCLA-Wayne-and-Hampshire-County-Sites-257100.shtml
- http://www.cyberwarnews.info/2012/03/09/anonymous-hack-police-equipment-supplier-new-york-iron-works-for-fff/
- http://www.guardian.co.uk/world/2012/mar/11/abortion-website-hacker-caught
- http://www.cyberwarnews.info/2012/03/09/athenscountygovernment-com-hacked-by-anonymous-in-the-name-of-fff/
- http://nakedsecurity.sophos.com/2012/03/08/super-tuesday-malware-attack-targets-us-voters/
- http://www.telegraph.co.uk/news/9130527/Europes-youngest-app-designer-expelled-after-hacking-school-computer-system.html
- http://www.cyberwarnews.info/2012/03/10/european-atomic-data-site-hacked-by-anonopsromania/
- http://www.cyberwarnews.info/2012/03/15/nepal-government-hacked-and-leaked-by-n4m3le55-crew-for-censorship/
- http://www.zdnet.com/blog/facebook/chinese-spies-used-fake-facebook-profile-to-friend-nato-officials/10389
- http://anonops.blogspot.in/2012/03/anonymous-releases-symantec-source-code.html
- http://anonops.blogspot.in/2012/03/anonymous-hacks-vatican-web-site-again.html
- http://blog.sucuri.net/2012/03/web-hosting-provider-serverpro-hacked-defaced-blacklisted-by-google.html
- http://thehackernews.com/2012/03/pop-star-keha-twitter-hacked.html
- http://www.databreaches.net/?p=23616
- http://labs.alienvault.com/labs/index.php/2012/targeted-attacks-against-tibet-organizations/
- http://www.cyberwarnews.info/2012/03/14/islamic-nasheed-bank-hacked-2600-accounts-leaked-by-xdev-b4lc4nh4c/
- http://www.cyberwarnews.info/2012/03/15/chinese-websites-hacked-and-defaced-by-poltergeisth4cker-for-operation-free-christians/
- http://thehackernews.com/2012/03/tunisian-islamist-website-hacked-by.html
- https://twitter.com/search?q=%23OpVatican
- http://uk.reuters.com/article/2012/03/14/us-iran-bbc-idUKBRE82D00820120314
- http://www.guardian.co.uk/world/2012/mar/14/assad-emails-lift-lid-inner-circle
- http://www.zdnet.co.uk/news/security-threats/2012/03/15/dawn-raids-net-14-suspects-in-1m-phishing-theft-40095276/
- http://pastebin.com/u/Pr3dat0r
- http://www.cyberwarnews.info/2012/03/04/pentagon-mexican-presidents-and-universitys-hacked-by-yei-zeta/
February 2012 Cyber Attacks Timeline
Find here February 2012 Cyber Attacks Timelime Part I.
With a small delay (my apologies but the end of February has been very busy for me and not only for Cybercrooks as you will soon see), here it is the second part of my compilation with the main Cyber Attacks for February 2012.
Easily Predictable, the Hacktivism is still the main concern for System Administrators, in particular for the ones of Stratfor who suffered a huge leak of 5 million of emails.
On the same front, the threats of the Anonymous for the Friday actions have come true and as a matter of fact Law Enforcement Agencies suffered other remarkable breaches in this month: Infragard for the second time and also Interpol (a new entry) that was taken down after the arrest of 25 members of the collective. Anti ACTA protest also continue to shake Europe as also the delicate economical and social situation in Greece.
Last but not least, this month has also seen an unforgettable leak, affecting potentially more than 1.000.000 Youporn users.
As usual, the chart does not include the events related to Middle East Cyber War Timeline, that you may find at this link, as they “deserve” a dedicated timeline.
After the jump you find all the references, follows @paulsparrows for the latest updates on a regular basis and also have a look to the 2012 Cyber Attacks Timeline Master Index.
February 2012 Cyber Attacks Timeline (Part I)
February 2012 brings a new domain for my blog (it’s just a hackmaggedon) and confirms the trend of January with a constant and unprecedented increase in number and complexity of the events. Driven by the echo of the ACTA movement, the Anonymous have performed a massive wave of attacks, resuming the old habits of targeting Law Enforcement agencies. From this point of view, this month has registered several remarkable events among which the hacking of a conf call between the FBI and Scotland Yard and the takedown of the Homeland Security and the CIA Web sites.
The Hacktivism front has been very hot as well, with attacks in Europe and Syria (with the presidential e-mail hacked) and even against United Nations (once again) and NASDAQ Stock Exchange.
Scroll down the list and enjoy to discover the (too) many illustrious victims including Intel, Microsoft, Foxconn and Philips. After the jump you find all the references and do not forget to follow @paulsparrows for the latest updates. Also have a look to the Middle East Cyberwar Timeline, and the master indexes for 2011 and 2012 Cyber Attacks.
Addendum: of course it is impossible to keep count of the huge amount of sites attacked or defaced as an aftermath of the Anti ACTA movements. In any case I suggest you a couple of links that mat be really helpful:
- List of all vulnerable websites attacked by anonymous Part II (updated daily) (via cylaw.info)
- List of Websites Hacked, Defaced & Taken Down By Anonymous (via valuewalk.com)
January 2012 Cyber Attacks Timeline (Part 2)
Click here for part 1.
The second half of January is gone, and it is undoubtely clear that this month has been characterized by hacktivism and will be remembered for the Mega Upload shutdown. Its direct and indirect aftermaths led to an unprecedented wave of cyber attacks in terms of LOIC-Based DDoS (with a brand new self service approach we will need to get used to), defacements and more hacking initiatives against several Governments and the EU Parliament, all perpetrated under the common umbrella of the opposition to SOPA, PIPA and ACTA. These attacks overshadowed another important Cyber Event: the Middle East Cyberwar (which for the sake of clarity deserved a dedicated series of posts, here Part I and Part II) and several other major breaches (above all Dreamhost and New York State Electric & Gas and Rochester Gas & Electric).
Chronicles also reports a cyber attack to railways, several cyber attacks to universities, a preferred target, and also of a bank robbery in South Africa which allowed the attackers to steal $6.7 million.
Do you think that cyber attacks in this month crossed the line and the Cyber Chessboard will not be the same anymore? It may be, meanwhile do not forget to follow @paulsparrows to get the latest timelines and feel free to support and improve my work with suggeastions and other meaningful events I eventually forgot to mention.
January 2012 Cyber Attacks Timeline (Part 1)
Click here for part 2.
New year, new Cyber Attacks Timeline. Let us start our Information Security Travel in 2012 with the chart of the attacks occurred in the first fifteen days of January. This month has been characterized so far by the leak of Symantec Source Code and the strange story of alleged Cyber Espionage revolving around it. But this was not the only remarkable event: chronicles tell the endless Cyber-war between Israel and a Saudi Hacker (and more in general the Arab World), but also a revamped activity of the Anonymous against SOPA (with peak in Finland). The end of the month has also reserved several remarkable events (such as the breaches to T-Mobile and Zappos, the latter affecting potentially 24,000,000 of users). In general this has been a very active period. For 2012 this is only the beginning, and if a good beginning makes a good ending, there is little to be quiet…
Browse the chart and follows @paulsparrows to be updated on a biweekly basis. As usual after the jump you will find all the references. Feel free to report wrong/missing links or attacks.
Looking Back…
Actually this post is nearly a couple of weeks in delay (last week I was skiing in at the Italian Dolomites!!). (Un)fortunately now that I am back to home (and to work), I have choosen this Friday The 13th, while preparing my traditional Cyber Attacks Master Index for the first half of January 2012, to give a quick look to the past year in terms of my blogging activity in order to discover which where the posts which collected most views (more than 60,000 in total), of course excluding the home page.
As you will easily notice the articles related to cyber attack statistics dominate the Top 10. For sure it is not a coincidence that some of the included articles were also quoted by leading security firms such as Kaspersky and IBM). Of course, for a correct interpretation of the chart you should also consider the period of the year in which each article was written (before the article is written, greater is the number of potential readers) and also the fact that the master index is continuously updated.
|
Date |
Title |
Views |
|
Aug 11, 2011 |
16,737 |
|
|
Dec 31, 2011 |
3,668 |
|
|
Aug 16, 2011 |
2,406 |
|
|
Apr 17,2011 |
2,110 |
|
|
Jun 22, 2011 |
1,535 |
|
|
Jun 28, 2011 |
1,195 |
|
|
Dec 15, 2011 |
1,090 |
|
|
Sep 15, 2011 |
938 |
|
|
May 1, 2011 |
696 |
|
|
Sep 2, 2011 |
590 |
Yes, the post dedicated to Android Malware ranked undoubtely at number 1 (it even deserved a mention on Engadget) but also the Cyber Attacks Master index “performed well” even if at a great distance (but it was destined for a more professional audience) being quoted in many information security forums.
At rank number 3 there is a summer post dedicated to cyber attacks targeting contractors (clearly it is updated to August and could not include STRATFOR), which, actually a surprise for me, gained an unexpected attention under the Dog Days (a prolific period for blogging).
Clearly my readers have shown a great interest for security statistics, since in order to find a more technical article we have to browse the chart until number 4 with my post dedicated to TCP Split Handshake. In that circumstance I forced myself to investigate the question since when I first stumbled upon it after the NSS report (and the consequent turmoil) I must confess I had never heard about it.
Again statistics at ranks number 5, 6, and 7, until number 8 which is hold by a post dedicated to a scam targeting Twitter and mobile users. At that time the scam lured so many victims, who consequently “googled” the phrase “This made me laugh so hard when i saw this about you lol” (the symptom of the scam) and were hence redirected to that article.
A particular mention is also deserved by the Social Espionage at number 9, dealing with the threats hidden behind social networks: the Social Network Poisoning seen from the perspective of several resounding examples such as Primoris Era and Robin Sage.
In any case, forgive me if I could not do it before, I really would like to say thank you to all the Information Security Professionals who inspired my work (which I decided to quote in a very special manner)…
But most of all I want to say thank you to all the readers who stumbled upon my blog and decided to keep on reading (and retweeting) the articles regularly. Hope they will find in 2012 the same level of interest shown in the past year. Since it is not so easy to conciliate my professional and personal life with my blogging activity (thanks to my wife Romina for her patience), their appreciation is the scope of my work and a crucial driver to improve the level of quality…
About The Author
Support My Work!
Share:
News
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
Visitors from…
