The Cruel Summer the title of this post refers to, is not the famous ’83 pop hit by Bananarama, but just a brief summary of what is happening on Information Security, most of all for those companies and istitutions falling among the target of Anonymous.
Yesterday the latest: as part of the #Antisec operation and in retaliation for the raids and the arrest again alleged Anonymous and LulzSec members (provided they are the right ones), Anonymous attacked 77 U.S. Law Enforcement Institutions, defacing and destroying their servers.
In the attack, as usual announced by Twitter, massive amounts of confidential and personal information were stolen (10 Gb according to Anonymous), including emails, passwords, classified documents, internal files, informant lists, and more.
Moreover 7,000 law enforcement officials’ private data were posted, including: social security numbers; email accounts and passwords; phone numbers and home addresses.
Here is the list of the compromised domains:
20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,
bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,
baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,
cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,
cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,
coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,
drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org,
georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,
hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,
izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com,
jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov,
jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,
kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,
lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,
meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,
newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,
poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,
prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,
rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,
sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,
stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,
talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,
tunicamssheriff.com, vbcso.com, woodsonsheriff.com
It has been an hard Week-End, started with the hack of ManTech, and just ended (maybe) with this further resounding action…
Luckily this dirty July is nearly over… from the meteorological point of view, this summer is not very hot, at least in Italy, the same can not be said for Information Security for which I do not remember a month so troubled. Will it end here, or will the peak (of meterological and information security temperatures) be reached in August?
After the initial surprise more details are being divulged about the CNAIPIC Hack disclosed this morning. CNAIPIC stands for Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche) and in practice corresponds to Italian Cyber Police. The event was so resounding to deserve ample space on foreign press as well, starting from BBC, which shows that it has not a mere technical meaning.
Several quick considerations:
- As already stated, CNAIPIC played a primary role during the Campaign of July in which 15 alleged Anonymous members were arrested in 32 raids carried on in Italy and Switzerland. At first glance, this hack seems a clamorous retaliation… But this is too much simple and in my opinion there’s more… During the above mentioned raids, the Italian Police (a statement not reported by local press) reported that: Out of all of the current hacker groups, Anonymous is the largest, but is also populated by the least technical people. Some of its members carry out attacks using software downloaded from the Internet and do not carry out the most basic attempts to secure their IP address. A clear reference to the fact that, until then, the activities of the Anonymous/LulzSec cells in Italy were mainly focused on disruptive DDoS against several sites related to Government, Finance, Telcos and utilities probably made with LOIC without precautions. This attack has shown a much greater level of complexity and this can be easily intended as a kind of “revenge inside the revenge”: Anonymous is not (only) LOIC made DDoS.
- BBC reported that the Anonymous hacker group received the files from a “source”, implicitly suggesting an internal origin for the leak (also suggested by Gizmodo). Honestly speaking I do not agree with this interpretation. As a matter of fact the first tweet announcing the leak on the @AnonymousIRC account was a mere forward from an original tweet by @anonesc (who admitted not to have further details since only forwarded the info). Guess who gave the first tweet? Yes, it was Sabu (thanks to Punto 1 for reporting the info), an old acquaintance, the alleged leader of the LulzSec Group. I have already indicated that this hack resembled the one perpetrated against HBGary Federal which was already performed by Sabu, which could be involved in this hack as well the fact that he was the first to report the CNAIPIC leak cannot be considered a coincidence. Moreover, so far no details concerning the leak were given, not even from the Italian Anonymous and LulzSec.
- The statement was first written in English, of course with the purpose to reach a wider audience. Gizmodo suggests that “the broken English indicates a foreign agent—maybe Italian—and might hint at the possibility of this being an inside job” (considered the average level of English knowledge in Italy the fact that the first statement was written in English should exclude an internal origin but this is a personal consideration ). Anyway, the first statement lacks the irony (and the grammar) of the Lulz pastebins (but it looks like the Lulz Boat had a dedicated member, Topiary, for “public relations”). Curiously, the same statement in Italian was released several hours later and, honestly speaking, is a broken Italian, suggesting a quick translation from the original statement, perhaps with Google Translator or a similar tool, without further deep revisions. In any case, to me, it sounds more likely that the hack was performed with a foreign hand: if I were in an Italian attacker’s shoes I would have reserved more attention to my own language.
In any case, internal or external origin, the action is destined to raise many controversies in Italy, making even more bloody the fight against Anonymous.
- Italian Cyber Police Hacked? (paulsparrows.wordpress.com)
Are you an hardcore Playstation gamer hit by the infamous PSN Breach? (the infamous PSN Breach not the (In)famous PS3 hit… Or rather are you a Citi Card Holder afraid that your card, not yet replaced, has been compromised?
You can sleep peaceful sleep since you may check right now, for free, if your credit card has been compromised. Simply surf to:http://www.ismycreditcardstolen.com/
Insert your Credit Card and check. All for free!
Done? Ok!, now click on the “About” link on the page to discover that this is a mere provocation done by some coders to educate users about the dangers of phishing which will revamp after the numerous breaches of sensitive data which are characterizing this 2011.
In any case better to be careful when playing with CC numbers, most of all from mobile devices… If you still have any concerns about the leakages by Lulzec and Anonymous, you can always check if your email addresses and passwords are safe…
Thanks to my colleague Massimo Biagiotti for reporting the CC link!
- How To Buy A Stolen Credit Card (npr.org)