This awful infosec July is over, and finally we can sum up the Cyber Attacks reported during this month. I collected all the available information and inserted it inside the following chart. Where possible (that is enough information available) I tried to estimate the cost of the attacks using the indications from the Ponemon’s insitute according to which the average cost of a Data Breach is US $214 for each compromised record. The total sum (for the known attacks) is around $7.6 billion, mainly due to the “National Data Breach” of the South Korean Social Network Cyworld.
Approximately 16 attacks were directly or indirectly related to Antisec or Anonymous, they promised an hot summer and unfortunately are keeping their word…
Useful resources for compiling the (very long) chart were taken from:
- 2011 Cyber Attacks (and Cyber Costs) Timeline (Updated) (paulsparrows.wordpress.com)
- 2011 CyberAttacks Timeline (paulsparrows.wordpress.com)
- 50 Days of Hunt (paulsparrows.wordpress.com)
- LulzSec hacking: a timeline (telegraph.co.uk)
- Anonymous Denies Paternity For the CNAIPIC Hack (paulsparrows.wordpress.com)
The CNAIPIC Hack is becoming paradoxical. Yesterday Italian Security Professional (and Italian Newspapers) are literally gone crazy in analyzing the event, divided between those who claimed a huge and real damage (in terms of image and substance) for Cyber Italian Police, and those who raised doubts on the event, supported by the few details provided concerning the incident, together with the uncertain identity and origin of the attackers.
A couple of hours ago the last “coup de théâtre”: an official statement (in Italian) from the Italian Anonymous in which they (and the LulzSec) deny the paternity of the attack and dissociate themselves feom the hack (after dedicating ample space to the leak in their blog, claiming responsibility for it), because of the impossibility to verify the veracity of the information. Similarly, after so much noise, the tweets from the two groups are silent since 5/6 hours.
According to the Italian Anonymous the hack is exclusively attributable to the crew NKWT LOAD which is in no way related to Anonymous or LulzSec, and which is the only to possess the 8gbs of data. As a consequence, they may not confirm the accusations against CNAIPIC. At the same way they do not know which vulnerability was exploited to perform the hack.
At the beginning the action seemed a clear retaliation for the Italian Cyber Police raids against the Italian Anonymous splinter cell, but now differente hypotheses are open: a hoax, real data leaked from an Internal source, a simple 8 Gb USB key lost from a contractor or rather an attack from a foreign cyber army (with the attempt to introduce a red harring against the Anonymous)? To be continued with one clear evidence: when dealing with Italian Affairs, using a local expression, “The situation is always desperate but never serious”.
This morning the Anonymous tweets are particularly loud in Italy. It looks like a splinter cell of Anonymous hacked the Italian Cyber Police (CNAIPIC) releasing an image previews, two preview archives and a structure of the file archive (links are currently working). According to the related pastebin the content of the whole leak should amount to 8 Gb of data.
The Italian Cyber Police was heavily involved into the 32 raids which led, at the beginning of July, to the arrest of 15 alleged anonymous members in Italy during a campaign which interested the whole country and the Switzerland where the alleged leader of the group resided. Probably, to confirm a consolidated “tradition” of the group, the Anonymous decided to have a clamorous revenge (does this remember the HBGary affair?).
Moreover, this alleged leak follows another resounding leak happened in Italy, nearly in contemporary with the above raids, targeting several of the main Italian Universities.
This July 2011 seems to be endless from an Infosec perspective and, at my memory, I do not remember Italy has ever been involved so much, with actions by both sides.
Here is the full pastebin content:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ____ _______ ________
| | \ _ \ _____ \______ \
| | / /_\ \\__ \ | | \
| |__\ \_/ \/ __ \_| ` \
|_______ \_____ (____ /_______ /
\/ \/ \/ \/
+Legion of Anonymous Doom+ Release Zero1+
This is a prerelease of a series we are going to make to reveal the biggest in history of European LE cyber operation Evidence exploitation and abuse. Thing’s gonna get published and twittered all over anonymous and lulzsec community.
Today we were granted with the Italian law enforcement Pandora box, we really think it shall be a new era of “regreaissance” to the almighty Homeland Security Cyber Operation Unit in EU.
So we decided to leak everything they got since they were established as a full scale cyber taskforce named CNAIPIC.
This corrupted organization gathered all the evidence from the seized property of suspected computer professional entertainers and utilized it over many years to conduct illegal operations with foreign intelligence agencies and oligarchy to facilitate their lust for power and money, they never used obtained evidence to really support ongoing investigations.
Today we reveal a whole Load of stuff (estimated leak would be over 8Gb) from such owned institutions, just to make it clear all of this stuff was stored on CNAIPIC evidence servers for years while people are doing time in jail waiting for the trial while CNAIPIC used the evidence in the global spy game galore:
Egypt: Ministry of Transport and Communication
Australia: Ministry of Defence
Russia: Atomstroyexport, Diaskan, Sibneft, Gazprom etc.
Ukraine: several embassies and consulates on it’s territory
Nepal: Ministry of Foreign Affairs
Belarus: Ministry of Foreign Affairs, Belneftehim, Belspetzexport
Gibraltar, Cyprus, Cayman Islands etc: Tecno Develp, Line Holdings, Dugsberry Inc, Alpha Prime, Alpha Minerals etc.
Vietnam: PetroVietnam (PTSC), Ministry of Natural Resources (MONRE)
USA: EXXON MOBIL, US Department of agriculture and hundreds of attorneys and DOJ accounts including: McCallion & Associates LLP, Goodkind, Labaton, Rudoff & Sucharow, LLP, and hundreds of bullshit agencies we don’t even know why we pay taxes to support all of them.
So to cut the crap let’s get it over with fellaz…
Is the image preview to get a glimpse on what is meant to be said.
first of 2 preview archives with preview documents to get a general idea.
2nd preview archive
CNAIPIC file structure and listing Part 1
Thank you all,
Stay tuned…4 update on this one.
It looks like that security issues for US Military contractors never end. The consulting firm Booz Allen Hamilton is only the last which has fallen under the blows of anonymous. In the name of the #AntiSec operation hackers claimed today that they compromised a server released internal data, including about 90,000 military e-mail addresses. Due to the huge amount of data leaked, the operation was called #MilitaryMeltdownMonday.
We infiltrated a server on their network that basically had no security measures in place. We were able to run our own application, which turned out to be a shell and began plundering some booty. Most shiny is probably a list of roughly 90,000 military emails and password hashes (md5, non-salted of course!). We also added the complete sqldump, compressed ~50mb, for a good measure.
The entire statement is available on pastebin, while the leaked data have been inserted into a torrent at The Pirate Bay, and are also already available on pastebin, although password are hashed (but not salted).
We also were able to access their svn, grabbing 4gb of source code. But this was deemed insignificant and a waste of valuable space, so we merely grabbed it, and wiped it from their system.
It was clear that something was in the air since a couple of days, as some tweets announced “the biggest day in #anonymous‘ history according to sabu”:
This might be an indication that the ghost of the infamous group LulzSec played a crucial role in the attack to Booz Allen Hamilton. As a matter of fact Sabu, is the alleged leader of the infamous group LulzSec, and also the alleged author of the hack to HBGary Federal, another military contractor hacked earlier this year becouse of its CEO Aaron Barr claimed to have unmasked some Anonymous members. In response to his actions, the hackers dumped 71,000 emails which revealed, among the others things, that HBGary had worked with Booz Allen Hamilton to develop a response plan for Bank of America based on what the bank feared might be an upcoming leak of its internal documents by WikiLeaks.
The Anonymous statement also paints the contractor as another player involved (together with HBGary) on a military project, dubbed Operation Metal Gear by Anonymous (for lack of an official title) designed to manipulate social media, and as a revolving door of military-related conflicts of interest, and argues that the firm has been involved in mass surveillance projects.
The company wrote on its Twitter feed that “as part of @BoozeAllen security policy, we generally do not comment on specific threats or actions taken against our systems.”
This is only the last attack to a U.S. Contractor. On July, the 9th, Anonymous attacked IRC Federal, an FBI contractor, and dumped the content of the attack on a torrent available once again at The Pirate Bay. The dumped content apparently included databases, private emails, contracts, development schematics, and internal documents for various government institutions. The attack was performed as a sequel to the first one against Infragard, another FBI affiliate, on June, the 3rd performed (what a coincidence) from LulzSec.
After HBGary Federal, between April and May 2011 three U.S. Defense contractors: L-3, Lockheed Martin and Northrop Grumman were attacked by using compromised RSA seeds, although in this case no one has been identified as the author of the attacks, and also no connection with anonymous has been found.
- Hackers claim they exposed Booz Allen Hamilton data (news.cnet.com)
- 50 Days of Hunt (paulsparrows.wordpress.com)