Archive
September 2011 Cyber Attacks Timeline (Part II)
Here it is the second part of my traditional monthly Cyber Attacks Timeline (Part I available here). From an information Security Perspective the main events of this month were the infamous Diginotar breach which led to Bankrupt for the Dutch Company and also the BEAST attack to SSL, two events which, together, thumbed the Infosec Community in its stomach.
Of course these events did not divert the attention of hackers who kept on to carry on attacks against different targets.
The Anonymous continued their campaign: although mainly focused on the #OccupyWallStreet Operation (in which a Senior Officer who used pepper spray against protestors was “doxed”, they targeted several governments including Mexico, Austria, (where they also performed an unconfirmed hack against an health insurance Firm targeting 600,000 dumped users) and Syria. In particular the latter attack triggered a retaliation by Syrian Electronic Soldiers against the prestigious Harvard University.
Chronicles also report a Japan defense contractor hit by hackers, Mitsubishi Heavy Industries, (China denied its involvement on the attack), another Twitter Account hacked by The Script Kiddies (this time against USA Today), an indirect attack perpetrated against (through) Oracle by infecting its MySQL.com domain with downloadable malware and, last but not least a massive defacement of 700,000 sites hosted by Inmotion.
US Navy was also victim of defacement.
As far as the prize for the “Most Expensive Breach of the Month” is concerned, the laurel wreath is undoubtedly for SAIC (Science Applications International Corp.) which lost a tape database backup containing data of 4,900.000 users with an estimated cost of approximately 1 billion of bucks…
As usual, useful Resources for compiling the table include:
- Cyber War News (but it looks like it gave up to post reports on Cyber Attacks on 25 September 2011)
CNET Hackers Chart(unfortunately it is not up-to-date since 24 August 2011).- DATALOSSdb
- Dark Reading
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- The Hacker News
My inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
Update: On 09/30/2011, Betfair reported a 3.15 million records breach with a total estimated cost of 1.3 billion USD winning the laurel wreath of the most expensive breach of the month.
| Date | Author | Description | Organization | Attack |
| Sep 16 |
|
Websites of several Mexican government ministries As part of OpIndipendencia, websites of several Mexican government ministries, including Defense and Public Security, are teared down in the same day of the symbolic beginning of Mexico’s independence from Spain. |
 |
DDoS |
| Sep 16 | Mikster |
Clubmusic.com
Clubmusic.com, a worldwide dj website. is hacked and the leak dumped on pastebin. |
 |
SQLi |
| Sep 16 | Sec Indi Security Team |
Official Website of The United States Navy An hacker crew called Sec Indi Security Team Hacker uploads a custom message on the server to warn a WebDav vulnerability. |
 |
WebDav Vulnerabilty |
| Sep 16 | ? | California State Assembly More than 50 employees of the California State Assemby, including some lawmakers, have been warned that their personal information might have been obtained by a computer hacker. |
 |
? |
| Sep 17 | ? |
Intelligence And National Security Alliance Names and email addresses of hundreds of U.S. intelligence officials have been posted on an anti-secrecy website. On Monday Sep 10 INSA published a major report warning of an urgent need for cyberdefenses. Within a couple of days, in apparent retaliation, INSA’s “secure” computer system was hacked and the entire 3,000-person membership posted on the Cryptome.org website |
 |
N/A |
| Sep 17 | ? |
Fake FBI Anonymous Report A Fake FBI Psychological profile of the Anonymous group is published. Although not a direct cyber attack, this event can be considered an example of psychological hacking and a “sign of the times” of how information and counter information may play a crucial role in hacking. |
 |
SQLi? |
| Sep 18 |  |
Texas Police Anonymous/Anti-sec releases a document containing a list of about 3300 members of the Texas Police Association |
 |
N/A |
| Sep 19 |
? |
Mitsubishi Heavy Industries, Japan’s biggest defense contractor, has revealed that it suffered a hacker attack in August that caused some of its networks to be infected by malware. According to the firm, 45 network servers and 38 PCs became infected with malware at ten facilities across Japan. The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles. |
 |
APT |
| Sep 19 |  |
City Of Rennes TeaMp0isoN takes responsibly to hack the official website of The City Of Rennes (France) via a tweet. They also publish the reason of hack on the defacement page. |
 |
Defacement |
| Sep 19 |
? |
Hana SK Card Co., a South Korean credit card firm, announces that Sep 17, some 200 of its customers’ personal information has been leaked. Total cost of the breach is $42,800. |
Hana SK Card |
SQLi? |
| Sep 20 |
? | Former USSR Region Source report that at least 50 victim organizations ranging from government ministries and agencies, diplomatic missions, research institutions, and commercial entities have been hit in the former Soviet Union region and other countries in an apparent industrial espionage campaign that has been going on at least since August 2010.The advanced persistent threat (APT)-type attacks — dubbed “Lurid” after the Trojan malware family being used in it — has infected some 1,465 computers in 61 countries with more than 300 targeted attacks. |
 |
APT |
| Sep 20 |
Shad0w | Fox Sports Website Fox Sports website, on of the most visited Websites in the world (rank 590 in Alexa) gets hacked. An Hacker named “Shad0w” releases SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked database info posted on pastebin. Vulnerable link is also posted together admin password hashes. |
 |
SQLi? |
| Sep 22 |  |
Core Security Technologies Another security Firm target of hacking: Core Security Technologies is hacked by an hacker called Snc0pe, who defaces some websites belonging to the firm. Mirror of the hack can be seen here. |
 |
N/A |
| Sep 24 | ? |
UKChatterbox
Popular IRC service UKChatterbox advises users to change their passwords following a series of hacks which culminated in an attack that may have compromised user details. The password reset follows on from a succession of outages previously attributed to maintenance upgrades, back to the start of the summer. In a notice to users, UKChatterbox advises users to change their passwords and not to re-use them on other sites. The number of hacked account is unknown. |
 |
N/A |
| Sep 25 |
|
Seven Major Syrian Cities and Government Web Sites The Anonymous unleash a chain of defacement actions against the Syrian Government, hacking and defacing the official sites of seven major Syrian cities, which stayed up in their defaced version for more than 16 hours. The defacement actions kept on the following day in which 11 Syrian Government Sites were defaced as part of the same operation. |
 |
Defacement |
| Sep 25 | ? |
Indira Gandhi International Airport
Although happened three months ago, it turns out that a ‘technical snag’ hittinh operations at the Indira Gandhi International Airport (IGIA) T3 Terminal was caused by a “malicious code” sent from a remote location to breach the security at the airport. |
 |
APT |
| Sep 26 |  |
Inmotion Hosting Server 700,000 websites hosted on InMotion Hosting network are hacked by TiGER-M@TE. The hackers copied over the index.php in many directories (public_html, wp-admin), deleted images directory and added index.php files where not needed. List of all hacked 700,000 sites here. |
 |
Defacement |
| Sep 26 |  |
Austrian Police The Austrian Anonymous branch publishes the names and addresses of nearly 25,000 police officials, raising fears for officers’ personal security. An Austrian Interior ministry spokesman said the information came from an “association closely related with the police”. Estimated cost of the breach is around $ 5,400,000. |
 |
SQLi? |
| Sep 26 |  |
USA Today Twitter Account
The USA Today Twitter account is hacked and starts to tweet false messages mentioning the other accounts hacked by the authors of the action: the Script Kiddies (already in the spotlight for hacking the FoxNews Twitter Account at the Eve of 9/11 anniversary) |
 |
Account Hacking |
| Sep 26 |
? |
MySQL.com
MySQL.com website is struck by cybercriminals, who hacked their way in to serve up malicious code to visiting computers with a Java exploit that downloaded and executed malicious code on visiting Windows computers. Brian Krebs reports that just few days before, he noticed on a Russian underground website that a hacker was offering to sell admin rights to MySQL.com for $3000. MySQL.com receives almost 12 million visitors a month (nearly 400,000 a day). |
 |
Java Exploit to install malware |
| Sep 26 |  |
Harvard University In retaliation for the defacements performed by the Anonymous targeting Syria, Syrian Electronic Soldiers deface the website of the prestigious Harvard University. The same group came in the spotlight during July and August for defacing Anonoplus engaging a “de facto” cyberwar against The Anonymous. |
 |
Defacement |
| Sep 26 | ? |
#Occupywallstreet The month of September is characterized by the OccupyWallStreet Operation, started on September, the 17th and still ongoing. Although not directly configurable as an hacking action, it may rely on the support of the Anonymous who “doxed” a senior police who controversially usec pepper spray against a group of female protesters. |
 |
N/A |
| Sep 27 | |
COGEL, Council On Governmental Ethical Law Once again in this month,Snc0pe claims another resounding action. This time the alleged target is the official website of The Council on Governmental Ethics Laws (COGEL). He posts a message on pastebin, along with the database download link. |
 |
SQLi? |
| Sep 28 | |
Tiroler Gebietskrankenkasse (TGKK) AnonAustria in the spotlight again after the resounding hack against Austrian Police. This time the victim is an health insurance firm Tiroler Gebietskrankenkasse (TGKK) whose database of some 600,475 medical records AnonAustria claims to have hacked. The databse includes some celebrities. The total cost of the breach is around $128,500,000.00. |
 |
SQLi? |
| Sep 29 | ? |
SAIC (Science Applications International Corp.) SAIC, one of the Pentagon‘s largest contractors reveals to have discovered a data breach occurred a couple of weeks before, affecting as many as 4.9 million patients who have received care from military facilities in San Antonio since 1992. The breach involved backup computer tapes from an electronic health care record. Some of the information included Social Security numbers, addresses, phone numbers and private health information for patients in 10 states. Statement of the data breach here Estimated cost of the breach is around $ 1 billion. |
 |
Car Burglary |
| Sep 30 | ? |
Laptop Virus Repair
Although not resounding as the one which targeted MySQL.com, here it is another example of a website infected with malicious code targeting a free antivirus cloud based service. |
Laptop Virus Repair |
Malicious Code |
| Sep 30 | ? |
Betfair
Betfair reports a leak including not only the payment card details of most of its customers but also “3.15m account usernames with encrypted security questions”, “2.9m usernames with one or more addresses” and “89,744 account usernames with bank account details”. The incident occurred on 14 March 2011 but was announced only 18 months later. Estimated cost of the breach is around $1.3 billion. |
 |
? |
September 2011 Cyber Attacks Timeline (Part I)
So here it is, also for this month, the first part of My Cyber Attacks Timeline covering the first half of September.
Apparently It looks like the wave of the Anonymous attacks that characterized August has stopped. Even if several isolated episodes occurred, their impact was slightly lower than the previous months.
Probably the most important security incident for this month was the Diginotar Hack, not only because the Dutch Certification Authority has been banned forever by the main browsers and OSes but also because all the authentication model based on CAs is under discussion. Moreover once again a cyber attack has been used as a mean of repression. This incident is a turnkey point for information security but in my opinion also the DNS hacks by Anonymous Sri Lanka and Turkguvenligi are noticeable since they reinforce the need for a quick adoption of DNSSEC.
For the first time not even the Linux Operating System (an open world) was immune from hackers: both the Linux Kernel and the Linux Foundation Web Sites were hacked during this month, two episodes that Penguin Lovers will remember for a long time.
Easily predictable an attack recalling 9/11 carried on against the Twitter Account of NBC News was also reported.
Other noticeable events: three huge data breaches were reported, four attacks with political motivations targeting India, Nigeria, Colombia, and the Russia Embassy in London were perpetrated and another security vendor (Panda Security) was indirectly targeted.
The remainder of the month was characterized by many smaller attacks (mostly defacements and data leaks) and an actress (Scarlett Johansson) was also victim of data leaks.
Useful Resources for compiling the table include:
- Cyber War News
- CNET Hackers Chart
- DATALOSSdb
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- The Hacker News
And my inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
| Date | Author | Description | Organization | Attack |
| Sep 1 |
? |
The site of Kernel.org suffered a security breach leading which caused the server to be rooted and 448 credential compromised. Although it is believed that the initial infection started on August the 12th, it was not detected for another 12 days. |
 |
rootkit (Phalanx) |
| Sep 1 | |
Apple, Symantec, Facebook, Microsoft, etc.
The Sri Lankan branch of Anonymous claims to have hacked into the DNS servers of Symantec, Apple, Facebook, Microsoft, and several other large organizations over the past few days, posting the news and records of its exploits on Pastebin. |
 |
DNS Cache Snoop Poisoning |
| Sep 1 | ? |
Birdville Independent School District
Two students hack into their school district’s server and accessed a file with 14,500 student names, ID numbers, and social security numbers. Estimated cost of the breach is around $3,000,000. |
 |
? |
| Sep 2 |  |
Texas Police Chiefs Association As usual happens on Fridady, Texas Police Chiefs Association Website is hacked by Anonymous for Antisec Operation. Hacker defaced their website and posted 3GB of data in retaliation for the arrests of dozens of alleged Anonymous suspects. According to Hackers the site has been owned for nearly one month. |
|
SQLi? |
| Sep 2 |  |
EA Game Battlefield Heroes One of the most famous games over the world Battlefield Heroes developed by EA Games is hacked by a hacker named “Why So Serious?” who leaks the User Login passwords on pastebin |
 |
SQLi? |
| Sep 2 | |
vBTEAM Underground Vbteam.info, the underground vBulletin Hacking website is hacked by “Why So Serious?“, who leaks 1400+ accounts of the Vbteam.info forum in pastebin. |
 |
SQLi? |
| Sep 3 | Nomcat |
Indian Government
An Indian Hacker named “nomcat” claims to have been able to hack into the Indian Prime Ministers Office Computers and install a Remote Administration Tool) in them. He also Exposes the Vulnerability in Income Tax website and Database Information. |
 |
SQLi? |
| Sep 4 |
|
Popular Websites: : Daily Telegraph, The Register, UPS, Vodafone Popular websites including The Register, The Daily Telegraph, UPS, and others fall victim to a DNS hack that has resulted in visitors being redirected to third-party webpages. The authors of the hack, a Turkish group called Turkguvenligi, are not new to similar actions and leave a message declaring this day as World Hackers’ Day. |
 |
DNS Hijacking |
| Sep 5 | |
Mobile App Network Forum Mobile APP Network Forum is Hacked by “Why So Serious?”. He leaks over 15.000 accounts of the community (Forum) on Pastebin in two parts (Part 1 and Part 2). |
 |
SQLi? |
| Sep 5 |  |
European Union Institute For Energy and Transport One of the Sub domain of European Union (Institute for Energy) is hacked and Defaced by Inj3ct0r. Hackers deface the web page, release some internal details and leave a message against Violence in Lybia and Russian influence in Ukraine. |
 |
Defacement |
| Sep 5 | Cocain Team Hackers | United Nations Sub Domain of Swaziland United Nations Sub-Domain of Swaziland is hacked and defaced by Cocain Team Hackers. |
 |
Defacement |
| Sep 5 | |
Uronimo Mobile Platform The Uronimo Mobile platform is hacked by Team Inj3ct0r. They leak the web site database and release on Pastebin internal data including Username, Hash Password, emails and Phone Numbers of 1000 users. Estimated Cost of the Breach is $214,000. |
 |
SQLi? |
| Sep 6 | Comodo Hacker |
Diginotar
The real extent of the Diginotar breach becomes clear: 531 bogus certificates issued including Google, CIA, Mossad, Tor. Meanwhile in a pastebin message Comodo Hacker states he own four more CAs, among which GlobalSign which precautionally suspends issuance of certificates. |
 |
Several Vulnerabilities |
| Sep 7 | ? |
Beaumont Independent School District
The superintendent of schools for Beaumont Independent School District announces that letters are being mailed to parents of nearly 15,000 of its 19,848 students to inform them of a potential breach of data that occurred recently. Inadvertently, private information including the name, date of birth, gender, social security number, grade and scores on the Texas Assessment of Knowledge and Skills (TAKS) exam of students who were in the third through 11th grades during the 2009-2010 school year–were potentially exposed. Estimated cost of the breach is $3,210,000. |
 |
Human Mistake |
| Sep 7 | ? |
Stanford Hospital, Palo Alto, Calif.
A medical privacy breach leads to the public posting on a commercial Web site of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif., including names and diagnosis codes. The information stayed online for nearly a year from one of its vendors, a billing contractor identified as Multi-Specialty Collection Services, to a Web site called Student of Fortune, which allows students to solicit paid assistance with their schoolwork. Estimated Cost of The Breach is $4,280,000. |
 |
Human Mistake |
| Sep 9 | Comodo Hacker |
GlobalSign
After suspending issuing certificates, GlobalSign finds evidence of a breach to the web server hosting the www website. The breached web server has always been isolated from all other infrastructure and is used only to serve the http://www.globalsign.com website. |
 |
? |
| Sep 9 |
Comodo Hacker |
Google
As consequence of the infamous Diginotar Breach Google advises its users in Iran to change their Gmail passwords, and check that their Google accounts have not been compromised. Google also indicates that it is directly contacting users in Iran who may have been hit by a man-in-the-middle attack. |
 |
Man In The Middle |
| Sep 9 | |
NBC News
The NBC News Twitter account is hacked and starts to tweet false reports of a plane attack on ground zero. The account is suspended and restored after few minutes. |
 |
Trojan Keylogger via Email |
| Sep 9 | ? |
Samsung Card
Data of up to 800,000 Samsung Card clients may have been compromised after an employee allegedly extracted their personal information. The Breach was discovered on Aug. 25 and reported to police on Aug. 30. It is not clear what kind of information has been leaked, maybe the first two digits of residence numbers, the names, companies and mobile phone numbers were exposed. Estimated cost of the breach is $171,200.000. |
 |
Unauthorized Access |
| Sep 10 | ? |
BuyVIP (Amazon Owned)
Although not officially confirmed, BuyVIP users received an e-mail informing that their database had been hacked. Apparently, the website had been offline for a couple days and it looks like that not only names and email addresses were retrieved, but also birth dates, real shipping addresses as well as phone numbers. |
 |
SQLi |
| Sep 11 | ? |
Linux Foundation Few weeks after the kernel.org Linux archive site suffered a hacker attack, the Linux Foundation has pulled its websites from the web to clean up from a security breach. A notice posted on the Linux Foundation said the entire infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down for maintenance due to a security breach that was discovered on September 8, 2011. |
 |
SQLi? |
| Sep 11 | |
AryansBook.com Anonymous leaks the complete database from a well known nazi website AryansBook.com and posts the content on The Pirate Bay. This is a fight towards racism of any kind. |
AryansBook |
SQLi? |
| Sep 12 | ? |
Bitconitalk Forum An unknown hacker uses a zero day flaw to steal email addresses, hashed passwords and read personal messages from the bitcointalk.org forum. Forum administrators said the attacker gained root access on 3 September and was able to run arbitrary PHP code not detected until the attacker injected “annoying JavaScript” into the forum pages a week later: the Javascript splashed actor Bill Cosby across the forums and replaced all references to BitCoin with CosbyCoin. |
 |
0-day exploit in SMF |
| Sep 12 | ? |
Nigerian Government Website Nigerian Government Website is hacked and defaced by Brazilian Hackers that leave a message in the main page. |
 |
Defacement |
| Sep 12 | ? |
Vacationland Vendors
A hacker gains unauthorized access to the card processing systems at Wilderness Waterpark Resort and improperly acquires 40,000 credit card and debit card information. Estimated Cost of the Breach is $8,560,000. |
 |
N/A |
| Sep 12 | X-Nerd | Panda Security
Another Security Company Hacked: a hacker going by the name of X-Nerd hacks and defaces the Pakistan Server of a very well known security software website: Panda Security. |
 |
SQLi? |
| Sep 12 | ? |
Russian UK Embassy Just before Prime Minister David Cameron’s first visit to Moscow, the website belonging to the Embassy Of The Russian Federation in London was taken down by hackers. It seems as the attack was launched in sign of protest to the upcoming visit after a 5-year break in which no British leader went to Moscow. |
 |
DDoS |
| Sep 13 | Cyb3rSec |
thetvdb.com Cyb3rSec dumps a list of 3500+ Accounts from the forum thetvdb.com. |
 |
SQLi? |
| Sep 13 |  |
top100arena.com Albanian hackers belonging to Albanian Cyber Army exploit one of the biggest Game Arena site “Top100″ database using SQL injection attack. They leak the database on mediafire. |
 |
SQLi |
| Sep 14 |  |
President of Bolivia (presidencia.gob.bo) SwichSmoke crew hacks the site belonging to President of Bolivia and dumps the leaked data on pastebin. |
 |
Various Exploits |
| Sep 14 | ? |
uTorrent.com
The uTorrent.com |
 |
SQLi |
| Sep 14 | ? |
Bright House Networks Bright House Networks, the sixth largest owner and operator of cable systems in the U.S., has sent a letter to customers warning that they may have been exposed after servers used to process Video on Demand (VOD) were breached. |
 |
? |
| Sep 14 | ? |
Scarlett Johansson
Also an actress may be victim of hackers: The FBI investigate reports that nude photos of a famous celebrity (allegedely Scarlett Johansson) have been leaked onto the web. The day before Twitter was flooded with messages claiming to link to naked pictures of her, which were allegedly stolen from her iPhone by a hacker earlier this year. |
 |
? |
| Sep 15 | Stohanko |
Various Sites More than 101 sites, with huge amount of data and personal information which ranges from emails, phone numbers, to full names and addresses, have been hacked by an hacker dubbed Stohanko. At this link a list of the hacked sites and the links to dumped data. |
 |
? |
Anatomy Of A Twitter Scam
Do you remember Mobile Phishing and the related risks? Well This morning I had a bad surprise and could see it anction with my hands (or better with my fingers on the display of my Android Device).
This morning I woke up early (6 AM) since I previously arranged a travel to my hometown which takes approximately 4 hours. As usual I have the bad habit to check email upon awakening, directly from my Android device. This morning found a strange DM strange DM on my Twitter Account:
This made me laugh so hard when i saw this about you lol hxxp://t.co/AusOXeQ
I already exchanged some DMs in English with this contact, so, the content was not so strange (probably a similar message from an Italian contact would have received a different impact and triggered an alarm bell). Moreover I suppose my neurons were not completely up and running (actually they are rerely in this state), so a little bit for curiosity, a little bit for fun I clicked the link directly from my mobile device.
In the following screenshots you may realize how easy and dangerous for the user, mobile phishing is: as a matter of facts the link points to a bogus Twitter-like site, but, believe me, from a 3.7″ screen is really difficult to discriminate it.
The page is really similar to the real one:
But yes, if you look carefully at the address bar (but at the 6 AM with the sleep fog surrounding you is not so easy) you will notice a misplaced detail and it is the link (currently up): hxxp://www.ltwittier.com/session-verify (but not all the address is visibile on the bar). If you click on the text box the situation is even worse since the address bar, a default beaviour for the Android Browser, disappears.
Needless to say, if you login, your account will be hacked and your contacts will suffer the same fate.
This event shows how easy is to fall victim of phishing in case of mobile devices and, even worse, in case the bait comes from Social Network (and a professional social network how Twitter is for me, in which I trust the reputation of my contacts).
Always remember to check the links and be careful to follow strange links from mobile devices!
P.S.
If you point to the incomplete link: hxxp://www.ltwittier.com/ there is a clear evidence of the fact that the site is bogus:
http://paulsparrows.files.wordpress.com/2011/09/wronglink.png” alt=”" width=”300″ height=”494″ />
August 2011 Cyber Attacks Timeline
Here it is the complete list of Main Cyber Attacks for July: definitively it looks like the Dog Days did not stop the Cyber Attacks, which have been particularly numerous during August.
Following the trail of July, an attack against PCS Consultants, another U.S Government contractor opened this hot month, even if the controversial shady RAT affair monopolized (and keeps on to monopolize) the infosec landscape (and not only during the first half of the month). Easily predictable nearly every endpoint security vendor (and McAfee competitors) tend to minimize the event considering it only the latest example of RAT based cyber attacks with no particular features (see for instance the comment by Sophos, Kaspersky and Symantec).
Analogously the Dog Days did not stop hactivism with the infamous hacking group Anonymous (and its local “chapters”) author of several attacks in different countries and most of all of author of a kind of arm wrestling against BART (Bay Area Rapid Transit), sometimes carried out with questionable methods. Research in Motion was indirectly involved on the Anonymous Campaign during the London Riot, but also Anonymous was hit by (another) defacement attack carried on by Syrian hackers which affected Anonplus, the alternative Social Network.
South Korea was also hit with other massive breaches (involving also Epson Korea) and a defacement against the local branch of HSBC.
According to my very personal estimates, based on the Ponemon Institute indications, the cost for the data breach for which enough information was available, is around $ 126 million mainly due to the impressive Epson Data Breach.
Useful resources for compiling the table include:
And my inclusion criteria do not take into consideration simple defacement attacks (unless they are really resounding) or small data leaks.
Enjoy the complete list!
| Date | Author | Description | Organization | Attack |
| Aug 1 |
|
Another U.S. Government contractor, PCS Consultants gets hacked by Anonymous & Antisec. Hackers extract website Database and leak it on the internet via Twitter on Pastebin (as usual!). Leaked Data include Admin’s and 110 users emails, plus passwords in encrypted hashes. |
 |
SQLi? |
| Aug 2 | |
Vitrociset
72 hours after the first defacement, Vitrociset, a contractor of Italian Cyber Police, is hacked and defaced again by Anonymous. |
 |
SQLi? Defacement |
| Aug 3 |  |
United Nations (Shady RAT)
In an interview to Vanity Fair (as to say, information Security is a fashion), a McAfee Security Researcher declares UN and other international institutions have been victims of a large scale Remote Access Tool based attack from a Foreign Country. The attack is dubbed shady RAT and suspects are directed to China. |
 |
Remote Access Tool |
| Aug 3 |  |
Colombia
Anonymous and Colombian Hackers shut down the websites of Colombia’s president, the interior and justice ministry, the intelligence service DAS and the governing party. The hacker attack was meant as a protest against government censorship. |
 |
DDoS |
| Aug 3 |  |
The SUN and News Corp. International
Britain’s Rupert Murdoch-owned tabloid The Sun sends a message to readers warning them that computer hackers may have published their data online after an attack on the paper’s website last month. A hacker styled ‘Batteye‘ claims to have posted details taken from The Sun on the Pastebin. |
 |
SQLi? |
| Aug 3 |  |
Front National
As a consequence of the Massacre of Oslo, Anonymous France claims to have hacked a server belonging to Front National, leaking a list of 100 leaders of the party |
 |
? |
| Aug 5 | ? |
Eight weeks after a hacker cracked its credit card database, the company’s credit card unit in Japan, Citi Card, reported in a message to its user base that “certain personal information of 92,408 customers has allegedly been obtained and sold to a third party illegally.” Estimated cost of the breach is about $19.8 million. |
 |
unfaithful outsourcer |
| Aug 6 |  |
Law Enforcement Agencies
After the first attack to Law Enforcement Institutions in July, Anonymous and LulzSec, as part of what they define the ShootingSheriffsSaturday, leak again 10 Gb of Data from the same Law Enforcement Agencies, including private police emails, training files, snitch info and personal info. The attack was made in retaliation for anonymous arrests |
 |
SQLi? |
| Aug 6 | |
SAPPE (Sindacato Autonomo Polizia Penitenziaria)
Anonymous defaces the Web Site of SAPPE (Independent Union of Prison Guards) and leaves a message on pastebin (here in italian) claiming more rights for detainees |
 |
SQLi? |
| Aug 6 |  |
Policia Federal (Brazilian Police)
LulzSec Brazil hacks Brazilian Police and discloses 8 gb of data from what they defined the Pandora’s Box |
 |
USB Key Stolen? |
| Aug 7 | |
Syrian Ministry of Defense
The Syrian Ministry of defense is hacked by Anonymous which defaces the web site and post a note supporting the Syrian people |
 |
Defacement |
| Aug 9 | |
Anonplus (Anonymous Social Network)
In retaliation for the defacement of the Syrian Ministry of Defence, a Syrian Group of hackers dubbed Syrian Electronic Army, has defaced (for the third time), Anonplus, the alternative Social Network in phase of deployment by Anonymous, posting several gruesome images. |
 |
Defacement |
| Aug 9 | |
Research In Motion
As an (in)direct consequence of the London Riots, a crew of hackers called TeaMp0isoN defaces The Official BlackBerry Blog after RIM has indicated to assist London police, who are investigating the use of the messaging service in organizing riots, with a “very extensive monitoring of the BlackBerry Messenger model”. |
 |
SQLi? |
| Aug 9 |
|
Operation Satiagraha
As part of Operation Antisec, LulzSec and Anonymous, release 5gb of documents, photos, audio files and videos, exposing that wich was one of the greatest corruption scandals in the recent history of Brazil |
 |
SQLi? |
| Aug 10 | ? |
University Of Wisconsin Milwaukee
The Social Security numbers of 75,000 students and employees at the University of Wisconsin-Milwaukee arE exposed after hackers planted malware in a campus server.ty-of-wisconsin-server. Estimated Cost of the Breach is $16 million. |
 |
APT |
| Aug 10 | ? |
Hong Kong Stock Exchange (HKEx)
The Hong Kong stock exchange (HKEx) halts trading for seven stocks in the afternoon trading session after its website was attacked during the morning trading session. The seven stocks in question were all due to release sensitive results to the website that could impact the price of their stocks. Initially the attack was believed to have compromised the web site. Later it was discovered to be a DDoS. |
 |
DDoS |
| Aug 12 | Headpuster |
Welt.de
An hacker called Headpuster, to protest against the sale of user data to a third party operator, hacks Welt.de using an SQL Injection (http://boot24.welt.de/index_welt..php?ac =***) and steals a large amount of data including credit card information of 30,264 users from the database He then publishes censored excerpts. Estimated cost of the breach is around $6.5 million. |
 |
SQLi? |
| Aug 12 | ? |
Hong Kong stock exchange (HKEx)
The Hong Kong stock exchange comes under attack for the second day in a row on Thursday. The exchange blamed a Distributed Denial of Service (DDoS) attack against its news web server, hkexnews.hk. A Suspect has been arrested on Aug, the 23rd. |
 |
DDoS |
| Aug 14 | |
Mybart.org
As part of their #OpBART and #Bart-Action in response to a temporary shutdown of cell service in four downtown San Francisco stations to interfere with a protest over a shooting by a BART police officer, Anonymous attacks the myBART.org website belonging to San Francisco’s BART (Bay Area Rapid Transit) system. They perform a SQL injection (SQLi) attack against the site and extract 2,450 records containing names, usernames, passwords (plain text), emails, phone numbers, addresses and zip codes. Estimated Cost of the Breach is $524,300. |
 |
SQLi |
| Aug 15 | ? |
GOMTV.NET
After SK, Another South Korean service provider reports a large-scale data breach of usernames and passwords for subscribers worldwide. This time, it’s the turn of Seoul-based streaming media service GOMTV to suffer a data-spilling intrusion. According to GOM TV, the breach happened early in the morning of Friday 12 August 2011 Korean time; the company sent out a warning email to its subscribers on Sunday 14 August 2011. |
 |
SQLi? |
| Aug 16 | |
Vanguard Defense Industries
Antisec targets Richard Garcia, the Senior Vice President of Vanguard Defense Industries (VDI). During the Breach nearly 4,713 emails and thousands of documents are stolen. The attack has been performed on August the 16th, but, as a consolidated tradtion, the torrent has been released on Friday, August the 19th. |
 |
Vulnerability in WordPress Hosting Platform |
| Aug 16 |  |
Ebay
Hacker group Cslsec (Can’t stop laughing security) leaks some accounts from Ebay and post them on pastebin. |
 |
SQLi? |
| Aug 17 | |
BART Police
A database belonging to the BART Police Officers Association is hacked, and the names, postal and email addresses of officers are posted online. Over 100 officers are listed in the document posted, as usual, on pastebin. Estimated cost of the breach is $21,400. |
 |
SQLi? |
| Aug 20 |  |
A turkish based hacker hacks and defaces the Korean branch of HSBC, the global banking group. |
 |
defacement |
| Aug 21 | pr0tect0r AKA mrNRG |
The developer forum section of Nokia Website is hacked by Indian Hacker “pr0tect0r AKA mrNRG“. He was able to deface the site and access to email records. According to an official statement from Nokia a “significantly larger” number of accounts has been accessed although they do not contain sensitive information. |
 |
SQLi |
| Aug 21 | |
Danish Government
Anonymous Hackers upload a file on Torrent containing the snapshot of the Danish Government database of companies. The snapshot was obtained during the summer of 2011 by systematically harvesting data from the public parts of the cvr.dk website. |
 |
SQLi? |
| Aug 22 | ? |
Epson Korea
Hacking in South Korea: After GOMTV.NET Epson Korea is hit by a massive data breach, involving the personal information of 350,000 registered customers. Hackers break into Epson Korea’s computer systems, and steal information including passwords, phone numbers, names, and email addresses of customers who had registered with the company. Estimated cost of the breach is $74,900,000. |
 |
? |
| Aug 22 | Electr0n |
Libyan domain name registry
Hackers deface the nic.ly website, the main registry which administers .ly domain names (the “.ly” stands for “Libya”) and replace it with anti-Gaddafi message. |
 |
defacement |
| Aug 22 |  |
Allianceforcebiz.com
@ThEhAcKeR12, an admirer of Anonymous acts independently to breach an outsourced provider and steal a customer list with 20,000 log-in credentials. Many on the list were U.S. government employees. Estimated cost of the breach is around $4,280,000. |
 |
SQLi? |
| Aug 22 |
|
UK MET Police As part of the Murder Military Monday, Metropolitan UK Police is hacked for #Antisec by CSL Security using SQL injection Vulnerability and the vulnerable link is also shown on Twitter and pastebin. Other attacked sites include: USarmy.com, GoArmy.com. |
 |
SQLi |
| Aug 23 | |
U.S. Government F-Secure discovers that on 17th of July, a military documentary program titled “Military Technology: Internet Storm is Coming” was published on the Government-run TV channel CCTV 7, Millitary and Agriculture (at military.cntv. While they are speaking about theory, they actually show camera footage of Chinese government systems launching attacks against a U.S. target. |
|
DDoS? |
| Aug 24 | |
Cslsec
Another example of Cyberwars between different hacker crews: TeaMp0isoN hacks Cslsec which claimed to be the new LulzSec |
|
Defacement |
| Aug 25 | ? |
U.S. Military Base
Another example of military emails leaked by hackers. |
|
SQLi? |
| Aug 27 | Division Hackers Crew |
Borlas.net
Division Hackers Crew hacks the Database of Borlas.net (Free SMS Site) and leaks the usernames, Passwords, emails and phone numbers of 14800 registered users. As usual, leaked database has been posted on pastenbin. Estimated cost of the breach is $3,167,200. |
 |
SQLi? |
| Aug 28 |  |
Orange.fr
Anonymous Hacker hacks Orange.fr and uploads the database and Site source code backup on file sharing site. |
 |
SQLi? |
| Aug 29 | Iranian Hackers |
Diginotar
A user named alibo on the Gmail forums posts a thread about receiving a certificate warning about a revoked SSL certificate for SSL-based Google services. The certificate in question was issued on July 10th by Dutch SSL certificate authority DigiNotar. The fake certificate was forged by Iranian Hackers, and revoked immediately. This is the second episode of a MITM attack against Google after the Comodo Affair in May. |
|
Vulnerability |
| Aug 29 | ? |
Gabia (South Korean domain registrar)
Another Cyber Attack in South Korea: Gabia a South Korean domain registrar is hacked on Saturday Aug 27, according to a report Monday by the Korea Herald. The hack exposed over 100,000 domains and 350,000 users data. The information included names, user IDS, passwords and registration numbers. |
 |
? |
| Aug 29 | |
densetsu.com
Sometimes they come back: one of the lulzsec members seems to have made a quick returning hacking a child porn trading forum and leaking over 7000 accounts. |
densetsu.com | SQLi? |
| Aug 30 |  |
Wikileaks (1) Der Spiegel reports that a WikiLeaks file containing the original leaked US State Department cables has inadvertently been released onto the Internet. The documents have not been edited to protect sources, meaning that the lives of informants could be at risk. |
|
? |
| Aug 30 | ? |
Wikileaks (2) The WikiLeaks website, which contains thousands of U.S. embassy cables, has crashed in an apparent cyberattack. The anti-secrecy organization said in a Twitter message Tuesday that Wikileaks.org “is presently under attack.” |
|
DDoS |
| Aug 30 |  |
swgalaxies.net @neatstuffs leaks over 23,000 emails and passwords from a Star Wars Fan Club, and all the passwords are in clear text…sad isnt it? that a website would store so many users information with no security. |
 |
SQLi? |
August 2011 Cyber Attacks Timeline (Part I)
Update Sep 2: August 2011 Cyber Attacks Timeline (Complete List)
It looks like the Dog Days did not stop the Cyber Attacks, which have been particularly numerous during August. This is the reason why I decided to divide my traditional collection in two parts. Today it is the turn of the first half covering the interval 1-15 August.
Following the trail of July, an attack against PCS Consultants, another U.S Government contractor opened this hot month, even if the controversial shady RAT affair monopolized (and keeps on to monopolize) the infosec landscape (and not only during the first half of the month). Easily predictable nearly every endpoint security vendor (and McAfee competitors) tend to minimize the event considering it only the latest example of RAT based cyber attacks with no particular features (see for instance the comment by Sophos, Kaspersky and Symantec).
Analogously the Dog Days did not stop hactivism with the infamous hacking group Anonymous (and its local “chapters”) author of several attacks in different countries and most of all of author of a kind of arm wrestling against BART (Bay Area Rapid Transit), sometimes carried out with questionable methods. Research in Motion was indirectly involved on the Anonymous Campaign during the London Riot, but also Anonymous was hit by (another) defacement attack carried on by Syrian hackers which affected Anonplus, the alternative Social Network.
South Korea was also hit with another massive breach (but the story for SK does not end here).
According to my very personal estimates, based on the Ponemon Institute indications, the cost for the data breach for which enough information was available, is around $ 43 million.
| Date | Author | Description | Organization | Attack |
| Aug 1 |
|
Another U.S. Government contractor, PCS Consultants gets hacked by Anonymous & Antisec. Hackers extract website Database and leak it on the internet via Twitter on Pastebin (as usual!). Leaked Data include Admin’s and 110 users emails, plus passwords in encrypted hashes. |
|
SQLi? |
| Aug 2 | |
Vitrociset
72 hours after the first defacement, Vitrociset, a contractor of Italian Cyber Police, is hacked and defaced again by Anonymous. |
|
SQLi? Defacement |
| Aug 3 | |
United Nations (Shady RAT)
In an interview to Vanity Fair (as to say, information Security is a fashion), a McAfee Security Researcher declares UN and other international institutions have been victims of a large scale Remote Access Tool based attack from a Foreign Country. The attack is dubbed shady RAT and suspects are directed to China. |
|
Remote Access Tool |
| Aug 3 | |
Colombia
Anonymous and Colombian Hackers shut down the websites of Colombia’s president, the interior and justice ministry, the intelligence service DAS and the governing party. The hacker attack was meant as a protest against government censorship. |
|
DDoS |
| Aug 3 | |
The SUN and News Corp. InternationalBritain’s Rupert Murdoch-owned tabloid The Sun sends a message to readers warning them that computer hackers may have published their data online after an attack on the paper’s website last month. A hacker styled ‘Batteye‘ claims to have posted details taken from The Sun on the Pastebin. | |
SQLi? |
| Aug 3 | |
Front National
As a consequence of the Massacre of Oslo, Anonymous France claims to have hacked a server belonging to Front National, leaking a list of 100 leaders of the party |
|
? |
| Aug 5 | ? |
Eight weeks after a hacker cracked its credit card database, the company’s credit card unit in Japan, Citi Card, reported in a message to its user base that “certain personal information of 92,408 customers has allegedly been obtained and sold to a third party illegally.” Estimated cost of the breach is about $19.8 million. |
|
unfaithful outsourcer |
| Aug 6 | |
Law Enforcement Agencies
After the first attack to Law Enforcement Institutions in July, Anonymous and LulzSec, as part of what they define the ShootingSheriffsSaturday, leak again 10 Gb of Data from the same Law Enforcement Agencies, including private police emails, training files, snitch info and personal info. The attack was made in retaliation for anonymous arrests |
|
SQLi? |
| Aug 6 | |
SAPPE (Sindacato Autonomo Polizia Penitenziaria)
Anonymous defaces the Web Site of SAPPE (Independent Union of Prison Guards) and leaves a message on pastebin (here in italian) claiming more rights for detainees |
|
SQLi? |
| Aug 6 | |
Policia Federal (Brazilian Police)
LulzSec Brazil hacks Brazilian Police and discloses 8 gb of data from what they defined the Pandora’s Box |
|
USB Key Stolen? |
| Aug 7 | |
Syrian Ministry of Defense
The Syrian Ministry of defense is hacked by Anonymous which defaces the web site and post a note supporting the Syrian people |
|
Defacement |
| Aug 9 | |
Anonplus (Anonymous Social Network)
In retaliation for the defacement of the Syrian Ministry of Defence, a Syrian Group of hackers dubbed Syrian Electronic Army, has defaced (for the third time), Anonplus, the alternative Social Network in phase of deployment by Anonymous, posting several gruesome images. |
|
Defacement |
| Aug 9 | |
Research In Motion
As an (in)direct consequence of the London Riots, a crew of hackers called TeaMp0isoN defaces The Official BlackBerry Blog after RIM has indicated to assist London police, who are investigating the use of the messaging service in organizing riots, with a “very extensive monitoring of the BlackBerry Messenger model”. |
|
SQLi? |
| Aug 9 |
|
Operation Satiagraha
As part of Operation Antisec, LulzSec and Anonymous, release 5gb of documents, photos, audio files and videos, exposing that wich was one of the greatest corruption scandals in the recent history of Brazil |
|
SQLi? |
| Aug 10 | ? |
University Of Wisconsin Milwaukee
The Social Security numbers of 75,000 students and employees at the University of Wisconsin-Milwaukee arE exposed after hackers planted malware in a campus server.ty-of-wisconsin-server. Estimated Cost of the Breach is $16 million. |
|
APT |
| Aug 10 | ? |
Hong Kong Stock Exchange (HKEx)The Hong Kong stock exchange (HKEx) halts trading for seven stocks in the afternoon trading session after its website was attacked during the morning trading session. The seven stocks in question were all due to release sensitive results to the website that could impact the price of their stocks. Initially the attack was believed to have compromised the web site. Later it was discovered to be a DDoS | |
DDoS |
| Aug 12 | Headpuster |
Welt.de
An hacker called Headpuster, to protest against the sale of user data to a third party operator, hacks Welt.de using an SQL Injection (http://boot24.welt.de/index_welt..php?ac =***) and steals a large amount of data including credit card information of 30,264 users from the database He then publishes censored excerpts. Estimated cost of the breach is around $6.5 million. |
|
SQLi? |
| Aug 12 | ? |
Hong Kong stock exchange (HKEx)
The Hong Kong stock exchange comes under attack for the second day in a row on Thursday. The exchange blamed a Distributed Denial of Service (DDoS) attack against its news web server, hkexnews.hk. A Suspect has been arrested on Aug, the 23rd.
|
|
DDoS |
| Aug 14 | |
Mybart.org
As part of their #OpBART and #Bart-Action in response to a temporary shutdown of cell service in four downtown San Francisco stations to interfere with a protest over a shooting by a BART police officer, Anonymous attacks the myBART.org website belonging to San Francisco’s BART (Bay Area Rapid Transit) system. They perform a SQL injection (SQLi) attack against the site and extract 2,450 records containing names, usernames, passwords (plain text), emails, phone numbers, addresses and zip codes. Estimated Cost of the Breach is $524,300. |
|
SQLi |
| Aug 15 | ? |
GOMTV.NETAfter SK, Another South Korean service provider reports a large-scale data breach of usernames and passwords for subscribers worldwide. This time, it’s the turn of Seoul-based streaming media service GOMTV to suffer a data-spilling intrusion. According to GOM TV, the breach happened early in the morning of Friday 12 August 2011 Korean time; the company sent out a warning email to its subscribers on Sunday 14 August 2011. | |
SQLi? |
MySpace Hacked? No It wasn’t!
Update: Next Web pointed out that that what has been reported is a standard error message used by MySpace since 2009. I know these are hard times of hoaxes and psychological terrorism driven by the recent hacks by Anonymous and LulzSec but I hope that the lesson will be learned. Probably it would be better, in times like these, to use clearer error messages. At any rate this is only the latest demonstration of what it means to be hacking in the time of Twitter: advertising an attack, too often before performing it, has become even more important than the effect of the attack itself.
Original Post
Even if the infamous OpFacebook announced a couple of days ago is probably a hoax, nevertheless it looks like other hackers did not waste time and hacked MySpace.
As usual the hack was announced with an (Anonymous) tweet:
Following the link (http://www.myspace.com/modules/common/static/html/error.html) leads to a bad surprise, a page whose title is meaningful “All is wrong 
“. By the way www.myspace.com is currently unavailable.
We messed up our code so bad that even puppies and kittens may be in danger. Please turn back …now.
Riot In Motion
As an (in)direct consequence of the London Riots, a crew of hackers called TeaMp0isoN has defaced the The Official BlackBerry Blog after RIM has indicated to assist London police, who are investigating the use of the messaging service in organizing riots, with a “very extensive monitoring of the BlackBerry Messenger model”.
The availability of BBM (Black Berry Messenger), a closed messaging system for one-to-one or one-to-many (encrypted!) communications at no charge, has made BlackBerry a very popular device among U.K. teens, who are believed to be the major responsible for the riots which have hit British streets. As a consequence BlackBerry Messenger is believed to have played a key role for rioters to organize themselves.
Since the Company decided to support the Police to contain the riot, granting access to BBM data and logs, it did not take so long for a resounding retaliation by the above quoted hacker group.
Curiously shortly after the attack, MP called for BlackBerry Messenger suspension to calm UK riots, and albeit this is claimed as a victory from rioters, I cannot help but notice that it is really a paradox: the whole story is a consequence of the need for authorities to extensively monitor BBM and the same authorities now ask for a complete lockdown of BBM which might be the ultimate remediation to stop the riots).
In my opinion, this hactivism event can be seen from a double perspective: at first glance this is only the last episode of hactivism, whose actions and impacts are nowadays natural extensions in the fifth virtual domain for wars and revolutions crossing the borders of the real world. But a second deeper analysis shows surprising and, somewhat, unexpected consequences.
The event was a consequence of the attempt by authorities to deprive rioters of their weapons, that is mobile technologies. Said in simple words, we are seeing a kind of Consumerization of Riots (the western world equivalent of what I defined Consumerization of Warfare that is the influence played by consumer technologies, mobile and social networks in primis, for spreading the riots in Middle East). Of course with the obvious difference of scopes and geography.
But if the contemporary use of both mobile technologies, for communicating and coordinating, and Social Media for virally spreading information useful for the cause (tweets like weapons), is a (quite) common and consolidated practice whose primary role has been recognized for the revolutions of Maghreb and Middle East, what is completely new is, for the first time, the impact and the price (to be) paid by the technology vendor, in this case RIM, (in)directly involved in the events. As a matter of fact RIM is suffering heavy aftermaths, which will not likely end here.
Not only the Waterloo based company was hacked with a resounding defacement, with huge consequences in terms of image, but also the brand seriously risks to be negatively associated with rioters, which could lead to further negative impacts for the brand, with possible consequences in terms of sells.
Is this maybe the reason why Twitter refused to shut down the accounts of the London rioters, besides the blog post according to which Tweets must always flow?
P.S. From an Information Security Perspective…
Several Information Security blogs were wondering if hackers managed to post on BlackBerry’s blog because of a software vulnerability, or because one of their administrators had his password cracked. In my opinion several tweets from TeaMp0isoN seems to confirm the first hypothesis:
Try to find out how we got in and patch…
Hacking In The Time of Twitter
So, after announcing an alleged hack to Italian Prison Guards, the threatening tweets anticipating the latest hack, have suddenly disappeared from @LulzSecITALY and replaced by a tweet announcing a day of relax. Of course the doubt if the announcement was a hoax or not remains… But in my opinion this is not the most relevant point of the story.
As a matter of fact this is only the last occurrence of a strange phenomenon that is changing the rules of hacking. In the old world, the attacks were performed silently, and disclosed (if discovered) only several months later and never because they were directly announced by the alleged authors.
What is happening after the example of Anonymous and LulzSec is a kind of “Consumerization of Hacking”, not only because the public availability of tools such as LOIC or TOR has allowed to enroll many “would-be” hackers, but most of all because in these strange days, advertising an attack, too often before performing it, has become even more important than the effect of the attack itself, that is the quality of the data leaked. In this scenario the social media play as a sounding board allowing a viral spreading of the information (which grants more importance to the action itself rather than to its content)
This trend has several consequences:
- Sometimes the attack are advertised even if they are not particularly sophisticated (for instance the massive DD0S campaigns), or the quality of the data stolen is irrelevant;
- Attacks are often anticipated or followed by many claims which make hard to identify the real author. Before or after an attack appears, different alleged authors claim the paternity (consider for instance the case of Italian Cyber Police Hack), also because many attacks of the last days are poor in quality, so that the author does not need to prove its skills.
- Also the quality of hacking is decreasing, as it often happens when something become available for (too) many, most of all because the many lack the necessary skills.
This dos not mean that information security professionals do not need to be worried, but only that the landscape is changing: more attacks, maybe less sophisticated, with an impact more quantitative than qualitative.
Have you ever tried to think to Stuxnet developers announcing with a pastebin their intention to stop the Iranian Nuclear Program, or a tweet announcing the Shady RAT, rather than the Mother of All Breaches disclosed by The Pentagon?
One could say that this attacks were mostly driven by military reasons, nevertheless honestly speaking, at this point I would not be surprised from Cyberwar Tweets announcing sensational operations in the fifth domain of war. Probably they are already between us even if hidden between us: this explains the intention for Department of Defense to invest millions in Twitter Tracking.
Italian Prison Guards Hacked? Yes They were!
Update August 7: Italian Prison Guards, or better to say SAPPE (Sindacato Autonomo Polizia Penitenziaria which stands for Independent Union of Prison Guards) were effectively hacked.
The attack was disclosed 24 hours later with a resounding defacement on the Union Web Site www.sappe.it (currently unavailable). Not only the Homepage has been defaced, but also a message was left on pastebin (translation here).
Original Post on August 5: Read more…
Five Years of Hacking (Updated)
Strange Days for Information Security, you may watch my July 2011 Attacks Chart for noticing how troubled July has been. August promises to be even worse, but this is not the point…
The point is that in an Interview to Vanity Fair, which is not tipically an Information Security Magazine, Dmitri Alperovitch, Vice President of threat research at McAfee reported that, for at least five years, a high-level hacking campaign, dubbed Operation Shady RAT (like Remote Access Tool), has infiltrated the computer systems of national governments, global corporations, nonprofits, and other organizations. This infiltration has made more than 70 victims in 14 countries for what has been defined “Biggest-ever series of cyber attacks uncovered”, an attack so big that, according to Alperovitch: “It’s been really hard to watch the news of this Anonymous and LulzSec stuff, because most of what they do, defacing Web sites and running denial-of-service attacks, is not serious. It’s really just nuisance.”
Victims included government agencies in the United States, Taiwan, South Korea, Vietnam, and Canada, the Olympic committees in three countries, and the International Olympic Committee. Rounding out the list of countries where Shady rat hacked into computer networks: Japan, Switzerland, the United Kingdom, Indonesia, Denmark, Singapore, Hong Kong, Germany, and India. The vast majority of victims—49—were U.S.-based companies, government agencies, and nonprofits. The category most heavily targeted was defense contractors—13 in all.
Courtesy Of McAfee
In addition to the International Olympic Committee, the only other victims that McAfee has publicly named are the World Anti-doping Agency, the United Nations, and ASEAN, the Association of Southeast Asian Nations (whose members are Indonesia, Malaysia, the Philippines, Singapore, Thailand, Brunei, Burma, Cambodia, Laos, and Vietnam).
All the signs of the attack point to China. If confirmed this would be the third attack discovered by McAfee originating from China, after Operation Aurora and the Night Dragon.
One thing is clear: if Vanity Fair is dealing with Information Security, there is really something strange. At least let us hope this is not the sign Information Security is simply becoming a matter of fasion.
Meanwhile, after the Vanity Fair preview, McAfee has released its report on Shady RAT. McAfee was able to gain access to one specific Command & Control server used by the intruders, collecting logs that reveal the full extent of the victim population since mid-2006 when the log collection began. The results are described inside the documents and Curiously China, which was reported by the press as the alleged author of the attack, is never expressely quoted.
Courtesy Of McAfee
Interesting to say, this report raised several doubts on McAfee Competitors. As an example, Sophos, on a dedicated post, considers that there’s nothing particularly surprising in McAfee’s report since companies get often targeted by hackers, who install malware to gain remote access to their computers and data, sometimes driven by motivations for hacking which extend beyond purely financial (for instance, IP theft, economic, political, etc motivations).
Moreover, Sophos wonders why McAfee did not disclose what kind of information was stolen from the targeted organisations, and how many computers at each business were affected.
In any case I noticed with pleasure that, like I did, Sophos was also surprised from the fact the preview was first released on Vanity Fair…
About The Author
Support My Work!
Share:
News
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
Visitors from…
