About these ads

Archive

Posts Tagged ‘Mossad’

16-31 March 2013 Cyber Attacks Timeline

First part here: 1-15 March 2013 Cyber Attacks Timeline

March is gone and hence it is time to analyze the events that characterized the past month.

Two events in particular gained the first pages of the magazines: the wiper malware in Korea and the DDoS attack against Spamhaus that, maybe exaggerating, has been defined the “biggest attack in history”.

But these were not the only noticeable attacks in this second part of the month: the Operation Ababil of the Izz ad-din al-Qassam Cyber Fighters against U.S. banks achieved a new phase, constantly disrupting the connectivity of several high profile financial targets, including Chase, USBank, etc.; Telenor admitted to have been hacked by high-tech spies emptying the content of executives’ personal computers, and also the Anonymous claimed to have breached the Mossad, despite there are many doubts about this last attack.

Other important events include a breach against MTV Taiwan (600,000 accounts), McDonald’s (200,000 accounts), the Turkish Ministry Of Economy (96,000 accounts), and Renault Colombia (31,000 accounts leaked).

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 March 2013 Cyber Attacks Timeline Read more…

About these ads
Categories: Cyber Attacks Timeline, Security Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Middle East Cyber War Timeline (Part 5)

February 19, 2012 1 comment

Click here for the Middle East Cyber War Master Index with the Complete Timeline.

This week of Cyber War on the Middle East front, has shown a slight change on the Cyber Conflict trend. For the first time since January, psyops have deserved a primary role, maybe on the wake of the video released by the Anonymous against Israel one week ago. Not only the Jerusalem Post calls the video into question, but also argues that it may have been forged by Iran, identifying a state sponsored impersonation behind the entry of Anonymous in this cyber war.

But this has not been the only psyops event as an alleged message from Mossad to the Anonymous has appeared on pastebin, whose beginning sounds like a dark warning: If you want to be a hero start with saving your own lives. Although there are many doubts on its truthfulness, it deserves a particular attention since outlines a new age on psyops, what I call “pastebin psyops”.

But a war is not made only of psyops, so this week has also seen more hostile actions, among which the most remarkable one has been the leak of 300,000 accounts from Israeli Ministry of Construction and Housing. This action had been preannounced by a wave of attacks on primary Israeli sites (which targeted also the PM site), and most of all, has been carried on by 0xOmar, the absolute initiator of this cyber conflict.

Palestine has been targeted as well, and it is really interesting to read under this perspective a statement by Ammar al-Ikir, the head of Paltel, the Palestinian telecommunications provider according to whom cyber attacks on Palestinian websites and internet servers have escalated since Palestine joined UNESCO.

On the Iranian front chronicle report of a failed cyber attacks againstPress TV, Iran’s English-language 24-hour news channel and most of all of a controversial statement by Gholam Reza Jalali, a senior Iranian military official in charge of head of the Iranian Cyber Intelligence, according to whom the country’s nuclear facilities have finally been made immune to cyber attacks. And it is not a coincidence that in this week Iran has kicked off the first national conference on Cyber Defense. A matter that deserves a special attention by Tehran because of the growing number of attacks on Iran’s cyber space by US and Israel. On the other hand, Israel did a similar move one month ago, at very early stage of the cyber conflict.

Read more…

November 2011 Cyber Attacks Timeline (Part I)

November 17, 2011 5 comments

Update 12/01/2011: November Cyber Attacks Timeline (Part II)

This first half of November has been very hard for Steam. The Valve Online Gaming Platform suffered a security breach putting at risk a potential sample of 37 million of users and hence wins the crown for the Major Breach of the First Half of November.

Also a sportswear giant like Adidas fell among the victims of cybercriminals, with a “sophisticated attack” targeting 500,000 users.

This month was also hot for the Cold Finland which has suffered two security breaches involving more than 30,000 users (a third breach also happened on November, the 16th, affecting 16,000 users but of course will be reported in the next report).

Two other CAs (KPN and Digicert Sdn Bhd Malaysia, not to be confused with Digicert US-based CA) were compromised. Also F-secure discovered a sample of malware signed with a valid certificate stolen from a Malasyan company.

On a larger scale, after 2 years of hunt, FBI uncovered a huge Botnet in Estonia, which stole $14 million from 4 million users worldwide, while on the other side of the Globe, Brazilian ISPS were targeted by a massive DNS Poisoning attack.

Not even Facebook was safe this month, whose (too) many users were targeted with a malware posting pornographic images on their wall exploiting an Internet Explorer Vulnerability.

As far as hactivism is concerned, the political events in the real world had a predictable echo in the Cyber space, with an attack to Palestine the day after the nation was admitted as a full member of UNESCO.

As a retaliation, some Israeli Government web sites were targeted with a wave of DDoS attacks by the infamous Anonymous hacking group. In any case the Anonymous were active also in other Cyberwar fronts acting a couple of defacements and DDoS (in one case they targeted the Muslim Brotherhood) and were also the authors to one of the two attacks in Finland (the one towards a right-wind party).

A group of Hackers called TeaMp0isoN claimed to have hacked more than 150 Email Id’s of International Foreign Governments even if this statement is controversial.

What is not controversial is the Cyberwar declared against Mexico which was targeted, in November, by a massive waves of Cyber Attacks.

Besides these noticeable events, the month was characterized by many other minor attacks and dumps among which, particularly noticeable are: the attacks to a couple of banks (DDoS and defacements) and Universities (UCLA and Standford hit by data breaches), and the Fox Business Twitter Account Hacking (Oops they did it again!).

The month ends with the first example of malware targeting ambulance.

Please notice that I decided henceforth not to insert attacks targeting a limited amount of users and most of all, claimed without clear evidence: in this month I discovered a claimed fake attack to Italian Police announced recycling old data.

  1. http://www.guardian.co.uk/world/2011/nov/01/palestinians-hit-cyber-attack-unesco
  2. http://www.cyberwarnews.info/2011/11/02/dump-of-steam-accounts/
  3. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf
  4. http://thehackernews.com/2011/11/fraud-communities-owned-and-exposed-by.html
  5. http://www.cyberwarnews.info/2011/11/03/opdarknet-official-and-last-release/
  6. http://www.cyberwarnews.info/2011/11/03/accounts-dumped-from-hiphopinstrumental-net/
  7. http://www.cyberwarnews.info/2011/11/03/peru-government-websites-defaced-by-challenges-hackers/
  8. http://nakedsecurity.sophos.com/2011/11/03/another-certificate-authority-issues-dangerous-certficates/
  9. http://www.cyberwarnews.info/2011/11/04/bayareaconnection-net-defaced/
  10. http://www.cyberwarnews.info/2011/11/04/yet-another-pointless-account-dump-hundreds-dumped-from-www-jjs2-com/
  11. http://threatpost.com/en_us/blogs/another-dutch-ca-kpn-stops-issuing-certificates-after-finding-ddos-tool-server-110411
  12. http://thehackernews.com/2011/11/capitalone-bank-taken-down-by-anonymous.html
  13. http://www.networkworld.com/news/2011/110411-hacker-selling-access-to-compromised-252771.html?source=nww_rss
  14. http://www.phiprivacy.net/?p=8227
  15. http://thehackernews.com/2011/11/anonymous-attack-on-israeli-government.html
  16. http://www.itworld.com/security/222033/fake-threat-against-facebook-dwarfs-anonymous-real-attacks-israel-finland-portugal
  17. http://pplware.sapo.pt/informacao/site-freeport-pt-foi-atacado-entre-outros/
  18. http://www.databreaches.net/?p=21359
  19. http://www.itworld.com/security/222033/fake-threat-against-facebook-dwarfs-anonymous-real-attacks-israel-finland-portugal
  20. http://www.yomiuri.co.jp/dy/national/T111105002386.htm
  21. http://www.cyberwarnews.info/2011/11/08/massive-amount-of-accounts-dumped-from-adidas-com/
  22. http://www.theregister.co.uk/2011/11/07/adidas_hack_attack/
  23. http://www.cyberwarnews.info/2011/11/08/massive-amount-of-accounts-dumped-from-adidas-com/
  24. http://thehackernews.com/2011/11/international-foreign-government-e.html
  25. http://www.theregister.co.uk/2011/11/09/teamp0ison_publishes_stupid_password_list/
  26. http://news.softpedia.com/news/16-000-Finns-Affected-by-Data-Breach-232851.shtml
  27. http://nakedsecurity.sophos.com/2011/11/08/anonymous-attacks-el-salvadoran-sites/
  28. http://www.smh.com.au/business/privacy-of-millions-at-mercy-of-a-usb-device-20111107-1n3wm.html
  29. http://thehackernews.com/2011/11/ump-french-political-party-got-hacked.html
  30. http://www.cyberwarnews.info/2011/11/08/premierleaguepool-co-uk-accounts-dumped-by-sen/
  31. http://www.cyberwarnews.info/2011/11/08/60k-accounts-dumped-from-ohmedia-by-teamswastika/
  32. http://www.cyberwarnews.info/2011/11/08/dump-of-accounts-from-beachvolley-se/
  33. http://www.cyberwarnews.info/2011/11/08/khadraglass-com-hacked-and-accounts-dumped-by-inj3ct0r/
  34. http://www.cyberwarnews.info/2011/11/09/scamming-email-account-dumpers-are-surfacing-50k-french-accounts-dumped/
  35. http://thehackernews.com/2011/11/possible-credit-card-theft-in-steam.html
  36. http://www.fbi.gov/news/stories/2011/november/malware_110911/malware_110911
  37. http://www.theregister.co.uk/2011/11/10/it_manager_charges/
  38. http://thehackernews.com/2011/11/bangladesh-supreme-court-website-hacked.html
  39. https://twitter.com/#!/igetroot/status/134865652543520768
  40. http://thehackernews.com/2011/11/operation-brotherhood-shutdown-by.html
  41. http://nakedsecurity.sophos.com/2011/11/14/ambulance-service-disrupted-by-computer-virus-infection/
  42. http://www.cyberwarnews.info/2011/11/12/ucla-department-of-psychology-hacked-by-inj3ct0r/
  43. http://www.ehackingnews.com/2011/11/social-network-site-findfriendzcom.html
  44. http://www.cyberwarnews.info/2011/11/13/dump-of-information-by-inj3ct0r/
  45. http://www.f-secure.com/weblog/archives/00002269.html
  46. http://www.cyberwarnews.info/2011/11/14/dump-of-accounts-from-congress-of-sonora/
  47. http://www.cyberwarnews.info/2011/11/14/2-more-government-dumps-by-metalsoft-team/
  48. http://www.cyberwarnews.info/2011/11/14/another-big-dump-of-accounts-from-sec404-mexican-hackers/
  49. http://www.cyberwarnews.info/2011/11/14/another-mexican-government-congress-hacked-canaldelcongreso-gob-mx/
  50. http://www.cyberwarnews.info/2011/11/14/dump-of-data-from-another-mexican-congress-sinaloa-state-congress/
  51. http://www.cyberwarnews.info/2011/11/14/ministry-of-economy-mexico-hacked-by-sec404/
  52. http://www.cyberwarnews.info/2011/11/14/unit-of-transparency-and-access-to-public-information-website-hacked/
  53. http://www.cyberwarnews.info/2011/11/14/national-commission-of-physical-culture-and-sport-hacked-and-accounts-leaked/
  54. http://nakedsecurity.sophos.com/2011/11/14/hacked-sky-news-twitter-account-james-murdoch-arrested/
  55. http://news.softpedia.com/news/Anonymous-Attacks-Anonymous-For-Being-Trolls-234949.shtml
  56. http://nakedsecurity.sophos.com/2011/11/16/facebook-explains-pornographic-shock-spam-hints-at-browser-vulnerability/

Virus e Servizi Segreti (Ancora Su Stuxnet)

January 16, 2011 2 comments

Il complesso di Dimona (Foto Getty Images)

E’ di questa mattina la notizia, secondo il New York Times, che il famigerato malware Stuxnet, il virus delle centrali nucleari, sarebbe stato sviluppato da un team composto da Israeliani e Americani (con la collaborazione indiretta degli ingegneri tedeschi di Siemens) presso il complesso israleliano di Dimona, nel bel mezzo del deserto del Negev.

Lo sviluppo di questo terribile malware sarebbe partito nel 2009. Il virus, assurto alla ribalta nel 2010, ha messo in ginocchio un quinto delle centrali nuclerari iraniane ed avrebbe raggiunto parzialmente il suo scopo (molte centrifughe sono state arrestate prima dell’insorgere di danni irreversibili) secondo il quotidiano d’Oltreoceano, riuscendo però a tardare la realizzazione della bomba sino al 2015.

Stuxnet, che prefigura il modello di infezione informatica Advanced Persistent Threat, che nel 2011 turberà i nostri sogni, aveva da subito attirato l’attenzione dei ricercatori di tutto il mondo sia per la sua complessità tecnica (7 vettori di infezione, l’utilizzo massiccio di vulnerabilità 0-day, la possibilità di falsificare certificati ed infine la conoscenza approfondita della tecnologia Siemens relativa alle centrifughe colpite), sia per i presunti richiami all’Antico Testamento più o meno nascosti all’interno del codice.

La complessità alla base del malware è presumibilmente dovuta al fatto che all’inizio del 2008, Siemens avrebbe collaborato con uno dei principali laboratori statunitensi, in Idaho, al fine di identificare le vulnerabilità dei computer che controllano le macchine industriali vendute da Siemens in tutto il mondo. Macchine Industriali che l’Intelligence d’Oltreoceano aveva identificato essere componenti chiave degli impianti di arricchimento dell’Uranio iraniani.

Siemens sostiene comunque che il programma (confermato dall’Idaho National Laboratory) era parte delle attività di routine volte a rendere sicuri dai Cyber-attacchi i propri sistemi che presiedono alle Infrastrutture Critiche, e ad ogni modo non avrebbe dato all’Idaho National Laboratory, parte del Dipartimento dell’Energia responsabile per gli armamenti nucleari USA, la possibilità di identificare i buchi del sistema utilizzati da Stuxnet nel 2010. I risultati sono stati riassunti in questa presentazione mostrata a luglio 2008 al Siemens Automation Summit presso Chicago. Il laboratorio americano, interrogato sulla questione, si è difeso indicando che la presentazione, sebbene contenesse schemi dettagliati, non mostrava come utilizzare le vulnerabilità, rifiutandosi nel contempo di fornire indicazioni relativamente agli aspetti classificati delle attività effettuate congiuntamente con Siemens. Siemens, dal canto suo, ha commentato la nitizia indicando che la presentazione non recava informazioni relative all’ubicazione delle centrifughe. Sta di fatto che la presentazione è recentamente scomparsa dal proprio sito Web.

L’origine politica del progetto partirebbe dagli ultimi mesi dell’Amministrazione Bush, che a gennaio 2009 avrebbe autorizzato (secondo il NYT) un programma nascosto per sabotare i sistemi elettronici ed informatici del complesso iraniano di Natanz, il principale centro di arricchimento dell’Uranio. Al suo insediamento, il Presidente Obama, appena informato del programma, ne avrebbe accelerato lo sviluppo secondo fonti dell’Amministrazione vicine agli strateghi responsabili dei piani volti a contrastare la strategia nucleare iraniana.

Naturalmente gli israeliani, preoccupati dai pericolosi sviluppi della situazione iraniana, non si lasciarono sfuggire l’occasione sviluppando una strategia di contrasto della minaccia iraniana congiunta con gli USA e differente da quella militare sostenuta sino ad allora.

Stuxnet o non Stuxnet, recentemente sia il Segretario di Stato Americano Hilary Clinton, sia il direttore uscente del Mossad, Meir Dagan, hanno confermato separatamente (rispettivamente il 10 e 7 gennaio) la propria convinzione di un ritardo (o meglio di un arretramento di alcuni anni) nei piani di sviluppo nucleare dell’Iran. Ma mentre la signora Clinton ha fatto riferimento alle sanzioni pilotate dagli USA, sanzioni che avrebbero reso difficile all’Iran procurarsi i componenti, e più in generale commerciare con altri paesi della comunità internazionale; il Signor Dagan ha annunciato al Knesset (il parlamento isreaeliano) l’improvviso insorgere di difficoltà tecnologiche in grado di ritardare la preparazione di una bomba iraniana sino al 2015. Da notare che sino ad allora gli israeliani erano stati fermamente convinti dello stato avanzato di realizzazione del programma nucleare iraniano e che il Mossad è stato accusato dall’Iran di essere la longa manus dietro agli attentati in cui è rimasto ucciso Majid Shahriari, scienziato nucleare iraniano e Fereydoon Abbasi, altro scienzato nucleare, è rimasto ferito.

Gli argomenti della spy story ci sono tutti: CIA, Mossad, lo spettro della Guerra Nucleare, il tutto condito con un pizzico di malware, Cyberwar e… perchè no di Sacre Scritture. Sarà davvero l’ultima puntata della storia?

Follow

Get every new post delivered to your Inbox.

Join 3,042 other followers