Update December 26: 2011 is nearly gone and hence, here it is One Year Of Lulz (Part II)
This month I am a little late for the December Cyber Attacks Timeline. In the meantime, I decided to collect on a single table the main Cyber Attacks for this unforgettable year.
In this post I cover the first half (more or less), ranging from January to July 2011. This period has seen the infamous RSA Breach, the huge Sony and Epsilon breaches, the rise and fall of the LulzSec Group and the beginning of the hot summer of Anonymous agsainst the Law Enforcement Agencies and Cyber Contractors. Korea was also affected by a huge breach. The total cost of all the breaches occurred inthis period (computed with Ponemon Institute’s estimates according to which the cost of a single record is around 214$) is more than 25 billion USD.
As usual after the page break you find all the references.
Easily Predictable, the 10th 9/11 anniversary turned out to be a too tempting opportunity for unscrupulous hackers and cyber pranksters. Probably the NBC News Twitter account (and its 130,000 followers) will remember this anniversary eve for a long time after, late on Friday September the 9th, the Twitter account started to tweet false reports of a plane attack on ground zero.
Although there were some misplaced details on the tweets, few minutes later the Company Chief Digital Officer, admitted the account was hacked, asking their followers not to retweet the bogus tweets:
The account was suspended and restored after few minutes, and you will probably remember that the misplaced detail, that is The Script Kiddies who claimed to have hacked the account, are not new to such similar actions since they already hacked the FOX News political account on July, the 4th 2011, announcing a bogus report on Mr. Obama death.
This is not a coincidence, probably the hacker(s), a splinter cell of Anonymous and LulzSec have exploited the same (human?) vulnerability. The NBC News account is tightly controlled and only three NBC News executives have the password.
One of them, Ryan Osborn, the NBC director of social media, said he was monitoring the account at the time and noticed the bogus messages within seconds, noticing that the password to NBC News’ Twitter account had been altered. He immediately contacted Twitter, which shut the account down eight minutes after the tweets appeared.
But there is a further particular: although the warning on easily predictable 9/11 scams, Osborn said he recently received a suspicious email as Hurricane Irene was approaching New York. The email came from an unknown sender with the subject “Hurricane Alert” and the message:
Ryan, You need to get off Twitter immediately and protect your family from the hurricane. That is an order.
Osborn wrote back “I’m sorry. Who is this?” and the sender then replied:
I’m the girl next door
with an attachment. Osborn said he mistakenly clicked on the attachment and it contained a Christmas tree.
Probably that click was fatal and injected a Trojan Keylogger on Osborn’s PC, which was used to steal the password.
The FBI is investigating the NBC News Twitter account hacking but one thing is clear: Twitter accounts are becoming a preferred target for this kind of hacks, they allow to reach a wide audience in few seconds with the double result to quickly (and virally) spread panic among followers and amplify the echo (and visibility) of the attack. Moreover, there is no need to perpetrate huge attacks to compromise the server infrastructure since the entry point is human and human defenses have proven to be extremely much weaker and easy to penetrate (a simple email is enough) than digital defenses.
Last but not least, this is only the latest occurrence of an attack carried on via malicious attachments which are being deployed to carry on complex multilayered attacks (as in case of RSA Breach), or simple questionable pranks (as in case of NBC News or Fox News).
I miss the good old days when the threat via e-mail could be at most spam…
- Hacked NBC News Twitter Account Issues False Reports of Ground Zero Plane Crash (mashable.com)
- FBI probes hacking of NBC News’ Twitter account (msnbc.msn.com)
Update: F-Secure posted in their blog the complete description on how the patient 0 was found: And here it is the infamous “2011 recruitment plan message”.
Have a look to the fake sender: a message from beyond…
Original Post follows:
I am working hard for the August 2011 Cyber Attacks Timeline (stay tuned it is almost ready! Meanwhile you may check the previous ones) while I stumbled upon this very interesting article. Yes, I may say that finally I saw one of the Emails used for spear phishing attacks against RSA customers, using compromised seeds.
As you will probably know everything started on March 17, 2011, when RSA admitted to have been targeted by a sophisticated attack which led to certain information specifically related to RSA’s SecurID two-factor authentication products being subtracted from RSA’s systems.
Of course the sole seed and serial number of the token (the alleged information subtracted) is not enough to carry on a successful attack, so the attacker (whose possible target were presumably RSA customers) had to find a way to get the missing pieces of the puzzle, that is the username and the PIN. And which is the best way? Of course Spear Phishing!
And here the example of a fake spear phishing E-mail targeting one of the One of America’s Most Secret (and Important) Agencies and in the same Time RSA customers:
Likely the same attack vector was utilized against three Contractors (RSA Customers) which were targeted by attacks based on compromised SecurID seeds between April and May (Lockheed Martin, L-3, and Northrop Grumman). What a terrible year for Contractors and DHS related agencies!
By chance today F-Secure revealed to have discovered the patient zero, that is the mail (“2011 Recruitment Plan”) used to convey the APT inside RSA. Someone (who decided to follow the best practices for anomalous e-mails) submitted it to Virus Total, a cloud based service for scanning files, and it looks like that F-Secure antimalware analyst Timo Hirvonen discovered the e-mail message buried in the millions of submissions stored in this crowd-sourced database of malicious or potentially malicious files.
The Pwnie Awards is an annual awards ceremony celebrating the achievements and failures of security researchers and the security community.
The awards are given out once an year. The fifth annual ceremony will take place on Aug 3rd, 2011 in Las Vegas at the BlackHat USA security conference.
In 2011 there will be nine award categories:
- Pwnie for Best Server-Side Bug
- Pwnie for Best Client-Side Bug
- Pwnie for Best Privilege Escalation Bug
- Pwnie for Most Innovative Research
- Pwnie for Lamest Vendor Response
- Pwnie for Best Song
- Pwnie for Most Epic FAIL
- Pwnie for Lifetime Achievement
- Pwnie for Epic Ownage
Do you remember the hacking matrix I posted several days ago, emphasizing impact and innovation as two key factors in hacking? Well, it looks like the panel of the judges did recognized the value of these two factor (together with a certain amount of shallowness in case of Sony).
(Nearly) all the events drawn in the matrix, which happened in 2011 deserved a nominee for the prize, with the exception of Epsilon Data Breach, whose likely category, Most Epic Fail, has been literally monopolized by Sony with 5 nominations.
RSA deserved a nomination as well in the category “Lamest Vendor Response”, while the category Epic Ownage has been monopolized by LulzSec. Even if LulzSec has been appointed only once for “hacking everyone”, there is also a nomination for Anonymous for “hacking HBGary Federal”, probably this is a mistake since it looks clear that HBGary Federal was hacked by the Lulz Boat as well (as also ironically stressed by the LulzSec group itself).
The other two nominations for the Epic Ownage? Bradley Manning and Wikileaks (but I would also have inserted Lady Gaga since a fake Lady Gaga CD was used to perform the leak, and… most of all Stuxnet, who ranked at the top for impact an innovation in this matrix. Stuxnet is considered the first of a new generation of Cyber-weapons even if, so far, no other malware of similar sophistication has been detected (but U.S. Department of Homeland Security fears a modified Stuxnet variant could soon attack U.S. Infrastructure).
Interesting to notice, as suggested by Network World, whoever will win the Epic Ownage prize will be, in theory, a criminal for the law, consequently Law enforcement could be seriously interested to see if anyone actually shows up to this year to accept the prize for Epic Ownage at Black Hat, since all the nominees will face possible criminal charges.
At this link a complete list of the nominations.
Actually I cleaned it up a little bit in order to show only some of the events happened in 2011, which were inserted in the original matrix. As a reference I left some events of the previous years (inserted in the original matrix as well) in order to have a kind of normalization. They include the infamous Ufo Hacker, the Greek Cellphone Caper, and finally the Palin’s Email Hacking.
As you may easily notice, Stuxnet deserves the Top of the Rock for Innovation and Impact. The infamous malware (the terror the nuclear power plants) has divided the infosec community in different factions: those who consider the malware as the first example of next-gen cyber-weapons developed (maybe by Israel and the U.S.) to seriously damage and delay the Iranian nuclear program (whose development took at least ten years of work), or those who consider it the work of an amateur, a script kid, possibly an astronomer with knowledge of the Holy Bible. Regardless of the real origin, because of its huge exploitation of 0-day vulnerabilities (which make it really contagious) the malware has established a new level, and probably a new standard for the information security landscape.
The RSA breach ranks in a considerable position as well. As known, compromised seeds were used to attack several main contractors of U.S. Defense (L-3, at the beginning of April but disclosed at the end of May, Lockheed Martin, on May, the 22nd, and Northrop Grumman on May, the 26th). As I told in one few posts ago I am afraid that also the Mother of All Breaches, that is the breach of 24,000 files by a Contractor, happened in March but disclosed by Pentagon last week, may be somehow related to the RSA Breach. As a consequence of the latter breach, a classified US military weapons system will have to be redesigned. Because of the impact, this breach should also be included in the matrix.
Probably the effects of the Epsilon Data Breach have been underestimated, since it is likely that security concerns, in terms of phishing, for the owners of breached e-mail addresses will last for years.
Obviously the matrix could not miss the infamous Anonymous and LulzSec Hacking groups. Their actions are considered quite simple with a major impact for the Lulz Boat. The Anonymous group is perhaps unfairly considered only for DDoS, and probably the matrix was drawn before the events of the last days such as the Monsanto Hack performed by Anonymous (whose impact is quite huge and denotes a growing interest of the group towards social problems), or the Sun Hacking (at this link some technical details on the hack).
Finally a quick consideration, of course it is a coincidence, but I could not help noticing that the author of the Ufo Hack, Gary McKinnon, has been diagnosed with the Asperger’s Syndrome, a form of Autism. Curiously the same disease has been diagnosed to Ryan Cleary, the alleged LulzSec member arrested in U.K. on June, the 21st. Probably some individuals suffering of autism spectrum disorders establish with machines the links and relationships they are not able to establish with the other human beings. This explains in part why they are so able with hacking…
Again, thanks to Massimo for reporting this really interesting (and enjoying) link.
- The LulzSec Boat is Back (and sails under The SUN) (paulsparrows.wordpress.com)
Today some more details about the Citi breach were revealed and it looks like it is not connected with the RSA breach.
The investigation is still in place, but data collected so far show the kind of attack performed is pretty much more “traditional” then a SecureID clonation: the attackers were able to bypass the perimeter security systems by logging on the site reserved for credit card customers (but no one has explained so far how) were they were able to exploit some vulnerabilities on the Home Banking Web Site.
Once inside, they leapfrogged between the accounts of different Citi customers by inserting vari-ous account numbers into a string of text located in the browser’s address bar. The hackers’ code systems automatically repeated this exercise tens of thousands of times — allowing them to capture the confidential private data.
It looks like application and database security is a curse and a bless for the infosec arena. Although not fully mature in my opinion, it is one of the most promising sectors (in which there are grand maneuvers under way by the vendors), but in the same way, application in(security) has been the indirect reasons for several events this year: Sony (in some of the suffered breaches) and Epsilon have been victims of SQL Injection, and if for a moment we forget the breaches (real leading actors of this 2011) and pass to consider malware, we must necessarily mention LizaMoon which has flooded an impressive number of databases all over the world with SQL Injection, infecting more than 1,500,000 URLs.
Unfortunately these kinds of attacks are not simple exercises in style but are often the first stage of more complex Cybercrime operations. If the stolen Data immediately usable (such as Credit Card Numbers and corresponding CVV codes), they are sold in the Black Market Bazaar. In other circumstances, when the stole information is not enough to gain immediate profit, the targets become victims of tailored spear-phishing campaigns (which could potentially last for several years) aimed to gain the missing pieces of the puzzle (read information) necessary to perform the malicious actions.
That is the reasons why, if not already done, Enterprises need to make application security a key foundation for the development of secure business application and services: educating the developers with secure development guidelines, implementing adequate countermeasures with Web Application/Database Firewall, periodically probing the security level of the infrastructure with Vulnerability Assessment and Penetration Test and, last but not least, performing a constant patching.
This corresponds to implement an application oriented modern form of the Deming Cycle, more poetically summarized by the expression “performing Application Housekeeping”.
- Application Security: What’s Next? (paulsparrows.wordpress.com)
- Citigroup Breach and RSA Breach: A Possible Connection? (paulsparrows.wordpress.com)
Today Citigroup revealed that the company has been victim of a breach of its online banking platform, which might have exposed sensitive data belonging to about hundreds of thousands of Citi customers.
Citigroup owns approximately 21 million card customers, which means, in turn, that data of 200.000 cardholders have been impacted.
According to Sean Kevelighan, head of communications and public affairs for Citigroup: “A limited number – roughly 1 percent – of Citi North America bankcard customers’ account information [such as name, account number and contact information, including e-mail address] was viewed, the customer’s Social Security number, date of birth, card expiration date and card security code [CVV] were not compromised. We are contacting customers whose information was impacted.”
Apparently the credit cards and Social Security Numbers are safe, but this will not prevent the Cardholders from the real risk of scams, phishing and fake phone calls from Citibank or its subsidiaries…
At first glance Citigroup is only the last breach following the notorious similar events occurred to RSA, Sony, Epsilon, so definitively nothing new under the sun of this really troubled (from an infosec perspective) 2012.
However, the more (scant so far) information I read, the stronger the suspicion became that the Citigroup and RSA breaches could somehow be linked.
Of course it is right to emphasize that what follows is a mere personal speculation (I would rather say a personal curiosity) based on the few information unleashed so far.
My concern comes from the fact that, according to the original statement, the breach was originated by an unauthorized access to the systems of Citi Account Online discovered during routine monitoring in early May. Citigroup is one of the main RSA customers, and most of all has been one of the first (together with Bank of America, JPMorgan Chase, Wells Fargo) to immediately ask to replace the tokens as soon as RSA declared the direct involvement of compromised SecurIDs in the Lockheed Martin breach (and consequently offered to replace SecurID tokens). Since I am not a Citigroup Customer, I do not know how the Citi Account Online Service works (in this moment the site is not completely visible, at least from Italy, but from what I have understood OTP is used only for transactions), so I cannot definitively trace a direct a connection between the unauthorized access and the use of compromised seeds (OK this is the weak point of my theory J), nevertheless if the coincidence of factors appears quite strange. For sure, to compromise data of 200.000 users it is likely (I would say obvious) that the attackers exploited other vulnerabilities.
Also the timeline of the breach is clearly noteworthy: it looks like the Citigroup breach happened at the early May, nevertheless the customers were notified Sunday JUne the 5th : said in few words, a month later. Maybe Citigroup has decided not to warn its customers of too many breaches at the same time (I wonder how many owners of SecurID or PSN members there are between them). Anyway few hours after the notification to Citigroup customers, RSA would have officially announced the evidence of a direct connection between its breach and the one to Lockheed Martin (and the consequent decision to replace the tokens); equally curiously, according to RSA, this evidence was obtained on June the 2nd, that is approximately three days before the notification by Citigroup to replace the cards to its customers. It is possible (but I repeat this is only a mere personal speculation) that at the moment of notifying its customers, Citigroup was already aware of the direct involvement of the compromised seeds on the Lockheed Martin affair (if I were in RSA’s shoes I would have immediately advised the affected customers), and probably also aware of the RSA offer to replace the compromised tokens. Consequently at that point the Bank realized the true extent of the breach and decided it was the right moment to take adequate countermeasures, first of all notifying the customers, and then finally replacing the tokens, but only after the official RSA statement.
Why Citigroup did not decide to replace the tokens before? The answer is pretty much simple: RSA security breach might cost banks $100 million, so who knows what would have been the cost if Banks should have purchased the new tokens from their own?
In the coming days I will try to follow developments closely, since I am really curious to see it a real involvement of compromised seeds will be identified. For sure we will have to face other similar events in the near future, and I do not exclude other “sons of a (RSA) breach” to come (or better to be unleashed).
- Citigroup Admits Being Hacked in May: Coy About Extent of Impact (spectrum.ieee.org)
- Citigroup Hack of the Day (geeks.thedailywh.at)
- Citigroup Helpfully Notifies Customers It Was Hacked a Month Ago [Hackers] (gawker.com)
- Citigroup hacked: data for 200,000 or more US Citibank customers breached (boingboing.net)
- Citigroup breach exposes data on 210,000 customers (infoworld.com)
Another crucial episode in the affair of the RSA Breach. In a letter published yesterday by mean of the Executive Chairman Art Coviello, letter that will probably go into the annals of computer security, RSA has confirmed that information taken in March had been used as an element of an attempted broader attack on Lockheed Martin. This evidence was obtained, according to the company, on June the 2nd, and so far, the Lockeed Martin attack is the only one, among those (alleged) aimed to other contractors, which has been confirmed directly related to the use of compromised seeds.
Finally this letter indirectly confirms that, given the stolen information, SecureID tokens have been comprimised (but this was implicitly said in the original letters as well):
While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack
and moreover, as was quite clear from the beginning, RSA believes that certain characteristics of the original attack indicated that the perpetrator’s most likely motive was to obtain an element of security information to be used to target defense secrets and related IP. For this reason, the Company worked with government agencies and companies in the defense sector to replace their tokens on an accelerated timetable as an additional precautionary measure.
Another interesting (and shareable) point of the letter is the fact that the unprecedented wave of cyber attacks against Epsilon, Sony, Google, PBS, and Nintendo have commanded widespread public attention. Albeit totally unrelated to the breach at RSA, this events, and this is a really important point, delineate a changing threat landscape and hence have heightened public awareness and customer concern: a landscape in which Cybercrime and Cyberwar dangerously overlap.
As a result, the Company is expanding its security remediation program including two offers for assuring SecureID users’ confidence:
- An offer to replace SecurID tokens for customers with concentrated user bases typically focused on protecting intellectual property and corporate networks.
- An offer to implement risk-based authentication strategies for consumer-focused customers with a large, dispersed user base, typically focused on protecting web-based financial transactions.
Is this a new dawning age for two-factors authentication?
With the alleged Northrop Grumman Cyber-attack, we have experienced three attempts, unleashed in few days, to leverage the compromised RSA seeds in order to steal data from U.S. Contractors.
Albeit the above mentioned events are characterized by two evident points in common: all the targeted companies are U.S. Defense Contractors, and all of them use RSA tokens; there is a point that seems confusing, and it is the timeline with which the attacks were carried out and subsequently unleashed (we will see that the two are very different and somehow confusing).
Analyzing the timeline: the first attack unleashed was the one led against Martin Lockheed. According to the sources, remote access to internal resources was disabled late on Sunday, May, the 22nd, just immediately after the attack was detected. The first details, although the target was not immediately revealed, were given few days after, on May, the 26th.
The second cyber-attack targeted L-3 and was unleashed few days after , on May, the 31st. According to the information revealed, the event occurred at the beginning of April (more exactly on April, the 6th, that is more than a month and a half before) and described into an e-mail sent by an executive to the 5000 group’s employees belonging to the division affected. Nothing strange apparently: the late disclosure was unintended for the target company and probably a consequence of the huge echo raised after the Lockheed Martin affair which led an anonymous source to reveal details to Wired.
On June, the 2nd, an alleged third attempt to attack a U.S. Defense Contractor using compromised seeds was unleashed, this time against Northrop Grumman. According to the revealed timeline, this attack was held on May, the 26th, that is nearly in contemporary (4 days after) the event of Lockheed Martin.
So definitively although the three attacks were revealed nearly in contemporary, only two of them were (i.e. the ones towards Lockheed Martin and Northrop Grumman), while the second one, to L-3 happened a couple of weeks after the RSA Breach and almost one month and half before the others. This sounds not clear to me.
If I had been in the attackers’ shoes, I would have attacked all at once in order to prevent the spreading of the information, and definitively to avoid the possibility for the others victims to organize themselves, for instance immediately replacing the tokens as made by Raytheon immediately after the RSA Breach.
Let us suppose (as it seems clear) that the alleged theft of the seeds was only the first step of the “perfect plan” to attack the U.S. Defense contractors, let us also suppose that the attackers took some time to obtain the missing pieces of the puzzle, that is to link the tokens to users, and eventually to obtain the PINs, by mean of keylogger trojans or phishing e-mails as suggested by by Rick Moy, president of NSS Labs. Do you really think that they would have left one month and a half between one attack and the other? Honestly speaking I do not think so. Of course I can imagine that obtaining all the PINs or user to token mappings at once was simply impossible, for reasons of time because it is impossible that all the victims to a specific targeted phishing campaign could reply simultaneously, but also because a massive “vertical” campaign of phishing targeting all the U.S. Contractors (and aimed to obtain information about RSA tokens) would have probably raised too much attention, so that I do not exclude that the necessary information to perform the attack had to be obtained with “evasion” techniques.
Nevertheless, provided the above depicted scenario is real, even if it is unlikely the attackers could attack all the target simultaneously, one month and half between one wave and the other seems actually too much: I doubt they already knew that the information concerning the first alleged attack to L-3 would have been revealed only many days after, of course it is easy to predict that L-3 and the eventual other victims would not have been happy to do it immediately after; but if they really had the perfect plan, relying on a similar occurrence would have been a huge hazard capable to put at risk the entire operation.
I seriously fear the truth is different. Of course this is a mere personal speculation, but I am more and more considering the hypothesis that a first wave of attacks was really held at the beginning of April (more or less in contemporary with L-3), that is after a short interval the original breach, short enough to catch the most part of the victims unprepared, most of all in case of very big companies. The consequence could be that many others attacks have not been revealed or simply were not detected at all, since, as I said a couple of days ago:
I wonder if military contractors are really the only targets or if they have been the only ones capable to detect the attempts because of their strict security protocols and policies.
How to explain the alleged second wave of May? It might be that the attackers have tried once, since the result was successful (it is not clear if they were able to steal sensitive data, but for sure the information was not immediately revealed) so they decided to try a second and a third chance (and who knows how many others). Otherwise, it might be that after the first wave they decided to sell the seeds on the black market (probably at a lower price since at that point the seeds would have been considered a good of second choice), and this could explain the late attack to Lockheed Martin and Northrop Grumman (and who knows who else). In this case I am afraid we will see many other attacks, unless other potential targets (that so far refused to comment the events) will not decide to follow the example of Raytheon and replace the tokens.