Archive
The Alphabet of Cyber Crime from APT to Zeus
If you need to know what Cyber Crime is but you are bored and fed up with the too many information security terms, loosing yourself among the acronyms, you have stumbled upon the correct place. I have just compiled a very special alphabet which collects the terms related to Cybercrime. Forgive me for some “poetic license” and enjoy this half-serious list.
A like APT
Yes, the Advanced Persistent Threats have been the undisputed protagonists of 2011. An APT is essentially an attack carried on with different vectors, different stages and on a distributed time windows (yes, it Persistent). APT are behind the most remarkable events of 2011 such as the RSA Breach, Stuxnet, and so on…
B like Botnet
Botnet are networks of compromised machines that are used by cybercriminals to perpetrate their malicious action. Tipically a compromised machine becomes part of a botnet where the master distributes the commands from a C&C Server. Command may include the theft of information or the attack to other machines.
C like Crime-As-A-Service
The last frontier of Cybercrime: why developing costly malware if you can find a wide offer of customizable malware on the black market offering help desk and support services?
D like DLP
Data Leackage (or Lost) prevention is a suite of technologies that may help organization to counter the theft of information by preventing misuse or leak of data while they are in use at the endpoint (DIU), in transit on the network (DIM), or simply it is an aggregated Dark Matter on the corporate servers (DAR) that needs to be indexed and cataloged (and possibly classified and assessed).
January 2012 Cyber Attacks Timeline (Part 2)
Click here for part 1.
The second half of January is gone, and it is undoubtely clear that this month has been characterized by hacktivism and will be remembered for the Mega Upload shutdown. Its direct and indirect aftermaths led to an unprecedented wave of cyber attacks in terms of LOIC-Based DDoS (with a brand new self service approach we will need to get used to), defacements and more hacking initiatives against several Governments and the EU Parliament, all perpetrated under the common umbrella of the opposition to SOPA, PIPA and ACTA. These attacks overshadowed another important Cyber Event: the Middle East Cyberwar (which for the sake of clarity deserved a dedicated series of posts, here Part I and Part II) and several other major breaches (above all Dreamhost and New York State Electric & Gas and Rochester Gas & Electric).
Chronicles also reports a cyber attack to railways, several cyber attacks to universities, a preferred target, and also of a bank robbery in South Africa which allowed the attackers to steal $6.7 million.
Do you think that cyber attacks in this month crossed the line and the Cyber Chessboard will not be the same anymore? It may be, meanwhile do not forget to follow @paulsparrows to get the latest timelines and feel free to support and improve my work with suggeastions and other meaningful events I eventually forgot to mention.
One Year Of Lulz (Part II)
Christmas has just gone and here it is my personal way to wish you a Happy New Year: the second part of my personal chart (first part here) of Main 2011 Cyber Attacks covering the time window from August to November 2011 (December is not yet finished, and featuring remarkable events, so expect an update very soon). This memorable year is nearly over and is time, if you feel nostalgic, to scroll down the second part of the list to review the main Cyber Events that contributed, in my opinion, to change the landscape and the rules of the (information security) game. Many events in this period among whom, IMHO, the most noticeable is the one carried on against Diginotar. Since then our trust in conventional authentication models is not (and will not be) the same anymore.
Of course this is my personal selection. Suggestions are well accepted and if you need more details about the cyber events in 2011, feel free to consult my 2011 Cyber Attacks Master Index. As usual after the page break you find all the references…
October 2011 Cyber Attacks Timeline (Part I)
October has come and here it is, also for this month, the first part of my Cyber Attacks Timeline covering the cyber events occurred in the first half of the current month.
Three events in particular have marked this month: The German Trojan R2-D2 (that is raising many questions and concerns inside the infosec community), the keylogger hitting U.S. Drones and a new cyber attack to Sony involving this time “only” 93,000 accounts (oops! They did it again).
Except for a couple of isolated occurrences (in Austria and UK), the Cyber Attacks by Anonymous and Antisec had a break, maybe because hacktivism efforts are being focused on the #OccupyWallStreet operation that is rapidly spreading all over the World (I wonder why in here in Rome yesterday it has not been possible to have peaceful protests as happened in all the other Capitals). Besides, albeit not directly related with Anonymous, several Syrian log files were leaked showing the control of the Government on the Internet.
Other events of the month: a couple of fashion related websites were hacked, the Cyber-Guerrilla between India and Pakistan was particularly active with the cyber armies of the two nations facing themselves in the cyber space with continual mutual defacements, @SwichSmoke was also particularly active against Venezuela Government Web Sites. Other “minor” leaks were performed by @FailRoot and @ThEhAcKeR12 but one of the victims of the latter was Camber Corporation, an U.S. Contractor.
Anyway, Camber Corporation was not the only targeted Contractor, also Raytheon Corporation (a survivor of the RSA Breach) was targeted with a cloud based spear-phishing campaign, again the attack was thwarted but, in my opinion, has deserved a mention as well. Chronicles also reports of a claimed hack to Infragard (again).
Moreover the aftermaths of the RSA breach are not completely over: this month the security firm’s CEO claimed that a couple of different Cyber Crews, under the flag of an enemy nation (and the suspects were immediately directed to China), are behind the Cyber Attack in March and acted to perform it.
But a very special mention for this month (and the consequent lowly desiderable prize), is undoubtedly deserved by Mr. Oliver Letwin, Her Majesty’s Cabinet Minister, who was caught by The Daily Mirror in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. Security, logical and physical, may have many unpredictable implications…
From a technical point of view SQLi and defacements were the most used lethal weapons for this month, even if a massive ASP.NET based attack, targeting 300,000 web sites, is also worth mentioning.
This Timeline was compiled with Useful Resources by:
- Cyber War News
- DATALOSSdb
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- Softpedia
- The Hacker News
- Threatpost
And my inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
Last but not least: you may find all the timelines for 2011 in my Master Index. Enjoy the list(s) and share and retweet to encourage me to keep it up2date!
| Date | Author | Description | Organization | Attack |
| Oct 1 |  |
NeatStuffs hacks filmradar.com a movie review and information site/community and releases on Mediafire a 6mb txt file containing 95167 accounts with hashed passwords. Estimated cost of the breach is $ 20,365,738. |
 |
SQLi? |
| Oct 2 |  |
Venezuela National Statistics Institute
SwichSmoke crew hacks the Venezuela National Statistics Insitute during the 2011 Census. |
 |
SQLi? |
| Oct 2 |
 |
Camber Corporation (US Contractor)
Once again a US Government contractor is target of cyber crime. This time is the turn of Camber Corporation, targeted by a small hack by @ThEhAcKeR12, which releases 3 admin accounts with encrypted passwords. and admin full name. |
 |
? |
| Oct 2 |
|
wrestlegame.co.uk
Again @ThEhAcKeR12, this time the crew dumps 1500+ accounts (in encrypted format) and a database from wrestlegame.co.uk. Estimated cost of the breach is around $321,000. |
wrestlegame | SQLi? |
| Oct 2 |
A student arrested few days later |
Thailand Prime Minister
Thailand’s Prime Minister, Yingluck Shinawatra, had her Twitter account hacked flooding her followers with a stream of messages criticising her leadership with statements like this: The final post read: “If she can’t even protect her own Twitter account, how can she protect the country?“ |
 |
Account Hacking |
| Oct 4 |  |
Austrian Economy Chamber (WKO) WKO confirms that its webserver was infiltrated by unidentified cyber criminals. More than 6,000 data sets of customers of the chamber were published on the internet. Although Anonymous Austria leaked the data, they stressed they had not carried out the attack on WKO themselves, but had been provided with the records by someone else, adding that the security leak was exposed by using online search engine Google. Estimated cost of the Breach is around $1,284,000. |
 |
Vulnerability on The Target Platform |
| Oct 5 | |
@ThEhAcKeR12 does not stop here and dumps 3300 accounts from funniestvideosonline.com and are all encrypted passwords. Estimated cost of the Breach is around $706,200. |
 |
SQLi? |
| Oct 5 |  |
www.xvidonline.com @FailRoot hacks and leaks several accounts from www.xvidonline.com putting the websits offline. |
xvidonline.com | SQLi? |
| Oct 5 | Optik Fiber | Gmail (Claimed) Optik Fiber releases several gmail accounts claimed to have been hacked via a known security flaw in gmail. It is not sure if this is real or not but it is meaningful as well of the global level of (in)security, real or psychological. |
 |
Known Security Flaw in Gmail (N/A) |
| Oct 5 | ? | Fashion TV India Unknown hackers hacks Fashion TV India with the injection tool havij and obtain a list of accounts dumping usernames and passwords in clear text. |
 |
SQLi via havij |
| Oct 6 |  |
Syrian Internet Log Files
Internet activists from Telecomix release 54 GB of log files allegedly created by Syrian internet censors between 22 July and 5 August 2011. The data were found on a third party server. |
 |
? |
| Oct 7 |
|
An Australian University website that lists jobs is hacked by @BlackHatGhosts and has data dumped, included user logins and passwords. |
 |
SQLi? |
| Oct 7 | Several Hackers |
Department of Public Enterprises South Africa Department of Public Enterprises, south Africa is hacked and had its database dumped |
 |
SQLi |
| Oct 7 | Same authors above |
Ministry of Culture and Tourism, Republic of Indonesia Another day, another government website hacked, (and its data leaked). |
 |
SQLi |
| Oct 7 | ? | University Of Georgia The University of Georgia discovers a data file on a publicly available Web server that contained sensitive personnel information on 18,931 members of the faculty and staff employed at the institution in 2002. The file included the social security number, name, date of birth, date of employment, sex, race, home phone number and home address of individuals employed at UGA in 2002. Estimatec Cost of the Breach is around $4,051,234. |
 |
Internal Accidental Error |
| Oct 8 | ? |
U.S. Military Drones
Wired reports that a computer virus has infected Predator drones and Reaper drones, logging pilots’ keystroke during their fly missions over Afghanistan and other warzones. The virus was detected nearly two weeks ago at the Ground Control System (GCS) at Creech Air Force Base in Nevada and has not prevented drones from flying their missions, showing an unexpected strength so that multiple efforts were necessary to remove it from Creech’s computers. |
 |
USB Stick? |
| Oct 8 | German law Author. and Customs Dep. |
German Citizens A very strange (un)lawful Cyber Attack, against German Citizens. Chaos Computer Club discloses a “state malware”: a backdoor Trojan horse capable of spying on online activity and recording Skype internet calls. They declare the malware is used by the German police force. The malware was allegedly installed onto the computer as it passed through customs control at Munich Airport. |
 |
Troian Horse |
| Oct 9 | Turkish Energy Team |
Several Government Websites
Turkish Energy Team performs (and keeps on to perform) a massive defacement against several governments websites (in certain cases some sub domains). The list (in continuous growth) is published on Zone-H. |
 |
Defacement |
| Oct 9 | MCA-CRB |
Other Government Websites
Different Crew, same result: a massive defacement against several governments websites. Also in this case the list (in continuous growth) is published on Zone-H. |
 |
Defacement |
| Oct 9 | |
justonehost.com
Another Web site hosting company defaced: this time it is the turn of justonehost.com that is hacked by @FailRoot, that also dumps its Database online. The leak contains all users informations, emails, paypals and much more is 11.86mb and has been uploaded to megaupload. |
 |
Defacement SQLi |
| Oct 10 |
|
Congress of the State of Chihuahua Another government website hit and leaked by @FailRoot: Congress of the state of Chihuahua Mexico. The leak contains administration usernames and (easy guessable) passwords. |
 |
SQLi? |
| Oct 10 | Q!sR QaTaR |
A cybercriminal from Quatar defaces a large number of websites belonging to the Ankara government, leaving them non-operational. |
 |
Margent |
| Oct 10 |
 |
40 Zimbabwe Government Websites
A crew called ISCN hacks and defaces 40 Zimbabwe government based websites leaving a polical message. |
 |
Defacement |
| Oct 10 |  |
UKGraffiti.com
UKGraffiti is hacked by Anonymous_DR (Anonymous Dominicana) who also dumps usernames, emails and encrypted passwords. |
 |
SQLi? |
| Oct 11 | ? |
RSA
RSA reveals that it believes two groups, working on behalf of a single nation state, hacked into its servers during the infamous Breach of March and stole information related to the company’s SecurID two-factor authentication products used to attack some defense contractors. Although people are likely to assume that China might have been involved in the attack, they did not reveal the name of the nation involved. |
 |
APT |
| Oct 11 | ? |
Sony (Playstation Network, Sony Entertainment Network and Sony Online Entertainment) Back tho the future! Sony under cyber attack… Again! The Company reports of unauthorized attempts to verify valid user accounts on Playstation Network, Sony Entertainment Network and Sony Online Entertainment. A total of 93,000 accounts have been affected (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000). In these cases the attempts succeeded in verifying valid sign-in IDs and passwords, so the accounts were temporalily locked. |
 |
SQLi? |
| Oct 11 | ? |
blueHOMES.com Unknown Hackers hack the European property Dealers website blueHOMES.com . About 500,000 Users data claim to be hacked including database with customer passwords in plaintext, full addresses, skype account, and mailboxes of bluehomes. Specified data leaked on pastebin with sample data of some users. |
 |
SQLi |
| Oct 11 | ? |
Find2Trade.com
Another website hit by Havij. This time is the turn of Find2Trade, an internet portal whose goal is to help small and medium enterprises to reach much higher profits while reducing costs. UserID, email and passwords, which are encrypted, were leaked. |
 |
Havij |
| Oct 12 | ? |
Raytheon
The U.S. Defense Contractor reveals that it was the victim of a cloud-based attack for the first time, with the incident occurring one week before. Nothing new but the fact that this was the first cloud based attack. The firm usually blocks 1.2 billion attacks a day in addition to four million spam emails each day. |
 |
N/A |
| Oct 12 | ? | WineHQ
Another Linux Project hacked! Jeremy White, Codeweavers Founder announces that access to the WineHQ database has been compromised. It looks like attackers have used phpMyAdmin to access the WineHQ project’s database and harvest users’ appdb and bugzilla access credentials. |
 |
SQLi |
| Oct 13 | ? |
300,000 Websites Google reveals another mass infection which affected hundreds of thousands of sites that relied on ASP or ASP.NET: A malicious script got injected into several locations targeting English, German, French and other language speakers surfers. |
 |
ASP Vulnerability |
| Oct 13 | ? |
Genentech The biotechnology company suffered a data breach on August, 17 which may have resulted in the theft of information belonging to 3,500 of the million patients who utilize the company’s support programs. Estimated Cost of The Breach is around $750,000 |
 |
Unlegitimate Access |
| Oct 14 | ? |
Chili’s Grill & Bar Restaurant
Ok a Chili Breach is not a big deal, except the fact that the computer server Hackers broke into, is placed at Yokosuka Naval Base. According to Navy officials, hackers stole credit card information and run up erroneous charges. |
 |
Credit Card Thieft |
| Oct 14 | ? |
Fedora Project This is not a direct cyber attack but a consequence of the hacks to Linux projects (Kernel.org and Linux). ThreatPost reveals that Fedora Project contacted users to change their password and SSH public key before November 30 to avoid having their accounts marked as inactive. |
 |
N/A |
| Oct 14 | |
Barinas State, Venezuela Another dump of sites from @SwichSmoke coming from the state “Barinas” and the government for that state. The release note, in Spanish states that the original password is 123456, fairly lame for a government website. |
 |
SQLi |
| Oct 14 | Vicky Singh |
Pakistan Embassy in China Another episode of the Cyberware between Pakistan and Indian Crew: Vicky Singh defaces the Pakistan Embassy in China. |
 |
? |
| Oct 14 | Team Dexter |
Contrexx.com
An European Content Management System provider is hacked and has a dump of administration details leaked online. |
 |
N/A |
| Oct 14 Oct 15 | Several Authors |
Club Music CPPS
Club Music CPPS is hacked: the leak contains account emails, usernames and decrypted passwords. Note: on Oct 16 the site is still defaced |
 |
SQLi Defacement |
| Oct 14 | |
Venezuela National Graduate Advisory Council
Another cyber attack by @SwichSmoke, this time they leak the Venezuela National Graduate Advisory Council and release the leaked data on pastebin. |
 |
SQLi |
| Oct 14 | ? |
Infragard Atlanta (claimed)
It seems that Infragrad has been hacked again and had a dump of accounts leaked and decrypted even if there is no source or reason or even proof that this is 100% real in anyway. Anyway it still shows that Infragard is still in the eyes of some people. The alleged leak contains emails, usernames, encrypted passwords and the decryption of the password as well. |
 |
N/A |
| Oct 14 | ? |
NSEC (Netaji Subhash Engineering College)
The Netaji Subhash Engineering College NSEC is hacked and has a fair amount of member accounts dumped on pastebin. This comes from an unknown source and unknown reasons. The leak contains full user information, emails and passwords in clear text. |
 |
SQLi |
| Oct 14 |  |
Barbaros-DZ hacks over 1,700 sites belonging to the Chinese Government defacing them and leaving a message against the Goverment itself. THe list of the sites is available on Zone-H. |
 |
Defacement |
| Oct 14 |  |
Special mention this month for Her Mayesty’s Cabinet Minister Oliver Letwin, who has got himself into hot water, after The Daily Mirror reported him in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. The documents contained the personal details of the minister’s constituents, including names, phone numbers, email contacts and postal addresses. |
 |
Defacement |
| Oct 15 | SA3D HaCk3D |
16,000+ websites
SA3D HaCk3D shows on Zone-H the results of his work of the past years: a total of 16,000+ websites defaced. |
 |
Defacement |
| Oct 15 | p0xy |
iCPPS
For an alleged personal revenge, a hacker called p0xy leaks usernames, emails and hashed passwords from the iCPPS online platform. |
 |
SQLi |
| Oct 15 | iolaka |
World Miss Photogenic
This time is the turn of a fashion/model based website, which is attacked and suffers a dump of accounts leaked containing 1000+ accounts including usernames, emails and encrypted passwords by iolaka. |
 |
SQLi |
| Oct 15 |  |
India Cyber Crime Investigation Cell Another episode of the Cyber-Guerrilla between India and Pakistan: Pakistani hacker Shadow008 hacks and defaces India’s Most Important website of Cyber cell located at Mumbai. |
 |
Defacement |
Related articles
- Just For Reference… (paulsparrows.wordpress.com)
- September 2011 Cyber Attacks Timeline (Part II) (paulsparrows.wordpress.com)
- September 2011 Cyber Attacks Timeline (Part I) (paulsparrows.wordpress.com)
September 2011 Cyber Attacks Timeline (Part II)
Here it is the second part of my traditional monthly Cyber Attacks Timeline (Part I available here). From an information Security Perspective the main events of this month were the infamous Diginotar breach which led to Bankrupt for the Dutch Company and also the BEAST attack to SSL, two events which, together, thumbed the Infosec Community in its stomach.
Of course these events did not divert the attention of hackers who kept on to carry on attacks against different targets.
The Anonymous continued their campaign: although mainly focused on the #OccupyWallStreet Operation (in which a Senior Officer who used pepper spray against protestors was “doxed”, they targeted several governments including Mexico, Austria, (where they also performed an unconfirmed hack against an health insurance Firm targeting 600,000 dumped users) and Syria. In particular the latter attack triggered a retaliation by Syrian Electronic Soldiers against the prestigious Harvard University.
Chronicles also report a Japan defense contractor hit by hackers, Mitsubishi Heavy Industries, (China denied its involvement on the attack), another Twitter Account hacked by The Script Kiddies (this time against USA Today), an indirect attack perpetrated against (through) Oracle by infecting its MySQL.com domain with downloadable malware and, last but not least a massive defacement of 700,000 sites hosted by Inmotion.
US Navy was also victim of defacement.
As far as the prize for the “Most Expensive Breach of the Month” is concerned, the laurel wreath is undoubtedly for SAIC (Science Applications International Corp.) which lost a tape database backup containing data of 4,900.000 users with an estimated cost of approximately 1 billion of bucks…
As usual, useful Resources for compiling the table include:
- Cyber War News (but it looks like it gave up to post reports on Cyber Attacks on 25 September 2011)
CNET Hackers Chart(unfortunately it is not up-to-date since 24 August 2011).- DATALOSSdb
- Dark Reading
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- The Hacker News
My inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
Update: On 09/30/2011, Betfair reported a 3.15 million records breach with a total estimated cost of 1.3 billion USD winning the laurel wreath of the most expensive breach of the month.
| Date | Author | Description | Organization | Attack |
| Sep 16 |
|
Websites of several Mexican government ministries As part of OpIndipendencia, websites of several Mexican government ministries, including Defense and Public Security, are teared down in the same day of the symbolic beginning of Mexico’s independence from Spain. |
 |
DDoS |
| Sep 16 | Mikster |
Clubmusic.com
Clubmusic.com, a worldwide dj website. is hacked and the leak dumped on pastebin. |
 |
SQLi |
| Sep 16 | Sec Indi Security Team |
Official Website of The United States Navy An hacker crew called Sec Indi Security Team Hacker uploads a custom message on the server to warn a WebDav vulnerability. |
 |
WebDav Vulnerabilty |
| Sep 16 | ? | California State Assembly More than 50 employees of the California State Assemby, including some lawmakers, have been warned that their personal information might have been obtained by a computer hacker. |
 |
? |
| Sep 17 | ? |
Intelligence And National Security Alliance Names and email addresses of hundreds of U.S. intelligence officials have been posted on an anti-secrecy website. On Monday Sep 10 INSA published a major report warning of an urgent need for cyberdefenses. Within a couple of days, in apparent retaliation, INSA’s “secure” computer system was hacked and the entire 3,000-person membership posted on the Cryptome.org website |
 |
N/A |
| Sep 17 | ? |
Fake FBI Anonymous Report A Fake FBI Psychological profile of the Anonymous group is published. Although not a direct cyber attack, this event can be considered an example of psychological hacking and a “sign of the times” of how information and counter information may play a crucial role in hacking. |
 |
SQLi? |
| Sep 18 |  |
Texas Police Anonymous/Anti-sec releases a document containing a list of about 3300 members of the Texas Police Association |
 |
N/A |
| Sep 19 |
? |
Mitsubishi Heavy Industries, Japan’s biggest defense contractor, has revealed that it suffered a hacker attack in August that caused some of its networks to be infected by malware. According to the firm, 45 network servers and 38 PCs became infected with malware at ten facilities across Japan. The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles. |
 |
APT |
| Sep 19 |  |
City Of Rennes TeaMp0isoN takes responsibly to hack the official website of The City Of Rennes (France) via a tweet. They also publish the reason of hack on the defacement page. |
 |
Defacement |
| Sep 19 |
? |
Hana SK Card Co., a South Korean credit card firm, announces that Sep 17, some 200 of its customers’ personal information has been leaked. Total cost of the breach is $42,800. |
Hana SK Card |
SQLi? |
| Sep 20 |
? | Former USSR Region Source report that at least 50 victim organizations ranging from government ministries and agencies, diplomatic missions, research institutions, and commercial entities have been hit in the former Soviet Union region and other countries in an apparent industrial espionage campaign that has been going on at least since August 2010.The advanced persistent threat (APT)-type attacks — dubbed “Lurid” after the Trojan malware family being used in it — has infected some 1,465 computers in 61 countries with more than 300 targeted attacks. |
 |
APT |
| Sep 20 |
Shad0w | Fox Sports Website Fox Sports website, on of the most visited Websites in the world (rank 590 in Alexa) gets hacked. An Hacker named “Shad0w” releases SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked database info posted on pastebin. Vulnerable link is also posted together admin password hashes. |
 |
SQLi? |
| Sep 22 |  |
Core Security Technologies Another security Firm target of hacking: Core Security Technologies is hacked by an hacker called Snc0pe, who defaces some websites belonging to the firm. Mirror of the hack can be seen here. |
 |
N/A |
| Sep 24 | ? |
UKChatterbox
Popular IRC service UKChatterbox advises users to change their passwords following a series of hacks which culminated in an attack that may have compromised user details. The password reset follows on from a succession of outages previously attributed to maintenance upgrades, back to the start of the summer. In a notice to users, UKChatterbox advises users to change their passwords and not to re-use them on other sites. The number of hacked account is unknown. |
 |
N/A |
| Sep 25 |
|
Seven Major Syrian Cities and Government Web Sites The Anonymous unleash a chain of defacement actions against the Syrian Government, hacking and defacing the official sites of seven major Syrian cities, which stayed up in their defaced version for more than 16 hours. The defacement actions kept on the following day in which 11 Syrian Government Sites were defaced as part of the same operation. |
|
Defacement |
| Sep 25 | ? |
Indira Gandhi International Airport
Although happened three months ago, it turns out that a ‘technical snag’ hittinh operations at the Indira Gandhi International Airport (IGIA) T3 Terminal was caused by a “malicious code” sent from a remote location to breach the security at the airport. |
 |
APT |
| Sep 26 |  |
Inmotion Hosting Server 700,000 websites hosted on InMotion Hosting network are hacked by TiGER-M@TE. The hackers copied over the index.php in many directories (public_html, wp-admin), deleted images directory and added index.php files where not needed. List of all hacked 700,000 sites here. |
 |
Defacement |
| Sep 26 | |
Austrian Police The Austrian Anonymous branch publishes the names and addresses of nearly 25,000 police officials, raising fears for officers’ personal security. An Austrian Interior ministry spokesman said the information came from an “association closely related with the police”. Estimated cost of the breach is around $ 5,400,000. |
 |
SQLi? |
| Sep 26 |  |
USA Today Twitter Account
The USA Today Twitter account is hacked and starts to tweet false messages mentioning the other accounts hacked by the authors of the action: the Script Kiddies (already in the spotlight for hacking the FoxNews Twitter Account at the Eve of 9/11 anniversary) |
 |
Account Hacking |
| Sep 26 |
? |
MySQL.com
MySQL.com website is struck by cybercriminals, who hacked their way in to serve up malicious code to visiting computers with a Java exploit that downloaded and executed malicious code on visiting Windows computers. Brian Krebs reports that just few days before, he noticed on a Russian underground website that a hacker was offering to sell admin rights to MySQL.com for $3000. MySQL.com receives almost 12 million visitors a month (nearly 400,000 a day). |
 |
Java Exploit to install malware |
| Sep 26 |  |
Harvard University In retaliation for the defacements performed by the Anonymous targeting Syria, Syrian Electronic Soldiers deface the website of the prestigious Harvard University. The same group came in the spotlight during July and August for defacing Anonoplus engaging a “de facto” cyberwar against The Anonymous. |
 |
Defacement |
| Sep 26 | ? |
#Occupywallstreet The month of September is characterized by the OccupyWallStreet Operation, started on September, the 17th and still ongoing. Although not directly configurable as an hacking action, it may rely on the support of the Anonymous who “doxed” a senior police who controversially usec pepper spray against a group of female protesters. |
 |
N/A |
| Sep 27 | |
COGEL, Council On Governmental Ethical Law Once again in this month,Snc0pe claims another resounding action. This time the alleged target is the official website of The Council on Governmental Ethics Laws (COGEL). He posts a message on pastebin, along with the database download link. |
 |
SQLi? |
| Sep 28 | |
Tiroler Gebietskrankenkasse (TGKK) AnonAustria in the spotlight again after the resounding hack against Austrian Police. This time the victim is an health insurance firm Tiroler Gebietskrankenkasse (TGKK) whose database of some 600,475 medical records AnonAustria claims to have hacked. The databse includes some celebrities. The total cost of the breach is around $128,500,000.00. |
 |
SQLi? |
| Sep 29 | ? |
SAIC (Science Applications International Corp.) SAIC, one of the Pentagon‘s largest contractors reveals to have discovered a data breach occurred a couple of weeks before, affecting as many as 4.9 million patients who have received care from military facilities in San Antonio since 1992. The breach involved backup computer tapes from an electronic health care record. Some of the information included Social Security numbers, addresses, phone numbers and private health information for patients in 10 states. Statement of the data breach here Estimated cost of the breach is around $ 1 billion. |
 |
Car Burglary |
| Sep 30 | ? |
Laptop Virus Repair
Although not resounding as the one which targeted MySQL.com, here it is another example of a website infected with malicious code targeting a free antivirus cloud based service. |
Laptop Virus Repair |
Malicious Code |
| Sep 30 | ? |
Betfair
Betfair reports a leak including not only the payment card details of most of its customers but also “3.15m account usernames with encrypted security questions”, “2.9m usernames with one or more addresses” and “89,744 account usernames with bank account details”. The incident occurred on 14 March 2011 but was announced only 18 months later. Estimated cost of the breach is around $1.3 billion. |
 |
? |
September 2011 Cyber Attacks Timeline (Part I)
So here it is, also for this month, the first part of My Cyber Attacks Timeline covering the first half of September.
Apparently It looks like the wave of the Anonymous attacks that characterized August has stopped. Even if several isolated episodes occurred, their impact was slightly lower than the previous months.
Probably the most important security incident for this month was the Diginotar Hack, not only because the Dutch Certification Authority has been banned forever by the main browsers and OSes but also because all the authentication model based on CAs is under discussion. Moreover once again a cyber attack has been used as a mean of repression. This incident is a turnkey point for information security but in my opinion also the DNS hacks by Anonymous Sri Lanka and Turkguvenligi are noticeable since they reinforce the need for a quick adoption of DNSSEC.
For the first time not even the Linux Operating System (an open world) was immune from hackers: both the Linux Kernel and the Linux Foundation Web Sites were hacked during this month, two episodes that Penguin Lovers will remember for a long time.
Easily predictable an attack recalling 9/11 carried on against the Twitter Account of NBC News was also reported.
Other noticeable events: three huge data breaches were reported, four attacks with political motivations targeting India, Nigeria, Colombia, and the Russia Embassy in London were perpetrated and another security vendor (Panda Security) was indirectly targeted.
The remainder of the month was characterized by many smaller attacks (mostly defacements and data leaks) and an actress (Scarlett Johansson) was also victim of data leaks.
Useful Resources for compiling the table include:
- Cyber War News
- CNET Hackers Chart
- DATALOSSdb
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- The Hacker News
And my inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
| Date | Author | Description | Organization | Attack |
| Sep 1 |
? |
The site of Kernel.org suffered a security breach leading which caused the server to be rooted and 448 credential compromised. Although it is believed that the initial infection started on August the 12th, it was not detected for another 12 days. |
 |
rootkit (Phalanx) |
| Sep 1 | |
Apple, Symantec, Facebook, Microsoft, etc.
The Sri Lankan branch of Anonymous claims to have hacked into the DNS servers of Symantec, Apple, Facebook, Microsoft, and several other large organizations over the past few days, posting the news and records of its exploits on Pastebin. |
 |
DNS Cache Snoop Poisoning |
| Sep 1 | ? |
Birdville Independent School District
Two students hack into their school district’s server and accessed a file with 14,500 student names, ID numbers, and social security numbers. Estimated cost of the breach is around $3,000,000. |
 |
? |
| Sep 2 |  |
Texas Police Chiefs Association As usual happens on Fridady, Texas Police Chiefs Association Website is hacked by Anonymous for Antisec Operation. Hacker defaced their website and posted 3GB of data in retaliation for the arrests of dozens of alleged Anonymous suspects. According to Hackers the site has been owned for nearly one month. |
|
SQLi? |
| Sep 2 |  |
EA Game Battlefield Heroes One of the most famous games over the world Battlefield Heroes developed by EA Games is hacked by a hacker named “Why So Serious?” who leaks the User Login passwords on pastebin |
 |
SQLi? |
| Sep 2 | |
vBTEAM Underground Vbteam.info, the underground vBulletin Hacking website is hacked by “Why So Serious?“, who leaks 1400+ accounts of the Vbteam.info forum in pastebin. |
 |
SQLi? |
| Sep 3 | Nomcat |
Indian Government
An Indian Hacker named “nomcat” claims to have been able to hack into the Indian Prime Ministers Office Computers and install a Remote Administration Tool) in them. He also Exposes the Vulnerability in Income Tax website and Database Information. |
 |
SQLi? |
| Sep 4 |
|
Popular Websites: : Daily Telegraph, The Register, UPS, Vodafone Popular websites including The Register, The Daily Telegraph, UPS, and others fall victim to a DNS hack that has resulted in visitors being redirected to third-party webpages. The authors of the hack, a Turkish group called Turkguvenligi, are not new to similar actions and leave a message declaring this day as World Hackers’ Day. |
 |
DNS Hijacking |
| Sep 5 | |
Mobile App Network Forum Mobile APP Network Forum is Hacked by “Why So Serious?”. He leaks over 15.000 accounts of the community (Forum) on Pastebin in two parts (Part 1 and Part 2). |
 |
SQLi? |
| Sep 5 |  |
European Union Institute For Energy and Transport One of the Sub domain of European Union (Institute for Energy) is hacked and Defaced by Inj3ct0r. Hackers deface the web page, release some internal details and leave a message against Violence in Lybia and Russian influence in Ukraine. |
 |
Defacement |
| Sep 5 | Cocain Team Hackers | United Nations Sub Domain of Swaziland United Nations Sub-Domain of Swaziland is hacked and defaced by Cocain Team Hackers. |
 |
Defacement |
| Sep 5 | |
Uronimo Mobile Platform The Uronimo Mobile platform is hacked by Team Inj3ct0r. They leak the web site database and release on Pastebin internal data including Username, Hash Password, emails and Phone Numbers of 1000 users. Estimated Cost of the Breach is $214,000. |
 |
SQLi? |
| Sep 6 | Comodo Hacker |
Diginotar
The real extent of the Diginotar breach becomes clear: 531 bogus certificates issued including Google, CIA, Mossad, Tor. Meanwhile in a pastebin message Comodo Hacker states he own four more CAs, among which GlobalSign which precautionally suspends issuance of certificates. |
 |
Several Vulnerabilities |
| Sep 7 | ? |
Beaumont Independent School District
The superintendent of schools for Beaumont Independent School District announces that letters are being mailed to parents of nearly 15,000 of its 19,848 students to inform them of a potential breach of data that occurred recently. Inadvertently, private information including the name, date of birth, gender, social security number, grade and scores on the Texas Assessment of Knowledge and Skills (TAKS) exam of students who were in the third through 11th grades during the 2009-2010 school year–were potentially exposed. Estimated cost of the breach is $3,210,000. |
 |
Human Mistake |
| Sep 7 | ? |
Stanford Hospital, Palo Alto, Calif.
A medical privacy breach leads to the public posting on a commercial Web site of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif., including names and diagnosis codes. The information stayed online for nearly a year from one of its vendors, a billing contractor identified as Multi-Specialty Collection Services, to a Web site called Student of Fortune, which allows students to solicit paid assistance with their schoolwork. Estimated Cost of The Breach is $4,280,000. |
 |
Human Mistake |
| Sep 9 | Comodo Hacker |
GlobalSign
After suspending issuing certificates, GlobalSign finds evidence of a breach to the web server hosting the www website. The breached web server has always been isolated from all other infrastructure and is used only to serve the http://www.globalsign.com website. |
 |
? |
| Sep 9 |
Comodo Hacker |
Google
As consequence of the infamous Diginotar Breach Google advises its users in Iran to change their Gmail passwords, and check that their Google accounts have not been compromised. Google also indicates that it is directly contacting users in Iran who may have been hit by a man-in-the-middle attack. |
 |
Man In The Middle |
| Sep 9 | |
NBC News
The NBC News Twitter account is hacked and starts to tweet false reports of a plane attack on ground zero. The account is suspended and restored after few minutes. |
 |
Trojan Keylogger via Email |
| Sep 9 | ? |
Samsung Card
Data of up to 800,000 Samsung Card clients may have been compromised after an employee allegedly extracted their personal information. The Breach was discovered on Aug. 25 and reported to police on Aug. 30. It is not clear what kind of information has been leaked, maybe the first two digits of residence numbers, the names, companies and mobile phone numbers were exposed. Estimated cost of the breach is $171,200.000. |
 |
Unauthorized Access |
| Sep 10 | ? |
BuyVIP (Amazon Owned)
Although not officially confirmed, BuyVIP users received an e-mail informing that their database had been hacked. Apparently, the website had been offline for a couple days and it looks like that not only names and email addresses were retrieved, but also birth dates, real shipping addresses as well as phone numbers. |
 |
SQLi |
| Sep 11 | ? |
Linux Foundation Few weeks after the kernel.org Linux archive site suffered a hacker attack, the Linux Foundation has pulled its websites from the web to clean up from a security breach. A notice posted on the Linux Foundation said the entire infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down for maintenance due to a security breach that was discovered on September 8, 2011. |
 |
SQLi? |
| Sep 11 | |
AryansBook.com Anonymous leaks the complete database from a well known nazi website AryansBook.com and posts the content on The Pirate Bay. This is a fight towards racism of any kind. |
AryansBook |
SQLi? |
| Sep 12 | ? |
Bitconitalk Forum An unknown hacker uses a zero day flaw to steal email addresses, hashed passwords and read personal messages from the bitcointalk.org forum. Forum administrators said the attacker gained root access on 3 September and was able to run arbitrary PHP code not detected until the attacker injected “annoying JavaScript” into the forum pages a week later: the Javascript splashed actor Bill Cosby across the forums and replaced all references to BitCoin with CosbyCoin. |
 |
0-day exploit in SMF |
| Sep 12 | ? |
Nigerian Government Website Nigerian Government Website is hacked and defaced by Brazilian Hackers that leave a message in the main page. |
 |
Defacement |
| Sep 12 | ? |
Vacationland Vendors
A hacker gains unauthorized access to the card processing systems at Wilderness Waterpark Resort and improperly acquires 40,000 credit card and debit card information. Estimated Cost of the Breach is $8,560,000. |
 |
N/A |
| Sep 12 | X-Nerd | Panda Security
Another Security Company Hacked: a hacker going by the name of X-Nerd hacks and defaces the Pakistan Server of a very well known security software website: Panda Security. |
 |
SQLi? |
| Sep 12 | ? |
Russian UK Embassy Just before Prime Minister David Cameron’s first visit to Moscow, the website belonging to the Embassy Of The Russian Federation in London was taken down by hackers. It seems as the attack was launched in sign of protest to the upcoming visit after a 5-year break in which no British leader went to Moscow. |
 |
DDoS |
| Sep 13 | Cyb3rSec |
thetvdb.com Cyb3rSec dumps a list of 3500+ Accounts from the forum thetvdb.com. |
 |
SQLi? |
| Sep 13 |  |
top100arena.com Albanian hackers belonging to Albanian Cyber Army exploit one of the biggest Game Arena site “Top100″ database using SQL injection attack. They leak the database on mediafire. |
 |
SQLi |
| Sep 14 | |
President of Bolivia (presidencia.gob.bo) SwichSmoke crew hacks the site belonging to President of Bolivia and dumps the leaked data on pastebin. |
 |
Various Exploits |
| Sep 14 | ? |
uTorrent.com
The uTorrent.com |
 |
SQLi |
| Sep 14 | ? |
Bright House Networks Bright House Networks, the sixth largest owner and operator of cable systems in the U.S., has sent a letter to customers warning that they may have been exposed after servers used to process Video on Demand (VOD) were breached. |
 |
? |
| Sep 14 | ? |
Scarlett Johansson
Also an actress may be victim of hackers: The FBI investigate reports that nude photos of a famous celebrity (allegedely Scarlett Johansson) have been leaked onto the web. The day before Twitter was flooded with messages claiming to link to naked pictures of her, which were allegedly stolen from her iPhone by a hacker earlier this year. |
 |
? |
| Sep 15 | Stohanko |
Various Sites More than 101 sites, with huge amount of data and personal information which ranges from emails, phone numbers, to full names and addresses, have been hacked by an hacker dubbed Stohanko. At this link a list of the hacked sites and the links to dumped data. |
 |
? |
Tragedie Reali e Sciacalli Virtuali (Aggiornamento)
Gli sconvolgimenti naturali a cui è ciclicamente sottoposto il genere umano generano tra gli uomini reazioni contrastanti: da un lato esempi di solidarietà che in condizioni normali sarebbero impensabili, dall’altro episodi di turpe sciacallaggio da parte di chi vede nella disgrazia un modo per arricchirsi.
Analogamente al mondo reale, il mondo virtuale di Internet non sfugge a questa dura legge e il recente terremoto di 8.9 gradi in Giappone si è rivelato una occasione propizia per gli immancabili sciacalli informatici che, sulla scia dei drammatici eventi orientali, hanno prontamente inondato il Web con un mare di truffe informatiche di vario genere.
Se da un lato Google, in questo caso espressione virtuale del buono che c’è nel genere umano, ha immediatamente attivato il suo servizio Person Finder per aiutare a trovare parenti, amici o conoscenti dispersi nella tragedia; dall’altro lato, e questo è il lato oscuro, nel sottobosco di internet sono immediatamente spuntati, come funghi velenosi, siti web, false pagine di Facebook o altre immancabili occasioni di frode aventi come denominatore comune l’utilizzo della tragedia nipponica per scopi malevoli.
Trend Micro per prima (ironia della sorte proprio un produttore giapponese), seguita a poca distanza da Symantec, ha evidenziato l’utilizzo di tecniche Black Hat SEO per avvelenare artificiosamente i risultati dei motori di ricerca (Search Engine Optimization Poisoning) e inserire ai primi posti siti truffaldini incoraggianti il download di un trojan sotto le mentite spoglie di un falso antivirus. Spinto dalla fame insaziabile di informazioni, il navigatore viene sospinto dal vento ingannatore della ricerca avvelenata verso un sito malevolo dove scarica malware (in questo caso un falso antivirus). L’ incremento di simili tecniche malevole nel 2011 era stato ampiamente previsto da Sophos, e l’occasione corrente si è dimostrata troppo propizia per spregiudicati truffatori in cerca di allocchi a cui rifilare bidoni informatici (purtroppo dannosi).
McAfee ha invece rilevato un triste primato della truffa: a sole due ore di distanza dal sisma nipponico erano già comparsi i primi siti promotori di false raccolte di fondi. Tecnologie nuove, metodi vecchi si dirà: le raccolte dei fondi fasulle sono sempre state uno dei metodi prediletti dagli sciacalli in circostanze analoghe, ed è veramente disarmante assistere a come le vecchie abitudini si adattino alle nuove tecnologie incoraggiate dalla facilità e velocità con cui chiunque, oggigiorno, può ottenere un dominio e di conseguenza mettere in piedi in quattro e quattr’otto un sito.
Sophos oggi ha invece rilevato l’occorrenza di una truffa di tipo Likejacking utilizzata senza vergogna da un sito francese (ibuzz.fr). Stuzzicando la morbosa curiosità degli utenti verso le tragedie, con la promessa di visualizzazione di un video da non perdere relativo allo Tsunami che ha investito le coste del Sol Levante; il sito francese ha pubblicato un video in cui ha celato codice nascosto contenente il classico bottoncino like di Facebook (uno dei tanti a cui il Social Network azzurro ci ha ormai abituato). Cliccando sul video l’utente poteva involontariamente fare pubblicità al sito d’origine del video modificando inconsapevolmente il proprio stato su Facebook con il non voluto apprezzamento nei confronti del sopra citato sito senza pudore. Niente di grave naturalmente, ma l’idea di speculare su una tragedia così immane è veramente nauseante.
Segnalo infine questo link, del produttore ESET, dove è possibile trovare una vasta letteratura in fatto di truffe derivanti dalle tragedie: dallo Tsunami del 2004 al terremoto giapponese di questi giorni passando il sisma di Haiti, delle Filippine, etc. Purtroppo il panorama è veramente desolante.
Cosa fare per non cadere nelle trappole? Come al solito (che noia, ma i problemi sono sempre gli stessi) un comportamento attento e responsabile: dubitare degli inviti a visionare o condividere nei social network video sconvolgenti, non attingere a notizie provenienti da fonti poco attendibili, dubitare delle raccolte di fondi provenienti da siti improvvisati…
Aggiornamento: Symantec segnala questa mattina false Catene di Sant’Antonio di Solidarietà. Ovviamente il consiglio rimane sempre lo stesso: meglio tenersene alla larga…
Se L’Androide Evapora
L’ultima segnalazione in fatto di malware per il povero Androide ce la segnala Symantec. E’ di queste ore la notizia della scoperta di un nuovo malware per il povero Androide senza pace. Android.Pjapps, questo il nome del malware, che si nasconde dietro una applicazione lecita: Steamy Window che nella sua versione pulita, vaporizza lo schermo dell’Androide, e nella versione bacata ne vaporizza anche la sicurezza.
Anche in questo caso siamo alle solite: permessi sospetti durante l’installazione, e mentre l’utente gioca a pulire lo schermo con il ditino, il trojan imprigiona l’Androide dentro una botnet controllata da alcuni server di Comando e Controllo (C&C). Una volta infettato l’Androide Impazzito è in grado di installare applicazioni contro la volontà dell’utente, navigare verso siti web, aggiungere bookmark al browser, inviare messaggi di testo e anche, bloccare le risposte a messaggi.
Il tutto, come nelle migliori tradizioni, rigorosamente in background senza che l’utente se ne accorga minimamente. Ad un cambiamento dell’intensità del segnale il servizio si avvia e tenta di connettersi al seguente server di comando e controllo:
http://mobile.meego91.com/mm.do?.. (parametri di controllo)
Come si nota agli autori del malware non è mancato il sense of humor, visto che a controllare i dispositivi è un server che richiama meego, il (quasi) defunto sistema operativo figlio della scellerata alleanza tra Nokia e Intel.
Assieme al Check-In, il malware invia informazioni sensibili ottenute dal dispositivo, tra cui:
- IMEI
- DeviceID
- Numero Telefonico.
- Subscriber ID
Alla risposta invia un messaggio con l’IMEI del dispositivo compromesso ad un numero ottenuto dall’indirizzo seguente:
http://log.meego91.com:9033/android.log?(parametri di controllo)
Anche in questo caso c’è un richiamo al povero MeeGo. Ovviamente il numero a cui viene inviato il messaggio è controllato dall’attaccante che è in grado di nascondere la sua identità.
Di tanto in tanto, inoltre, il servizio malevolo, mediante un proprio protocollo basato su XML, controlla il server di Comando e Controllo per verificare se ci sono altri comandi.
http://xml.meego91.com:8118/push/newandroidxml/...(comandi).
Anche in questo caso il problema è sempre lo stesso, una applicazione apparentemente lecita presa da un market parallelo e con permessi di installazione improbabili. Manca solo il terzo aspetto che sino ad oggi ha contraddistinto tutti i malware per il povero Androide (dopo i casi di Geinimi e HongTouTou), ovvero la Cina. Forti dubbi mi sono venuti da questa illustrazione che ho trovato sul Blog Symantec, ma poi scavando nella Rete ho scoperto che nelle stesse ore una azienda di sicurezza Cinese (guarda a caso) Netquin ha scoperto due varianti (chiamate SW.SecurePhone e SW.Qieting) presumibilmente riconducibili al malware rilevato da Symantec.
Devo ammettere che il dubbio che siano proprio le aziende d’Oriente a mettere in circolazione le infezioni per l’Androide non si è ancora completamente dissolto…
La Sindrome Cinese
Nel giorno in cui anche alla RSA Conference 2011 è stato ribadito che “E’ ora di prepararsi per le minacce mobili”, la Sindrome Cinese ha nuovamente colpito l’Androide che, in poche ore, è stato vittima di un nuovo malanno informatico. Ancora proveniente dalla Cina, ancora caratterizzato dal fatto di utilizzare come vettore di infezione un store di applicazioni parallelo cinese. A quanto pare quindi il malware Geinimi ha fatto proseliti.
A seguire le sue orme è oggi il malware HongTouTou (conosciuto anche con il nome di Android.Adrd o anche Android/Adrd.A nella sua ultima variante).
Le dinamiche di questo nuovo contagio dell’Androide Cagionevole (che alcuni ritengono essere una variante di Geinimi) sono le medesime, purtroppo collaudatissime, del suo illustre predecessore: il malware è rimpacchettato dentro applicazioni Android popolari e distribuito tramite market di applicazioni parallele e forum frequentati da utenti di lingua cinese. Ovviamente l’utente dovrebbe accorgersi dei permessi sospetti richiesti durante la fase di installazione.
Il malware, di cui sono state rilevate 14 istanze, è impacchettato dentro applicazioni lecite (tra cui il famosissimo Robo Defense con cui ho passato ore di riposo all’ombra di un ombrellone sotto il Sol Leone dell’Agosto passato). Una volta installata l’applicazione richiede i seguenti permessi, in realtà un po’ sospetti per un semplice passatempo o per un wallpaper:
android.permission.WRITE_APN_SETTINGSandroid.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.MODIFY_PHONE_STATE
All’avvio dell’applicazione infetta, il malware si insinua nel telefono colpito viene eseguito al verificarsi di una delle condizioni sottostanti:
- Sono passate 12 ore dell’avvio del Sistema Operativo;
- E’ cambiata la connettività di rete (ad esempio è stata persa e ristabilita);
- Il dispositivo infetto riceve una chiamata.
All’avvio il Trojan tenta di rubare le seguenti informazioni;
- 3gnet
- 3gwap
- APN
- cmnet
- cmwap
- Hardware information
- IMEI
- IMSI
- Network connectivity
- uninet
- uniwap
- Wifi
e le invia cifrate ad una coppia di domini remoti:
http://adrd.taxuan.net/indexhttp://adrd.xiaxiab.com/pic.
In risposta, HongTouTou riceve una pagina Web, ed un insieme di parole chiave di ricerca da inviare come query. Le richieste vengono inviate ad alcuni link noti. Un esempio di stringa è la seguente:
wap.baidu.com/s?word=[ENCODED SEARCH STRING]&vit=uni&from=[ID]
Lo scopo delle query è quello di incrementare il ranking e quindi la visibilità del sito Web.
A questo punto il malware emula il processo di richiesta utilizzando le parole chiave, analizza i risultati della ricerca con il ranking maggiore ed emula i click su specifici risultati, come se fosse l’utente ad effettuarli. Per il motore di ricerca truffato, le richieste sembrano provenire da un utente mobile che utilizza come browser il programma UCWeb Browser, “casualmente” un progamma di navigazione mobile “Made in China” (l’User-Agent corrisponde a J2ME/UCWEB7.4.0.57).
Il malware inoltre è in grado di scaricare pacchetti di installazione Android APK e quindi di autoaggiornarsi. Anche se ancora non è stato osservato sembrerebbe che il malware sia anche in grado di monitorare le conversazioni SMS e inserire contenuto inopportuno all’interno della conversazione SMS.
Ancor prima di dotarsi di una applicazione anti-malware mobile, come al solito le raccomandazioni sono sempre le stesse:
- Evitare, a meno che non sia strettamente necessario, di abilitare l’opzione di installazione delle applicazioni da Sorgenti Sconosciute (pratica definita anche “sideloading”).
- Fare attenzione in generale a ciò che si scarica e comunque installare esclusivamente applicazioni da sorgenti fidate (ad esempio l’Android Market ufficiale, le cui applicazioni non sono infette). Buona abitudine è anche quella di verificare il nome dello sviluppatore, le recensioni e i voti degli utenti;
- Controllare sempre i permessi delle applicazioni durante l’installazione. Naturalmente il buon senso corrisponde al migliore anti-malware per verificare se i permessi sono adeguati allo scopo dell’applicazione;
- Fare attenzione ai
sintomicomportamenti inusuali del telefono (ad esempio SMS inusuali o una sospetta attività di rete) che potrebbero essere indicatori di una possibile infezione.
Aldilà delle raccomandazioni, applicabili in qualsiasi contesto, non posso fare a meno di notare che HongTouTou (o Android.Adrd) è il secondo malware per l’Androide proveniente dalla Cina in meno di due mesi. Poiché sovente i produttori cinesi di sicurezza sono stati accusati di mettere in circolazione essi stessi il malware per promuovere i propri prodotti, mi domando a questo punto se certe scorciatoie non siano sbarcate anche nel mondo mobile…
Dalla Cina Con Furore Arriva Il Dragone Della Notte
Non sto parlando del titolo di un film di Bruce Lee in versione notturna, ma dell’ultimo arrivato nella poco ambita Hall Of Fame dei malware aventi come obiettivo le infrastrutture critiche.
Non si è ancora spenta l’eco del Virus Delle Centrali Nucleari che dalla Terra Dei Mandarini arriva un nuovo malware avente come obiettivo gli impianti di Olio, Gas e Petrolchimici. Secondo McAfee, che ha scoperto e battezzato il malware dagli occhi a mandorla con il nome di Night Dragon (che richiama suggestive e mitologiche immagini d’oriente), da novembre 2009, alcuni impianti di raffinazione in diversi paesi sono stati vittime di numerosi eventi malevoli, caratterizzata da un presunto focolaio cinese, e che hanno coinvolto numerose tecniche: dal social engineering, allo spearphishing, passando, tanto per cambiare, attraverso le immancabili vulnerabilità di Windows, la compromissione di Active Directory ed infine l’utilizzo di strumenti di amministrazione remota. Il tutto con l’obiettivo di raccogliere informazioni classificate appartenenti alla sfera tecnologica (quindi decisive nei confronti della concorrenza) e alla sfera finanziaria (ad esempio finanziamenti di progetti o gara d’appalto). Informazioni comunque contraddistinte dal minimo comune denominatore di appartenenza a tecnologie di produzione di impianti olio, gas e petrolchimico.
Dettagli Dell’Attacco
L’attacco del Dragone ha metaforicamente applicato il suo alito di fuoco verso le infrastrutture vittima mediante diversi fattori eterogenei di attacco in grado di penetrare progressivamente l’infrastruttura vittima. Le spire hanno avvolto gli obiettivi mediante:
- Compromissione dei web server della Extranet vittima tramite tecniche di attacco di tipo SQL Injection che hanno consentito l’esecuzione remota di comandi;
- Nei server compromessi sono stati caricati strumenti di controllo remoto utilizzati per trasformare i server compromessi in ponti di att(r)acco per accedere dall’esterno alla intranet e di conseguenza alle informazioni sensibili ivi contenute e memorizzate nei desktop e server interni.
- Ulteriore accesso nell’intimità della intranet violata è stato ottenuto mediante la presa con la forza bruta (o meglio con la brute force) di ulteriori nome utente e password;
- Utilizzando i server Web Compromessi come server di comando e controllo (C&C), gli attaccanti, nella realtà, si sono resi conto che la sola disabilitazione delle impostazioni del proxy dal browser Microsoft Internet Explorer (IE) si è rivelata sufficiente per ottenere una connessione remota diretta alle risorse interne.
- Mediante malware di Controllo Remoto innestato (RAT Remote Access Tool), gli attaccanti sono stati in grado di connettersi ad altre macchine arrivando infine ai desktop papaveriali (ovvero le postazioni degli alti dirigenti) in cui hanno provveduto alla ovvia e sistematica razzia di archivi di posta elettronica ed altri documenti sensibili.
Gli attacchi hanno avuto origine all’interno della Grande Muraglia [ci sarebbe voluto un Great (Fire)wall] ed hanno utilizzato alcuni server acquisiti da servizi di hosting degli Stati Uniti per compromettere alcuni server in Olanda, e sferrare da questi ultimi virulenti attacchi contro corporation del settore Oil, Gas e Petrolchemical in Kazakistan, Taiwan, Grecia e Stati Uniti per rubare le informazioni.
E’ interessante notare il fatto che, per distribuire nelle macchine remoto gli strumenti di controllo remoto (alcuni fatti in casa, altri “standard”), gli attaccanti abbiano utilizzato non solo tecniche di SQL Injection, ma anche ben più ingenue mail di phishing dirette verso le postazioni dei dipendenti, dipendenti che con un semplice click su un link compromesso hanno letteralmente aperto le porte (TCP) al malware che, una volta installato, ha provveduto alla sistematica raccolta di credenziali di dominio utilizzate poi per installarsi su ulteriori vittime e di conseguenza propagarsi ulteriormente nella intranet.
Una volta compromessi i sistemi interni, gli attaccanti hanno ottenuto le account di amministrazione interne e di Active Directory e le hanno utilizzate per aprire le porte sul retro (backdoor) dei sistemi ed impiantare cavalli di troia per bypassare le mura di protezione costituite dalla difesa perimetrale e dalle policy di sicurezza, arrivando, in alcuni casi a disabilitare i moduli anti-virus e anti-spyware a bordo dei desktop.
Tra gli strumenti di controllo remoto più utilizzati per questo attacco, McAfee ha rilavato il cavallo di troia zwShell, di cui gli attaccanti hanno sviluppato dozzine di varianti utilizzate per compromettere ed esportare (dumpare in termine tecnico) il database delle password di Windows (il famigerato SAM). Lo Zio SAM è stato successivamente crackato con uno strumento standard dalle cupe bibliche reminescenze: Cain & Abel.
Una volta terminata l’operazione di recupero password è iniziata la razzia di file relativi a contratti e progetti (in acluni casi addirittura dati dai sistemi SCADA).
Conclusione
Leggendo in sequenza i vari documenti sino ad ora pubblicati, il mio morboso entusiasmo da professionista della sicurezza si è progressivamente smorzato. Speravo Pensavo di essere davanti ad un novello Stuxnet, ed invece mi sono ritrovato di fronte ad un “semplice” Cyber-attacco, pur sempre perpetrato in maniera massiva verso infrastrutture critiche, ma comunque facente uso di una combinazione, per quanto complessa e ben congegnata, di tecniche “tradizionali”.
Sorprende semmai il fatto che una operazione di cosi vasta portata sia stata avviata utilizzando come appiglio iniziale per l’attaccante due tipologie di attacco tutto sommato relativamente conisciute (ma non per questo semplici da contrastare): il classico SQL Injection e l’altrettanto noto phishing. E proprio in questo punto giace il paradosso: il termine Cyberattack evoca chissà quali misure in grande per contrastare minacce planetarie alle infrastrutture critiche e poi si scopre che le nostri fonti di energia possono essere compromesse da una tipologia di attacco (l’iniezione SQL) mitigabile da una normale sana attività fisica (oops di patching!), ed una tipologia di attacco, il phishing, arcinota e che non può essere contrastata pienamente da nessuna contromisura tecnologica, ma soltanto da una educazione responsabile dell’utente per l’uso del mezzo internet. Proprio in questo punto giace la difficoltà: per l’SQL Injection esistono i firewall applicativi e le patch… Per il cervello umano ancora no…
About The Author
Support My Work!
Share:
News
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
Visitors from…
