As usual, here is the list of the main cyber attacks for April 2012. A first half of the month which has been characterized by hacktivism, although the time of the resounding attacks seems so far away. Also because, after the arrest of Sabu, the law enforcement agencies (which also were targeted during this month, most of all in UK), made two further arrests of alleged hackers affiliated to the Anonymous Collective: W0rmer, member of CabinCr3w, and two possible members of the infamous collective @TeaMp0isoN.
In any case, the most important breach of the first half of the month has nothing to deal with hacktivism, targeted the health sector and occurred to Utah Department of Health with potentially 750,000 users affected. According to the Last Ponemon Study related to the cost of a breach ($194 per record) applied to the minimum number of users affected (250,000), the monetary impact could be at least $ 55 million.
Another interesting event to mention in the observed period is also the alleged attack against a Chinese Military Contractor, and the takedown of the five most important al-Qaeda forums. On the hacktivist front, it worths to mention a new hijacked call from MI6 to FBI, but also the alleged phone bombing to the same Law Enforcement Agency. Both events were performed by TeamPoison, whose two alleged members were arrested the day after.
For the sample of attacks I tried to identify: the category of the targets, the category of the attacks, and the motivations behind them. Of course this attempt must be taken with caution since in many cases the attacks did not target a single objective. Taking into account the single objectives would have been nearly impossible and prone to errors (I am doing the timeline in my free time!), so the data reported on the charts refer to the single event (and not to all the target affected in the single event).
As usual the references are placed after the jump.
By the way, SQL Injection continues to rule (the question mark indicates attacks possibly performed by SQL Injection, where the term “possibly” indicates the lack of direct evidences…).
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @pausparrows on Twitter for the latest updates.
Hactivism is making possible to bring wars and revolutions on the cyberspace, the fifth domain of war. In particular the Arab Spring has given the definitive consecration to politically driven hacking actions that have proven to be a key factor inside the protests that are changing the political landscape in the Middle East: non conventional weapons used together with “traditional” methods by both parties involved on revolutions: cyber-opponents vs cyber-supporters.
Tunisia has been the first example of this new way to provide backing to social protests: at the beginning of 2011 the Anonymous activists targeted Tunisian government sites. It was the 4th of January and this action (or Operation quoting the same term used by the Anonymous) showed to the world the real, political and social power of the Cyber warfare.
Few days later (June, 26th 2011) the same fate befell to Egypt: government sites were targeted with DDOS attacks which contributed to draw attention to ongoing protests which led to the fall of President Mubarak.
Following the wake of the Arab spring, the Anonymous also took position in the Libyan Revolution declaring their engagement with the rebels. Although, from an information security perspective, no practical consequence followed this statement, it had a huge symbolic significance, since in a clear and decisive manner, an hacker crew crossed the boundary of the cyberspace and took position on a social and political event even before performing any hacking acton.
But in Syria the revolution fought in the fifth domain has reached its “bloody” peak. On August, the 7th 2011 the Anonymous targeted the Syrian Ministry of Defense with a resounding defacement. A couple of days later, in retaliation of the previous defacement, the Syrian Electronic Soldiers defaced Anonplus, the Anonymous Social Network, that had already been, a couple of weeks before, the target of a defacement performed by the same Syrian Crew.
But the “war inside the war” fought between the two groups does not stop here: following the bloody events in Syria, on Sunday, 25th of September, the Anonymous decided to open again the hostilities unleashing a chain of defacement action, against the Syrian Government, hacking and defacing the official sites of seven major Syrian cities, which stayed up in their defaced version for more than 16 hours. The defacement actions kept on the following day in which 11 Syrian Government Sites were defaced as part of the same operation.
Of course a retaliation of the Syrian Electronic Soldier was predictable (and close in time) and targeted, in an unexpected manner, one of the most important US Universities, the University of Harvard which was victim of a resounding defacement on Monday, the 26th of September.
So far the two Cyber Armies have shown an unprecedented impetus in countering their respective acts of cyberwar. Probably the story will not end up here and, most of all, we will have to get used to watch the wars and the revolutions on a double perspective involving real battlefields and virtual battlefields. The problem here is that information security professionals and system administrators are not likely to be mere spectators, but the real soldiers of this non conventional war.