Here it is the first part of the June 2013 Cyber Attacks timeline covering the first half of the month.
This period has been characterized by the protests in Turkey, that, easy predictable, have also influenced the cyber landscape. Many attacks (in several cases even with noticeable impact) have been carried on in name of OpTurkey.
Other noticeable facts include the attacks against the European Police College (14,000 records affected), the Bangladeshi Air Force recruitment website (110,000 credentials affected), and, most of all, against the Danish Police which affected the country’s driver’s license database, social security database, the shared IT system across the Schengen zone, and the e-mail accounts and passwords of 10,000 police officers and tax officials.
Last but not least, the first two weeks of June has brought us yet another high profile cyber-espionage operation, dubbed NetTraveler.
As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).
And here we are with the second part of the Cyber Attacks Timeline for May (first part here).
The second half of the month has shown an unusual activity with several high-profile breaches motivated by Cyber-Crime or Hacktivism, but also with the disclosure of massive Cyber-Espionage operations.
The unwelcome prize for the “Breach of the Month” is for Yahoo! Japan, that suffered the possible compromising of 22 million users (but in general this was an hard month for the Far East considering that also Groupon Taiwan suffered an illegitimate attempt to access the data of its 4.1 million of customers).
On the cyber-espionage front, the leading role is for the Chinese cyber army, accused of compromising the secret plans of advanced weapons systems from the U.S. and the secret plans for the new headquarter of the Australian Security Intelligence Organization.
On the Hacktivism front, this month has been particularly troubled for the South African Police, whose web site has been hacked with the compromising of 16,000 individuals, including 15,700 whistle-bowlers.
Other noticeable events include the unauthorized access against the well known open source CMS Drupal (causing the reset of 1 million of passwords), the trail of hijacked Twitter accounts by the Syrian Electronic Army and also an unprecedented wave of attacks against targets belonging to Automotive.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).
Here is the summary of the Cyber Attacks Timeline for February. A month that will probably be remembered for the “sophisticated” cyber attacks to the two main social networks: Facebook and Twitter.
But the attacks against the two major social networks were not the only remarkable events of this period. Other governmental and industrial high-profile targets have fallen under the blows of (state-sponsored) cyber criminals: the list of the governmental targets is led by the U.S. Department of Energy and the Japan Ministry of Foreign Affairs, while Bit9, a primary security firm, was also targeted, leading the chart of Industrial targets.
Hacktivists have raised the bar and breached the Federal Reserve, leaking the details of 4,000 U.S. Banks executives. Similarly, the Bush family was also targeted, suffering the leak of private emails.
Even if the list is not as long as the one of January, it includes other important targets, so, scroll it down to have an idea of how fragile our data are inside the cyberspace. Also have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013, and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
While the U.S. and Israel keep on mutually claiming the Stuxnet’s paternity, Kaspersky Lab has unveiled further details about Flame that allow to connect it with the infamous malware targeting Iranian Nuclear Plants.
Are the two 21st century Cyber Weapons really correlated? Due to some architectural differences, the first data seemed to exclude any similarities between the two platforms: the so-called Tilded platform which Stuxnet and Duqu are based on, and the brand new platform from which Flame has been developed. In any case never trust appearances, as a small detail dating back to 2012 has unveiled a landscape that seems completely different from what was previously believed, which suggests the hypothesis that the Stuxnet malware had a kind of “proto flame” inside.
The Cyber Spy Story begins in October 2010 when the automated systems by Kaspersky Lab detected a False (Stuxnet) Positive. This sample apparently looked like a new variant (Worm.Win32.Stuxnet.s) but a deeper analysis showed (then) no apparent correlation with Stuxnet so it was subsequently dubbed Tocy.a.
Only two years later, in 2012, after the discovery of Flame, the russian security firm started to compare the brand new malware with previously detected samples to find any similarities. And guess what? The nearly forgotten Tocy.a was nearly identical to Flame. A further check to logs, allowed to discover that the Tocy.a, apparently an early module of Flame, was actually similar to “resource 207” from Stuxnet, and this similarity was the reason why the automatic system had previously classified it as Stuxnet.
Resource 207 is a 520,192 bytes Stuxnet encrypted DLL file that contains another PE file inside (351,768 bytes). It was found in the 2009 version of Stuxnet, despite it was dropped in the 2010 evolution, with its code merged into other modules. The PE file is actually a Flame Plugin, while the purpose of Resource 207 on the 2009 variant of Stuxnet was just to allow the malware propagation to removable USB drives via autorun.inf, as well as to exploit a then-unknown vulnerability (MS09-025) to escalate privileges in the system during the infection from USB drive.
Given the evidences collected, researchers suggests that, although Flame has been discovered a couple of years after Stuxnet, it was already in existence when Stuxnet was created (Jan-Jun 2009), having already a modular structure. The “Resource 207″ module was removed from Stuxnet in 2010 due to the addition of a new method of propagation (vulnerability MS10-046), while the Flame module in Stuxnet exploited a vulnerability which was unknown then, allowing an escalation of privileges, presumably exploiting MS09-025.
Part of the Flame code was used in Stuxnet despite, after 2009, the evolution of the Flame platform continued independently from Stuxnet.
Probably, this is the second important discovery about Flame after the MD5 Collision Attack, which enabled to malware to hide the download of its own modules behind Windows Updates.
Regarding the MD5 Collision Attack, I suggest you to have a look at this very interesting presentation. You will be amazed in discovering that the first successful demonstration of this attack took, in 2008 (the alleged year in which Flame was created), about 2 days on a cluster of 200 PS3s (corresponding to about $20k on Amazon EC2). Together with the complexity of the attack, this aspect is enough to suggest a state-sponsored origin for the malware (i.e. the need of huge resources and know-how). But there’s more: to make the MD5 Collision Attack successful in Flame, the Attackers, had to overcome a huge obstacle corresponding to prediction the Serial Number of the Certificate (which is based on a sequential certificate number and the current time). Nothing strange apparently, except for the fact that they had a 1-millisecond window to get the certificate issued. What does this mean in simple words? A large number of attempts required to get the certificate issued at the right moment, an effort 10-100x more costly that the original MD5 Collision Attack Demonstration.
Now I understand why the Iran Cyber Warfare Budget is estimated to be “only” USD 100 Million…
- Back to Stuxnet: the missing link (securelist.com)
- Researchers Connect Flame to U.S.-Israel Stuxnet Attack (wired.com)
- Discovery of new “zero-day” exploit links developers of Stuxnet, Flame (arstechnica.com)
It looks like that Christmas approaching is not stopping hackers who targeted a growing number of organizations including several security firms (Kaspersky, Nod 32 and Bitdefender) even if in secondary domains and with “simple” defacements.
Cyber chronicles report of Gemnet, another Certification Authority Breached in Holland (is the 12th security incident targeting CAs in 2011) and several massive data breaches targeting Finland (the fifth this year, affecting 16,000 users), online gambling (UB.com affecting 3.5 million of users), Telco (Telstra, affecting 70,000 users), and gaming, after the well known attacks to Sony, Sega and Nintendo, with Square Enix, which suffered a huge attacks compromising 1,800,000 users (even if it looks like no personal data were affected).
Online Payment services were also targeted by Cybercrookers: a Visa East European processor has been hit by a security breach, but also four Romanian home made hackers have been arrested for a massive credit card fraud affecting 200 restaurants for a total of 80,000 customers who had their data stolen.
As usual, hacktivism was one of the main trends for this first half of the month, which started with a resounding hacking to a Web Server belonging to ACNUR (United Nations Refugees Agency) leaking more than 200 credentials including the one belonging to President Mr. Barack Obama.
But from a mere hactvism perspective, Elections in Russia have been the main trigger as they indirectly generated several cyber events: not only during the election day, in which three web sites (a watchdog and two independent news agencies) were taken down by DDoS attacks, but also in the immediately following days, when a botnet flooded Twitter with Pro Kremlin hashtags, and an independent forum was also taken down by a further DDoS attacks. A trail of events which set a very dangerous precent.
Besides the ACNUR Hack, the Anonymous were also in the spotlight (a quite common occurrence this year) with some sparse attacks targeting several governments including in particular Brazil, inside what is called #OpAmazonia.
Even if not confirmed, it looks like that Anonymous Finland might somehow be related to the above mentioned breach occurred in Finland.
Other interesting events occurred in the first two weeks of December: the 0-day vulnerability affecting Adobe products, immediately exploited by hackers to carry on tailored phishing campaigns and most of hall, a targeted attack to a contractor, Lockheed Martin, but also another occurrence of DNS Cache Poisoning targeting the Republic of Congo domains of Google, Microsoft, Samsung and others.
Last but not least, the controversial GPS Spoofing, which allegedly allowed Iran to capture a U.S. Drone, even the GPS Spoofing on its own does not completely solve the mistery of the capture.
Other victims of the month include Norwich Airport, Coca Cola, and another Law Enforcement Agency (clearusa.org), which is currently unaivalable.
As usual after the page break you find all the references.
E’ di questa mattina la notizia, secondo il New York Times, che il famigerato malware Stuxnet, il virus delle centrali nucleari, sarebbe stato sviluppato da un team composto da Israeliani e Americani (con la collaborazione indiretta degli ingegneri tedeschi di Siemens) presso il complesso israleliano di Dimona, nel bel mezzo del deserto del Negev.
Lo sviluppo di questo terribile malware sarebbe partito nel 2009. Il virus, assurto alla ribalta nel 2010, ha messo in ginocchio un quinto delle centrali nuclerari iraniane ed avrebbe raggiunto parzialmente il suo scopo (molte centrifughe sono state arrestate prima dell’insorgere di danni irreversibili) secondo il quotidiano d’Oltreoceano, riuscendo però a tardare la realizzazione della bomba sino al 2015.
Stuxnet, che prefigura il modello di infezione informatica Advanced Persistent Threat, che nel 2011 turberà i nostri sogni, aveva da subito attirato l’attenzione dei ricercatori di tutto il mondo sia per la sua complessità tecnica (7 vettori di infezione, l’utilizzo massiccio di vulnerabilità 0-day, la possibilità di falsificare certificati ed infine la conoscenza approfondita della tecnologia Siemens relativa alle centrifughe colpite), sia per i presunti richiami all’Antico Testamento più o meno nascosti all’interno del codice.
La complessità alla base del malware è presumibilmente dovuta al fatto che all’inizio del 2008, Siemens avrebbe collaborato con uno dei principali laboratori statunitensi, in Idaho, al fine di identificare le vulnerabilità dei computer che controllano le macchine industriali vendute da Siemens in tutto il mondo. Macchine Industriali che l’Intelligence d’Oltreoceano aveva identificato essere componenti chiave degli impianti di arricchimento dell’Uranio iraniani.
Siemens sostiene comunque che il programma (confermato dall’Idaho National Laboratory) era parte delle attività di routine volte a rendere sicuri dai Cyber-attacchi i propri sistemi che presiedono alle Infrastrutture Critiche, e ad ogni modo non avrebbe dato all’Idaho National Laboratory, parte del Dipartimento dell’Energia responsabile per gli armamenti nucleari USA, la possibilità di identificare i buchi del sistema utilizzati da Stuxnet nel 2010. I risultati sono stati riassunti in questa presentazione mostrata a luglio 2008 al Siemens Automation Summit presso Chicago. Il laboratorio americano, interrogato sulla questione, si è difeso indicando che la presentazione, sebbene contenesse schemi dettagliati, non mostrava come utilizzare le vulnerabilità, rifiutandosi nel contempo di fornire indicazioni relativamente agli aspetti classificati delle attività effettuate congiuntamente con Siemens. Siemens, dal canto suo, ha commentato la nitizia indicando che la presentazione non recava informazioni relative all’ubicazione delle centrifughe. Sta di fatto che la presentazione è recentamente scomparsa dal proprio sito Web.
L’origine politica del progetto partirebbe dagli ultimi mesi dell’Amministrazione Bush, che a gennaio 2009 avrebbe autorizzato (secondo il NYT) un programma nascosto per sabotare i sistemi elettronici ed informatici del complesso iraniano di Natanz, il principale centro di arricchimento dell’Uranio. Al suo insediamento, il Presidente Obama, appena informato del programma, ne avrebbe accelerato lo sviluppo secondo fonti dell’Amministrazione vicine agli strateghi responsabili dei piani volti a contrastare la strategia nucleare iraniana.
Naturalmente gli israeliani, preoccupati dai pericolosi sviluppi della situazione iraniana, non si lasciarono sfuggire l’occasione sviluppando una strategia di contrasto della minaccia iraniana congiunta con gli USA e differente da quella militare sostenuta sino ad allora.
Stuxnet o non Stuxnet, recentemente sia il Segretario di Stato Americano Hilary Clinton, sia il direttore uscente del Mossad, Meir Dagan, hanno confermato separatamente (rispettivamente il 10 e 7 gennaio) la propria convinzione di un ritardo (o meglio di un arretramento di alcuni anni) nei piani di sviluppo nucleare dell’Iran. Ma mentre la signora Clinton ha fatto riferimento alle sanzioni pilotate dagli USA, sanzioni che avrebbero reso difficile all’Iran procurarsi i componenti, e più in generale commerciare con altri paesi della comunità internazionale; il Signor Dagan ha annunciato al Knesset (il parlamento isreaeliano) l’improvviso insorgere di difficoltà tecnologiche in grado di ritardare la preparazione di una bomba iraniana sino al 2015. Da notare che sino ad allora gli israeliani erano stati fermamente convinti dello stato avanzato di realizzazione del programma nucleare iraniano e che il Mossad è stato accusato dall’Iran di essere la longa manus dietro agli attentati in cui è rimasto ucciso Majid Shahriari, scienziato nucleare iraniano e Fereydoon Abbasi, altro scienzato nucleare, è rimasto ferito.
Gli argomenti della spy story ci sono tutti: CIA, Mossad, lo spettro della Guerra Nucleare, il tutto condito con un pizzico di malware, Cyberwar e… perchè no di Sacre Scritture. Sarà davvero l’ultima puntata della storia?