There’s no day without a new high-profile cyber attack. The last victim in order of time is The White House which has confirmed to have been targeted by an unsuccessful spear phishing campaign.
According to officials, hackers linked to China’s government have tried to break into the computer network used by the White House Military Office (WHMO), the president’s military office in charge of some of the U.S. government’s most sensitive communications, including strategic nuclear commands. This is considered one of the U.S. government’s most sensitive computer networks, since it is used by the White House Military Office for nuclear commands. The secrets behind the WHMO include data on the so-called “nuclear football,” the nuclear command and control suitcase used by the president to be in constant communication with strategic nuclear forces commanders for launching nuclear missiles or bombers.
The cyber attack took place earlier this month, and the hackers are believed to have used servers located in China. According to officials, this kind of attack is “not infrequent” and hence there are unspecified “mitigation measures in place” which allowed to identify the attack and isolate the system. As a consequence there is no indication that any exfiltration of data took place.
This is not the first time in which alleged state-sponsored Chinese hackers have breached (or at least have tried to breach) high-profile U.S. targets. On July, 14, 2011, The Pentagon revealed to have lost 24,000 files during a cyber attack happening in March of the same year (suspects were directed to China). On May of the same year several U.S. Defense contractors such as Lockheed Martin, Northrop Grumman and L-3 Communications were hit by targeted attacks carried on with compromised SecurID tokens as a consequence of the infamous RSA breach.
At this link a non-exhaustive collection of the main cyber attacks carried on by Chinese hackers, maybe it is a little old (and should be updated), in any case it is enough to understand how active the Red Dragon is inside the cyber space.
As usual, here is the list of the main cyber attacks for April 2012. A first half of the month which has been characterized by hacktivism, although the time of the resounding attacks seems so far away. Also because, after the arrest of Sabu, the law enforcement agencies (which also were targeted during this month, most of all in UK), made two further arrests of alleged hackers affiliated to the Anonymous Collective: W0rmer, member of CabinCr3w, and two possible members of the infamous collective @TeaMp0isoN.
In any case, the most important breach of the first half of the month has nothing to deal with hacktivism, targeted the health sector and occurred to Utah Department of Health with potentially 750,000 users affected. According to the Last Ponemon Study related to the cost of a breach ($194 per record) applied to the minimum number of users affected (250,000), the monetary impact could be at least $ 55 million.
Another interesting event to mention in the observed period is also the alleged attack against a Chinese Military Contractor, and the takedown of the five most important al-Qaeda forums. On the hacktivist front, it worths to mention a new hijacked call from MI6 to FBI, but also the alleged phone bombing to the same Law Enforcement Agency. Both events were performed by TeamPoison, whose two alleged members were arrested the day after.
For the sample of attacks I tried to identify: the category of the targets, the category of the attacks, and the motivations behind them. Of course this attempt must be taken with caution since in many cases the attacks did not target a single objective. Taking into account the single objectives would have been nearly impossible and prone to errors (I am doing the timeline in my free time!), so the data reported on the charts refer to the single event (and not to all the target affected in the single event).
As usual the references are placed after the jump.
By the way, SQL Injection continues to rule (the question mark indicates attacks possibly performed by SQL Injection, where the term “possibly” indicates the lack of direct evidences…).
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @pausparrows on Twitter for the latest updates.