6 ms·

CIA Email Hackers Return with Major Law Enforcement Breach

93 points by CPLX 11y ago

mschuster91 11y ago
I don't get what these hackers are after by pastebin'ing their attack. It can't be money (as mentioned, by selling the data to gossip magazines they could earn more Bitcoins than MtGox), it can't be security (or else they'd have posted how they gained entry) and it can't really be fame as the feds will stop at nothing to hunt them down now...
- diggan 11y ago
  It's pretty clear since they even wrote about the motive in the article. >I'm the bad guy in the news that's targeting the US government for funding Israel. > US government to stop funding Israel and for them to stop killing innocent people > Did you know there was over 26,000 civilian deaths due to war-related violence in the Afghanistan war > Did you know the US military bombed an Afghan hospital? [0] So, basically it's about freedom from the US government suppressing other states. [0] http://pastebin.com/KtN8FqPu http://pastebin.com/KtN8FqPu that is linked in the article
  - SolarNet 11y ago
    It sounds less about the states the U.S. is suppressing and more the people the U.S. is oppressing, the states are just side effect of that.
  - wcummings 11y ago
    >Free Palestine. The United States government funds Israel, and in Israel they kill innocent people. We're going to do it until they stop funding Israel or until we get raided. >I'm below the age of 22 years old. I smoke pot. And I live in America >I'm going to go to Russia and chill with Snowden because I know the government is pretty mad about this I'm probably going to get tortured. I'm actually a pretty fast runner. >The government and the police. Like the White House people. They're losers. Looks like they did it for the lulz to me. http://money.cnn.com/2015/10/19/technology/cia-hack-john-brennan/ http://money.cnn.com/2015/10/19/technology/cia-hack-john-bre...
    - madaxe_again 11y ago
      Yes, Palestine sure is hilarious, isn't it? I laud his reasons.
      - anonbanker 11y ago
        I laud his reasons as well, and I defend to the death his right to speak them.
- compbio 11y ago
  Without any proof for or against, it is interesting to view this attack as a state-sponsored PSYOP.
hellofunk 11y ago
>“Just to clear this up,” Cracka tweeted on Thursday about the breach of the JABS database. “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.” If this is true, I'm a little surprised and disappointed. The U.S. can spend trillions on its military conflicts around the world, but can't do good cyber security? Even when handled with the highest precision, a massive cyber security team would be much less costly than building warships and the next space-age jet fighter, surely. How is it possible for a country with the resources of the U.S. to miss such important areas of technological security, such that a team of "crackas", as they call themselves, can come along and exploit it? Is awareness of the needs of the digital age really so far behind the technology itself?
- maxerickson 11y ago
  They probably figured out an individual's password. Maybe the system shouldn't allow outside access to individuals with just a password, but it isn't really that shocking that they got into it. I like how grandiose that tweet is, as if Xi Jinping starts every meeting by making fun of a few felony mug shots, look at the mustache on this guy, hahaha.
  - hellofunk 11y ago
    >Maybe the system shouldn't allow outside access to individuals with just a password Well that is exactly my point. If that is indeed possible, then why? Who is running the American government networks? Are they really so naive?
    - wfo 11y ago
      They are just like every IT worker in a large non-software industry: instructed by their boss that more important employees than you are currently unable to do their jobs because of your security restrictions, so remove them or be fired.
- deleted 11y ago
  [deleted]
IIAOPSW 11y ago
>Sealed arrest records are also quite common in hacker investigations when law enforcement officials quietly arrest an individual, then flip him to work as a confidential informant with agents to capture others. So I guess they'll be able to foresee when one of their crew gets turned al la lulzsec.
- lemevi 11y ago
  Yeah, I don't think this is going to turn out well for them. Granted lulzsec was broken up by having a mole so it might make it more difficult for law enforcement, but then again the FBI has been known to use blackhat means to track people across tor[0] and use malware to obtain information[1]. [0] http://www.wired.com/2013/09/freedom-hosting-fbi/ http://www.wired.com/2013/09/freedom-hosting-fbi/ [1] http://www.wired.com/2014/08/operation_torpedo/ http://www.wired.com/2014/08/operation_torpedo/
deleted 11y ago
[deleted]
cm2187 11y ago
Soon, someone is going to post a similar breach, where they gained access to anyone's browsing history in the UK! Brave new world...
pakled_engineer 11y ago
Bragging about your exploits on Twitter and giving interviews to Wired is what informants do to fish for more hackers to snitch on.
backtoyoujim 11y ago
> which is supposed to be available only to the FBI and other law enforcement agencies around the country. I think that a group one million possibly armed users with access to a secret shared database and private IM client shouldn't be reduced by by the adverb "only".
- function_seven 11y ago
  "Only" in this context doesn't mean "few". If you take it out of the quoted sentence, then the portal could also be available to veterinarians, carnival barkers, and scuba instructors. But it's not supposed to be available to those people, only to the FBI and other law enforcement agencies.
fiatmoney 11y ago
It's a good default assumption that any database that more than 10k people have access to is compromised or trivially compromisable.
hackuser 11y ago
Have you ever seen an organization that secured valuable data effectively? I don't mean one where they followed some standards or had the right policy, but where, as implemented by IT and as practiced by users and admins, the data was secured so well that attackers would not steal the data - where it was too difficult to be worthwhile. I mean an organization you know intimately, where you know how the sausage is made. Generally, the reality I've seen is security through obscurity.
- AndrewKemendo 11y ago
  Classic and common modus tollens. That you don't know of one does not mean they don't exist. But to your question yes, I have seen one. It all hinged on people actually internalizing security measures such that it was part of how they lived their lives.
- walshemj 11y ago
  I used to work for a major telco and any sensitive lines here monitored looking up C or Liz II's telephone details would ring a lot of alarms. And then you and had better hope MI5 got to you before BT's internal security did. The fact that the DCI's details where not secured is shocking the CEO, Chairman head of security should be fired. Id probably fire the entre call centre shift to make the point as well.
  - hackuser 11y ago
    Haven't the news media hacked into royal family phones, voicemail, etc. multiple times? Maybe that wasn't via BT.
    - biot 11y ago
      The news media don't have access to British Telecom's internal systems, so any hacking they do is outside of internal security controls. Here, BT != bluetooth (which may indeed be the attack vector for many hacks).
      - 11y ago
whoopdedo 11y ago
> Enterprise File Transfer Service > IDEAFX—a “web-based, file/folder sharing capabilities for cross-organizational teams” > Justice Enterprise File Sharing Can we talk for a bit about how much money is being spent to do the same thing three times?
gaius 11y ago
Two words: air gap I remember when Lockheed got hacked, I thought, why the hell were their CAD workstations connected to the Internet at all? So the engineers could check Facebook? And with so-called "Internet of things" it's only going to get more ludicrous.

93 points by CPLX 11y ago

I don't get what these hackers are after by pastebin'ing their attack. It can't be money (as mentioned, by selling the data to gossip magazines they could earn more Bitcoins than MtGox), it can't be security (or else they'd have posted how they gained entry) and it can't really be fame as the feds will stop at nothing to hunt them down now...

diggan 11y ago
It's pretty clear since they even wrote about the motive in the article. >I'm the bad guy in the news that's targeting the US government for funding Israel. > US government to stop funding Israel and for them to stop killing innocent people > Did you know there was over 26,000 civilian deaths due to war-related violence in the Afghanistan war > Did you know the US military bombed an Afghan hospital? [0] So, basically it's about freedom from the US government suppressing other states. [0] http://pastebin.com/KtN8FqPu http://pastebin.com/KtN8FqPu that is linked in the article
- SolarNet 11y ago
  It sounds less about the states the U.S. is suppressing and more the people the U.S. is oppressing, the states are just side effect of that.
- wcummings 11y ago
  >Free Palestine. The United States government funds Israel, and in Israel they kill innocent people. We're going to do it until they stop funding Israel or until we get raided. >I'm below the age of 22 years old. I smoke pot. And I live in America >I'm going to go to Russia and chill with Snowden because I know the government is pretty mad about this I'm probably going to get tortured. I'm actually a pretty fast runner. >The government and the police. Like the White House people. They're losers. Looks like they did it for the lulz to me. http://money.cnn.com/2015/10/19/technology/cia-hack-john-brennan/ http://money.cnn.com/2015/10/19/technology/cia-hack-john-bre...
  - madaxe_again 11y ago
    Yes, Palestine sure is hilarious, isn't it? I laud his reasons.
    - anonbanker 11y ago
      I laud his reasons as well, and I defend to the death his right to speak them.
compbio 11y ago
Without any proof for or against, it is interesting to view this attack as a state-sponsored PSYOP.

hellofunk 11y ago

>“Just to clear this up,” Cracka tweeted on Thursday about the breach of the JABS database. “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.” If this is true, I'm a little surprised and disappointed. The U.S. can spend trillions on its military conflicts around the world, but can't do good cyber security? Even when handled with the highest precision, a massive cyber security team would be much less costly than building warships and the next space-age jet fighter, surely. How is it possible for a country with the resources of the U.S. to miss such important areas of technological security, such that a team of "crackas", as they call themselves, can come along and exploit it? Is awareness of the needs of the digital age really so far behind the technology itself?

maxerickson 11y ago
They probably figured out an individual's password. Maybe the system shouldn't allow outside access to individuals with just a password, but it isn't really that shocking that they got into it. I like how grandiose that tweet is, as if Xi Jinping starts every meeting by making fun of a few felony mug shots, look at the mustache on this guy, hahaha.
- hellofunk 11y ago
  >Maybe the system shouldn't allow outside access to individuals with just a password Well that is exactly my point. If that is indeed possible, then why? Who is running the American government networks? Are they really so naive?
  - wfo 11y ago
    They are just like every IT worker in a large non-software industry: instructed by their boss that more important employees than you are currently unable to do their jobs because of your security restrictions, so remove them or be fired.
deleted 11y ago
[deleted]

IIAOPSW 11y ago

>Sealed arrest records are also quite common in hacker investigations when law enforcement officials quietly arrest an individual, then flip him to work as a confidential informant with agents to capture others. So I guess they'll be able to foresee when one of their crew gets turned al la lulzsec.

lemevi 11y ago
Yeah, I don't think this is going to turn out well for them. Granted lulzsec was broken up by having a mole so it might make it more difficult for law enforcement, but then again the FBI has been known to use blackhat means to track people across tor[0] and use malware to obtain information[1]. [0] http://www.wired.com/2013/09/freedom-hosting-fbi/ http://www.wired.com/2013/09/freedom-hosting-fbi/ [1] http://www.wired.com/2014/08/operation_torpedo/ http://www.wired.com/2014/08/operation_torpedo/

deleted 11y ago

[deleted]

cm2187 11y ago

Soon, someone is going to post a similar breach, where they gained access to anyone's browsing history in the UK! Brave new world...

pakled_engineer 11y ago

Bragging about your exploits on Twitter and giving interviews to Wired is what informants do to fish for more hackers to snitch on.

backtoyoujim 11y ago

> which is supposed to be available only to the FBI and other law enforcement agencies around the country. I think that a group one million possibly armed users with access to a secret shared database and private IM client shouldn't be reduced by by the adverb "only".

function_seven 11y ago
"Only" in this context doesn't mean "few". If you take it out of the quoted sentence, then the portal could also be available to veterinarians, carnival barkers, and scuba instructors. But it's not supposed to be available to those people, only to the FBI and other law enforcement agencies.

fiatmoney 11y ago

It's a good default assumption that any database that more than 10k people have access to is compromised or trivially compromisable.

hackuser 11y ago

Have you ever seen an organization that secured valuable data effectively? I don't mean one where they followed some standards or had the right policy, but where, as implemented by IT and as practiced by users and admins, the data was secured so well that attackers would not steal the data - where it was too difficult to be worthwhile. I mean an organization you know intimately, where you know how the sausage is made. Generally, the reality I've seen is security through obscurity.

AndrewKemendo 11y ago
Classic and common modus tollens. That you don't know of one does not mean they don't exist. But to your question yes, I have seen one. It all hinged on people actually internalizing security measures such that it was part of how they lived their lives.
walshemj 11y ago
I used to work for a major telco and any sensitive lines here monitored looking up C or Liz II's telephone details would ring a lot of alarms. And then you and had better hope MI5 got to you before BT's internal security did. The fact that the DCI's details where not secured is shocking the CEO, Chairman head of security should be fired. Id probably fire the entre call centre shift to make the point as well.
- hackuser 11y ago
  Haven't the news media hacked into royal family phones, voicemail, etc. multiple times? Maybe that wasn't via BT.
  - biot 11y ago
    The news media don't have access to British Telecom's internal systems, so any hacking they do is outside of internal security controls. Here, BT != bluetooth (which may indeed be the attack vector for many hacks).
    - 11y ago

whoopdedo 11y ago

> Enterprise File Transfer Service > IDEAFX—a “web-based, file/folder sharing capabilities for cross-organizational teams” > Justice Enterprise File Sharing Can we talk for a bit about how much money is being spent to do the same thing three times?

gaius 11y ago

Two words: air gap I remember when Lockheed got hacked, I thought, why the hell were their CAD workstations connected to the Internet at all? So the engineers could check Facebook? And with so-called "Internet of things" it's only going to get more ludicrous.