8 ms·

Anonymous releases 10,365 e-mails from the Iranian government

173 points by ssclafani 15y ago

olalonde 15y ago
Password for rar is: opiranopiran
deleted 15y ago
[deleted]
shii 15y ago
You know, I can see real utility in a simple site that lets you upload data garnered from hacking escapades online to be easily searchable and presentable to the general public. It'd have the pastebin feature of a general press statement/greetz file as well. On non-US/EU/whatever harbors to protect from bring being easily taken down. Easy to upload massive amounts of files and can take the load from DoS attacks. Easy way to pipe massive amounts of data via shell. Is spartan so things like SQLi aren't a problem, with competent security in the backend. Basically a CableGates search site for all dox from large scale hacking events like all the high profile recent ones in this year. To make things interesting, it'd use fancy things like schemaless document stores, bitcoin payment processing and fiat-->bitcoin conversion, and other shiny things that are popular nowadays. Pays the bills via ads and subscription-based early access to members. Also has pretty features like alerts via SMS on new uploads, easy viewing of images with jquery, auto-submitter to big news sites, etc. Could function as the role of media relative/press kit for news orgs as well. Makes the process of rolling your own torrent of the data (hostable by thepiratebay amongst other choices) easy and deadsimple. Basically the ultimate CMS for hacking. Whaddya think?
- jackie_singh 15y ago
  Liability would eventually be an issue.
  - shii 15y ago
    Yeah, which is the point of the non-US/Europe hosting and domain registering, etc. Anonymous payment for hosting. What was the name of that really good French host that'd host anything and was aggressive about protecting its customers' privacy again? Basically any and all steps that could be taken to insure anonymity of those running the site. Likewise, no logs are kept of those using the site to search. Maybe minimal ones for security purposes in case of a breach for finding the cause and source. Ideally, little to no personal information of those running the site should be on there anyways. And no Tor please. Tor is a dead argument and very slow.
    - Klonoar 15y ago
      ...did you pay attention to anything that went on with EG8? You have absolutely no guarantee that anything will be safe in France over the next few years, given Sarkozy's stance.
    - deleted 15y ago
      [deleted]
- Mithrandir 15y ago
  Aren't distributed downloads somewhat more hard to block though?
  - shii 15y ago
    Downloads via Bittorrent would continue with ThePirateBay. This would just be an alternative way to view and search through the data without having to personally download it. Hell, this could be quite useful for all those who use services or are employees of Gawker, Fox, PBS, the Iranian and US governments, and whoever else to see if they were part of the pwnd list and what information they have leaked out there. In the process, a learning experience could be developed: change your passwords, and keep them unique across sites. This could be step #1 for a positive outcome.
  - tlrobinson 15y ago
    It could automatically publish the data to BitTorrent as well.
- jackolas 15y ago
  This is what Wikileaks was supposed to be/ originally was. Since they've changed gears a site for en masse data collection of value would be interesting, sadly the "wikileaks rivals" have no interest in this... so it's probably a good plan.
  - deleted 15y ago
    [deleted]
  - shii 15y ago
    Right, that's what those[1,2] Wikileaks-specific sites were intended for. I'm imaging one for general use to dump by anyone that doesn't get filtered and screened by Wikikeaks. Also, I don't think Wikileaks would go along with the release of so much personal info. They also have their hands quite full with the cables affair which is ongoing and not near completely released yet (as is my understanding, correct me of wrong). [1]: http://www.cablegatesearch.net/search.php http://www.cablegatesearch.net/search.php [2:] http://cablesearch.org/ http://cablesearch.org/
  - canadaduane 15y ago
    They changed gears because it turned out that passive reporting of giant fact dumps did not garner attention nor have significant impact on the world. As soon as they began taking on the role of curation or reporting on top of their cache of data, that's when things really took off (according to Assange).
    - roc 15y ago
      Well, they certainly went from 'obscure curiosity' to 'house-hold name and infamy.'
- dariencrane 15y ago
  I think it's hilarious how a story about leaked Iranian emails somehow led to bitcoins.
  - FlowerPower 15y ago
    My precious, precious, bitcoins... my precious.
- mikecane 15y ago
  >>>You know, I can see real utility in a simple site that lets you upload data garnered from hacking escapades online to be easily searchable and presentable to the general public. Did you ever read Stephenson's Snow Crash? You just described what the CIA becomes in that novel: crowd-sourced intel uploaded to a central site.
  - alanfalcon 15y ago
    That had one incentive lacking in the proposal though: cash to the uploader in exchange for access. Also, apparently, some rudimentary gatekeeping on what was uploaded (though it seems some people were able to upload tons of useless information for a while before getting the boot).
  - Angostura 15y ago
    I thought that idea came from Stross' Accelerando - probably both actually.
    - streety 15y ago
      I'm actually reading Accelerando at the moment but somehow totally forgot about the crowd sourcing aspect of the new look CIA. Investigating further Accelerando was published after Snow Crash by a fair margin. http://en.wikipedia.org/wiki/Accelerando_%28novel%29 http://en.wikipedia.org/wiki/Accelerando_%28novel%29 http://en.wikipedia.org/wiki/Snow_crash http://en.wikipedia.org/wiki/Snow_crash
- ahamlett 15y ago
  Would it be filtered to only hack data submissions?
alanh 15y ago
What language is the content in?
- Mithrandir 15y ago
  It's mixed English and Persian. Majority is English.
scottjad 15y ago
Persian or English?
- dimmuborgir 15y ago
  Both English and Farsi.
Mithrandir 15y ago
The majority (or all of them, I can't tell) are directed to "e_visa@mfa.gov.ir" which seems to be related to http://evisa.mfa.gov.ir:7780/mfa/ http://evisa.mfa.gov.ir:7780/mfa/. That's the "Ministry of Foreign Affairs Online Electronic Visa Service" Also, the main website (http://mfa.gov.ir/ http://mfa.gov.ir/) is dead.
iandanforth 15y ago
At first glance it looks like thousands of really boring visa requests. Anyone find anything interesting?
- vrikhter 15y ago
  I picked out a few dozen random ones - specifically with different subject lines and got nothing. Some passports in there, probably not good for the individuals.
- leon_ 15y ago
  yeah, one request in german with an attached zipped "passport copy" which extracts to an .exe I don't want to know how often embassy employees actually open such .exe files.
  - yaix 15y ago
    At least once. You seem to have found the attack vector. ;)
  - karl_nerd 15y ago
    please post specifically this one somewhere!
scottjad 15y ago
One of the first email: "I decided to contact you for a business transaction to transfer funds for Investment purpose" Apparently even scam emails are TOP SECRET.
tansey 15y ago
1) The emails are mostly English 2) They're primarily Visa approval/rejection notices 99% of the emails are boring, auto-send text, examples: EMAIL A ------ Dear frederic norbert didier Your visa request has received successfully. You application ID is:99027 You will also be notified about your application process by e-mail. Thank you. EMAIL B -------- With reference to your visa application No 1000116698-1000102795 , we are glad to inform you that your request is approved under No. 901841. . After 3 working days of receiving this approval , please approach in person the Iranian Embassy / General Consulate in LAHORE . and collect your required visa . Best regards,M.F.A / Passport and Visa Office . --------- Pretty boring stuff. There is some Persian writing above the text in EMAIL B variants, so maybe that is interesting. I do not see any interesting English-text content.
- anigbrowl 15y ago
  It is boring in one sense, but in another way that is what makes it exciting. you and I have little or no use for this information, but it's great from an intelligence standpoint. I'm not entirely sure about the provenance. I've often wondered if western governments use anon as a deniable vector for track II diplomacy. Either way, interesting.
  - kposehn 15y ago
    Hmm, that is a good point there. I'm not so sure this intel is that useful all around outside tracking people that applied for Iranian visas. That said, I haven't perused these emails and I don't plan to. There could easily be other patterns here worth going over.
Mithrandir 15y ago
See also: http://piratepad.net/30Dz8cCdv5 http://piratepad.net/30Dz8cCdv5 (Release Notes) http://opiran.iranserv.com/ http://opiran.iranserv.com/ (Their chatroom) http://www.mediafire.com/?6d8bh7w4c938m4j http://www.mediafire.com/?6d8bh7w4c938m4j (The files) http://piratepad.net/498yehfsdk http://piratepad.net/498yehfsdk (Discussions about vulnerable .ir servers) http://piratepad.net/JAI223D1jp http://piratepad.net/JAI223D1jp (Discussions about vulnerable .ir servers) http://thenextweb.com/industry/2011/06/03/anonymous-steals-10000-iranian-government-emails-plans-ddos-attack/ http://thenextweb.com/industry/2011/06/03/anonymous-steals-1... (News Article)
- shii 15y ago
  The discussions are particularly interesting. Goes over the methods employed with a few tools mentioned, vulnerable and possible targets.
- brianleb 15y ago
  The second pirate pad is the most interesting (to me). "2a. Suggestions on how to proceed I know that there is an urge to "run and gun" this, perhaps go on a mad defacing spree, or start dropping anonymous based UI icons into the site's buttons, guy fakes banners, etc. We must resist this urge. I think there is a tremendous opportunity if we get even 3 moderately popular anti-green sites. Let's look at sites A,B, and C. What we should consider, is the ability to plant stories inside A, link to them from B, and then plant stories in B, and link to A and B's stories from C - the site with the most traffic. The stories should be posted, if possible, two days ago, or yesterday, assuming a blog-like ability to set times and dates when you post. Anyway, do what suits, thiswas just a thought. We may not have the luxury of time, in which case raw vandalization may do it - just put green party banners on the home page, and "anonymous" in text at the copyright on the bottom - that is just so they don't blame the green party for the exploit." Interesting. It seems to indicate that perhaps some of Anonymous' actors have matured, or at least were able to use the petty vandalism phase of the group as a learning process. I can't help but feel like with Anonymous talking about planting fake news, the whole government/HBGary thing about planting fake news, etc. that in the near future there may be some (albeit minor) crisis on the internet about finding news you can trust. Until the internet figures out how to route around the damage, of course.
tomelders 15y ago
Looks like Iran is doing business with several Nigerian dignitaries, helping them shift millions of US Dollars out of the country through Western Union. What a scandal.
thelicx 15y ago
Password for rar is: opiranopiran
thelicx 15y ago
Piratebay is not accessible from Italy. If you want to open the website from there use a proxy like http://hidemyass.com/ http://hidemyass.com/
- kmfrk 15y ago
  Or http://anonymouse.org/cgi-bin/anon-www.cgi/http://thepiratebay.org http://anonymouse.org/cgi-bin/anon-www.cgi/http://thepirateb....
freeth 15y ago
I'm currently trying to see if I can find anything to do with: http://freethehikers.org/ http://freethehikers.org/ Josh Fattal was a friend of mine in high school. Any help is appreciated.

173 points by ssclafani 15y ago

olalonde 15y ago

Password for rar is: opiranopiran

deleted 15y ago

[deleted]

shii 15y ago

You know, I can see real utility in a simple site that lets you upload data garnered from hacking escapades online to be easily searchable and presentable to the general public. It'd have the pastebin feature of a general press statement/greetz file as well. On non-US/EU/whatever harbors to protect from bring being easily taken down. Easy to upload massive amounts of files and can take the load from DoS attacks. Easy way to pipe massive amounts of data via shell. Is spartan so things like SQLi aren't a problem, with competent security in the backend. Basically a CableGates search site for all dox from large scale hacking events like all the high profile recent ones in this year. To make things interesting, it'd use fancy things like schemaless document stores, bitcoin payment processing and fiat-->bitcoin conversion, and other shiny things that are popular nowadays. Pays the bills via ads and subscription-based early access to members. Also has pretty features like alerts via SMS on new uploads, easy viewing of images with jquery, auto-submitter to big news sites, etc. Could function as the role of media relative/press kit for news orgs as well. Makes the process of rolling your own torrent of the data (hostable by thepiratebay amongst other choices) easy and deadsimple. Basically the ultimate CMS for hacking. Whaddya think?

jackie_singh 15y ago
Liability would eventually be an issue.
- shii 15y ago
  Yeah, which is the point of the non-US/Europe hosting and domain registering, etc. Anonymous payment for hosting. What was the name of that really good French host that'd host anything and was aggressive about protecting its customers' privacy again? Basically any and all steps that could be taken to insure anonymity of those running the site. Likewise, no logs are kept of those using the site to search. Maybe minimal ones for security purposes in case of a breach for finding the cause and source. Ideally, little to no personal information of those running the site should be on there anyways. And no Tor please. Tor is a dead argument and very slow.
  - Klonoar 15y ago
    ...did you pay attention to anything that went on with EG8? You have absolutely no guarantee that anything will be safe in France over the next few years, given Sarkozy's stance.
  - deleted 15y ago
    [deleted]
Mithrandir 15y ago
Aren't distributed downloads somewhat more hard to block though?
- shii 15y ago
  Downloads via Bittorrent would continue with ThePirateBay. This would just be an alternative way to view and search through the data without having to personally download it. Hell, this could be quite useful for all those who use services or are employees of Gawker, Fox, PBS, the Iranian and US governments, and whoever else to see if they were part of the pwnd list and what information they have leaked out there. In the process, a learning experience could be developed: change your passwords, and keep them unique across sites. This could be step #1 for a positive outcome.
- tlrobinson 15y ago
  It could automatically publish the data to BitTorrent as well.
jackolas 15y ago
This is what Wikileaks was supposed to be/ originally was. Since they've changed gears a site for en masse data collection of value would be interesting, sadly the "wikileaks rivals" have no interest in this... so it's probably a good plan.
- deleted 15y ago
  [deleted]
- shii 15y ago
  Right, that's what those[1,2] Wikileaks-specific sites were intended for. I'm imaging one for general use to dump by anyone that doesn't get filtered and screened by Wikikeaks. Also, I don't think Wikileaks would go along with the release of so much personal info. They also have their hands quite full with the cables affair which is ongoing and not near completely released yet (as is my understanding, correct me of wrong). [1]: http://www.cablegatesearch.net/search.php http://www.cablegatesearch.net/search.php [2:] http://cablesearch.org/ http://cablesearch.org/
- canadaduane 15y ago
  They changed gears because it turned out that passive reporting of giant fact dumps did not garner attention nor have significant impact on the world. As soon as they began taking on the role of curation or reporting on top of their cache of data, that's when things really took off (according to Assange).
  - roc 15y ago
    Well, they certainly went from 'obscure curiosity' to 'house-hold name and infamy.'
dariencrane 15y ago
I think it's hilarious how a story about leaked Iranian emails somehow led to bitcoins.
- FlowerPower 15y ago
  My precious, precious, bitcoins... my precious.
mikecane 15y ago
>>>You know, I can see real utility in a simple site that lets you upload data garnered from hacking escapades online to be easily searchable and presentable to the general public. Did you ever read Stephenson's Snow Crash? You just described what the CIA becomes in that novel: crowd-sourced intel uploaded to a central site.
- alanfalcon 15y ago
  That had one incentive lacking in the proposal though: cash to the uploader in exchange for access. Also, apparently, some rudimentary gatekeeping on what was uploaded (though it seems some people were able to upload tons of useless information for a while before getting the boot).
- Angostura 15y ago
  I thought that idea came from Stross' Accelerando - probably both actually.
  - streety 15y ago
    I'm actually reading Accelerando at the moment but somehow totally forgot about the crowd sourcing aspect of the new look CIA. Investigating further Accelerando was published after Snow Crash by a fair margin. http://en.wikipedia.org/wiki/Accelerando_%28novel%29 http://en.wikipedia.org/wiki/Accelerando_%28novel%29 http://en.wikipedia.org/wiki/Snow_crash http://en.wikipedia.org/wiki/Snow_crash
ahamlett 15y ago
Would it be filtered to only hack data submissions?

alanh 15y ago

What language is the content in?

Mithrandir 15y ago
It's mixed English and Persian. Majority is English.

scottjad 15y ago

Persian or English?

dimmuborgir 15y ago
Both English and Farsi.

Mithrandir 15y ago

The majority (or all of them, I can't tell) are directed to "e_visa@mfa.gov.ir" which seems to be related to http://evisa.mfa.gov.ir:7780/mfa/ http://evisa.mfa.gov.ir:7780/mfa/. That's the "Ministry of Foreign Affairs Online Electronic Visa Service" Also, the main website (http://mfa.gov.ir/ http://mfa.gov.ir/) is dead.

iandanforth 15y ago

At first glance it looks like thousands of really boring visa requests. Anyone find anything interesting?

vrikhter 15y ago
I picked out a few dozen random ones - specifically with different subject lines and got nothing. Some passports in there, probably not good for the individuals.
leon_ 15y ago
yeah, one request in german with an attached zipped "passport copy" which extracts to an .exe I don't want to know how often embassy employees actually open such .exe files.
- yaix 15y ago
  At least once. You seem to have found the attack vector. ;)
- karl_nerd 15y ago
  please post specifically this one somewhere!

scottjad 15y ago

One of the first email: "I decided to contact you for a business transaction to transfer funds for Investment purpose" Apparently even scam emails are TOP SECRET.

tansey 15y ago

1) The emails are mostly English 2) They're primarily Visa approval/rejection notices 99% of the emails are boring, auto-send text, examples: EMAIL A ------ Dear frederic norbert didier Your visa request has received successfully. You application ID is:99027 You will also be notified about your application process by e-mail. Thank you. EMAIL B -------- With reference to your visa application No 1000116698-1000102795 , we are glad to inform you that your request is approved under No. 901841. . After 3 working days of receiving this approval , please approach in person the Iranian Embassy / General Consulate in LAHORE . and collect your required visa . Best regards,M.F.A / Passport and Visa Office . --------- Pretty boring stuff. There is some Persian writing above the text in EMAIL B variants, so maybe that is interesting. I do not see any interesting English-text content.

anigbrowl 15y ago
It is boring in one sense, but in another way that is what makes it exciting. you and I have little or no use for this information, but it's great from an intelligence standpoint. I'm not entirely sure about the provenance. I've often wondered if western governments use anon as a deniable vector for track II diplomacy. Either way, interesting.
- kposehn 15y ago
  Hmm, that is a good point there. I'm not so sure this intel is that useful all around outside tracking people that applied for Iranian visas. That said, I haven't perused these emails and I don't plan to. There could easily be other patterns here worth going over.

Mithrandir 15y ago

See also: http://piratepad.net/30Dz8cCdv5 http://piratepad.net/30Dz8cCdv5 (Release Notes) http://opiran.iranserv.com/ http://opiran.iranserv.com/ (Their chatroom) http://www.mediafire.com/?6d8bh7w4c938m4j http://www.mediafire.com/?6d8bh7w4c938m4j (The files) http://piratepad.net/498yehfsdk http://piratepad.net/498yehfsdk (Discussions about vulnerable .ir servers) http://piratepad.net/JAI223D1jp http://piratepad.net/JAI223D1jp (Discussions about vulnerable .ir servers) http://thenextweb.com/industry/2011/06/03/anonymous-steals-10000-iranian-government-emails-plans-ddos-attack/ http://thenextweb.com/industry/2011/06/03/anonymous-steals-1... (News Article)

shii 15y ago
The discussions are particularly interesting. Goes over the methods employed with a few tools mentioned, vulnerable and possible targets.
brianleb 15y ago
The second pirate pad is the most interesting (to me). "2a. Suggestions on how to proceed I know that there is an urge to "run and gun" this, perhaps go on a mad defacing spree, or start dropping anonymous based UI icons into the site's buttons, guy fakes banners, etc. We must resist this urge. I think there is a tremendous opportunity if we get even 3 moderately popular anti-green sites. Let's look at sites A,B, and C. What we should consider, is the ability to plant stories inside A, link to them from B, and then plant stories in B, and link to A and B's stories from C - the site with the most traffic. The stories should be posted, if possible, two days ago, or yesterday, assuming a blog-like ability to set times and dates when you post. Anyway, do what suits, thiswas just a thought. We may not have the luxury of time, in which case raw vandalization may do it - just put green party banners on the home page, and "anonymous" in text at the copyright on the bottom - that is just so they don't blame the green party for the exploit." Interesting. It seems to indicate that perhaps some of Anonymous' actors have matured, or at least were able to use the petty vandalism phase of the group as a learning process. I can't help but feel like with Anonymous talking about planting fake news, the whole government/HBGary thing about planting fake news, etc. that in the near future there may be some (albeit minor) crisis on the internet about finding news you can trust. Until the internet figures out how to route around the damage, of course.

tomelders 15y ago

Looks like Iran is doing business with several Nigerian dignitaries, helping them shift millions of US Dollars out of the country through Western Union. What a scandal.

thelicx 15y ago

Password for rar is: opiranopiran

thelicx 15y ago

Piratebay is not accessible from Italy. If you want to open the website from there use a proxy like http://hidemyass.com/ http://hidemyass.com/

kmfrk 15y ago
Or http://anonymouse.org/cgi-bin/anon-www.cgi/http://thepiratebay.org http://anonymouse.org/cgi-bin/anon-www.cgi/http://thepirateb....

freeth 15y ago

I'm currently trying to see if I can find anything to do with: http://freethehikers.org/ http://freethehikers.org/ Josh Fattal was a friend of mine in high school. Any help is appreciated.