6 ms·

Anonymous Hacks NATO, Steals GB Of Data

89 points by Garbage 15y ago

redthrowaway 15y ago
Given that Anon has yet use anything other than simple SQLi attacks, I wonder where this data could have been stored (and, by extension, how secret it is). If it was on a public webserver, then one would expect it to be not much more than reports and presentations.
- gasull 15y ago
  I read somewhere that Anonymous used a 0day exploit against some church they attacked a few months ago.
  - redthrowaway 15y ago
    Who, the WBC? Pretty sure that was just bluster.
    - gasull 15y ago
      Video of Anonymous hacking WBC live during an interview: http://boingboing.net/2011/02/24/anonymous-hacks-west.html http://boingboing.net/2011/02/24/anonymous-hacks-west.html Tweet from AnonymousIRC saying that they used a 0day exploit: https://twitter.com/#!/AnonymousIRC/status/40839581074980864 https://twitter.com/#!/AnonymousIRC/status/40839581074980864
- aw3c2 15y ago
  Given that Anon has yet use anything other than simple SQLi attacks source?
- dekz 15y ago
  Replace Anon with LulzSec and you're correct. Anon != LulzSec
  - TobbenTM 15y ago
    True
paralogic 15y ago
Given the frequency of these events, the wide media coverage and the media outlets covering the story, this reminds me about the days before the attacks in afghanistan and the early days of the war on terror. I wouldn't be surprised if this is just a media campaign to introduce stronger internet controls. Maybe raids will also be executed on various opposing sites under the pretext of 'the war on anonymous'.
flexd 15y ago
Considering "NATO secret" machines are not allowed on networks connected to the internet they hopefully do not have anything to put people on the ground in danger. There could however have been a breach in protocols and someone accidentally hooked something up but I doubt something that serious could have happened. It's not like you accidentally hook a fileserver up to the internet. Confidential documents would (could) still be bad but there are strict rules about storing those as well.
- yaix 15y ago
  If it is so easy to break into the NATO network, then these "people on the ground" have been in real danger for a long time aleady. Because enemy gov't just may have had the idea of doing the break-on themselves, but without telling anybody about it.
- gorgoroth666 15y ago
  Don't be delusional, there were/are obviously beaches which are not red herrings. And all that "classified nato secret", "not allowed on networks connected to the internet", "breach in protocols" and "strict rules" are BS. But to say for sure, we would need a thorough analysis of the incriminated data.
  - flexd 15y ago
    I'm not saying this isn't bad enough. I'm just saying there are rules in place to prevent these kinds of things. Like physical network separation and machines with disabled interfaces (like network, usb, firewire). You would require physical access to steal data from those machines and it would be either guarded or locked away. Data security is taken very seriously within the military & NATO but I can't speak for how other countries do things. Accidents happen, things are poorly secured. I'm just speaking from my own experience, even if it is limited.
    - gorgoroth666 15y ago
      NATO include forces in a lot of countries already. I'm saying a lot of them do poor jobs. Are you saying they are so good that the data incriminated is either fake or a deliberate attempt at misinformation by Nato ?
yaix 15y ago
If a few kids with some SQL knowledge can breach NATO computers in a weekend, then who can't? Looks like any gov't with a intelligence service of more than 3 people has had access to secret NATO documents for a long time. That can't be good.
- lucasjung 15y ago
  These documents almost certainly were not classified SECRET: actual classified documents are kept on a separate network that is not connected to the regular internet. They were most likely unclassified documents that were sensitive enough to be kept to restricted access, but not important enough to be classified. If they actually were classified, that means that there was a major breach of protocols just in having them on computers connected to the regular internet.
  - gorgoroth666 15y ago
    It's not like a major breach of protocol is a very rare thing as all personels are not trained at security to say the least. I'd bet those documents are pretty damn secret.
    - lucasjung 15y ago
      Anyone with access to classified information is given extensive security training, with regular refreshers. This means that if classified documents to make their way onto an unclassified system, it was done by someone who was specifically trained not to do so. You are correct that, despite this training, classified information do sometimes accidentally make it onto unclassified computers. It is usually discovered almost immediately (most often by the person who did it), and almost always involves very small amounts of information (it's hard to "accidentally" copy large numbers of files). The bigger the collection of documents, the more likely it is to be discovered quickly. These events are a huge deal because the cleanup process is so extensive and thorough. I've read a lot of conflicting reports in various articles, probably because most journalists don't understand that words like "secret," "classified," "confidential," "restricted," and "sensitive" all have very specific meanings in a military context and are not interchangeable. As far as I can piece together, the documents in question were merely "restricted," not secret (not classified at all, for that matter).
deleted 15y ago
[deleted]
DrJokepu 15y ago
I'll just leave this here. DOSing Visa and Mastercard is one thing, espionage is something very different. USC Title 18 § 794 Gathering or delivering defense information to aid foreign government Whoever, with intent or reason to believe that it is to be used to the injury of the United States or to the advantage of a foreign nation, communicates, delivers, or transmits, or attempts to communicate, deliver, or transmit, to any foreign government, or to any faction or party or military or naval force within a foreign country, whether recognized or unrecognized by the United States, or to any representative, officer, agent, employee, subject, or citizen thereof, either directly or indirectly, any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, note, instrument, appliance, or information relating to the national defense, shall be punished by death or by imprisonment for any term of years or for life, except that the sentence of death shall not be imposed unless the jury or, if there is no jury, the court, further finds that the offense resulted in the identification by a foreign power (as defined in section 101(a) of the Foreign Intelligence Surveillance Act of 1978) of an individual acting as an agent of the United States and consequently in the death of that individual, or directly concerned nuclear weaponry, military spacecraft or satellites, early warning systems, or other means of defense or retaliation against large-scale attack; war plans; communications intelligence or cryptographic information; or any other major weapons system or major element of defense strategy.
- scythe 15y ago
  >Whoever, with intent or reason to believe that it is to be used to the injury of the United States or to the advantage of a foreign nation I don't think this qualifies.
  - DrJokepu 15y ago
    > reason to believe that it is to be used to the injury of the United States I think it does. I'm no lawyer, however.
    - scythe 15y ago
      I don't know, maybe in the most trivial "if it wasn't going to cause a problem, why were they hiding it?" sort of way. But it's not "reason to believe it could be used", it's "reason to believe it was to be used". That is, Anonymous would have to have thought that the Internet intends to use this to hurt the United States, that the people to whom they deliver the information -- people like you and I -- intend to harm the US. Not that they could, but that they would. Harming the US is not among my goals, nor is it among the goals of most people who will see the documents. That's where I think it gets up in the air. I don't think most Anons want to start a war, they just want the American people to protest government secrecy. Bradley Manning didn't get hit with "delivering defense information to aid foreign government" and considering the amount of egg he got on the military's face I'm sure they would've liked to.

89 points by Garbage 15y ago

Given that Anon has yet use anything other than simple SQLi attacks, I wonder where this data could have been stored (and, by extension, how secret it is). If it was on a public webserver, then one would expect it to be not much more than reports and presentations.

gasull 15y ago
I read somewhere that Anonymous used a 0day exploit against some church they attacked a few months ago.
- redthrowaway 15y ago
  Who, the WBC? Pretty sure that was just bluster.
  - gasull 15y ago
    Video of Anonymous hacking WBC live during an interview: http://boingboing.net/2011/02/24/anonymous-hacks-west.html http://boingboing.net/2011/02/24/anonymous-hacks-west.html Tweet from AnonymousIRC saying that they used a 0day exploit: https://twitter.com/#!/AnonymousIRC/status/40839581074980864 https://twitter.com/#!/AnonymousIRC/status/40839581074980864
aw3c2 15y ago
Given that Anon has yet use anything other than simple SQLi attacks source?
dekz 15y ago
Replace Anon with LulzSec and you're correct. Anon != LulzSec
- TobbenTM 15y ago
  True

paralogic 15y ago

Given the frequency of these events, the wide media coverage and the media outlets covering the story, this reminds me about the days before the attacks in afghanistan and the early days of the war on terror. I wouldn't be surprised if this is just a media campaign to introduce stronger internet controls. Maybe raids will also be executed on various opposing sites under the pretext of 'the war on anonymous'.

flexd 15y ago

Considering "NATO secret" machines are not allowed on networks connected to the internet they hopefully do not have anything to put people on the ground in danger. There could however have been a breach in protocols and someone accidentally hooked something up but I doubt something that serious could have happened. It's not like you accidentally hook a fileserver up to the internet. Confidential documents would (could) still be bad but there are strict rules about storing those as well.

yaix 15y ago
If it is so easy to break into the NATO network, then these "people on the ground" have been in real danger for a long time aleady. Because enemy gov't just may have had the idea of doing the break-on themselves, but without telling anybody about it.
gorgoroth666 15y ago
Don't be delusional, there were/are obviously beaches which are not red herrings. And all that "classified nato secret", "not allowed on networks connected to the internet", "breach in protocols" and "strict rules" are BS. But to say for sure, we would need a thorough analysis of the incriminated data.
- flexd 15y ago
  I'm not saying this isn't bad enough. I'm just saying there are rules in place to prevent these kinds of things. Like physical network separation and machines with disabled interfaces (like network, usb, firewire). You would require physical access to steal data from those machines and it would be either guarded or locked away. Data security is taken very seriously within the military & NATO but I can't speak for how other countries do things. Accidents happen, things are poorly secured. I'm just speaking from my own experience, even if it is limited.
  - gorgoroth666 15y ago
    NATO include forces in a lot of countries already. I'm saying a lot of them do poor jobs. Are you saying they are so good that the data incriminated is either fake or a deliberate attempt at misinformation by Nato ?

yaix 15y ago

If a few kids with some SQL knowledge can breach NATO computers in a weekend, then who can't? Looks like any gov't with a intelligence service of more than 3 people has had access to secret NATO documents for a long time. That can't be good.

lucasjung 15y ago
These documents almost certainly were not classified SECRET: actual classified documents are kept on a separate network that is not connected to the regular internet. They were most likely unclassified documents that were sensitive enough to be kept to restricted access, but not important enough to be classified. If they actually were classified, that means that there was a major breach of protocols just in having them on computers connected to the regular internet.
- gorgoroth666 15y ago
  It's not like a major breach of protocol is a very rare thing as all personels are not trained at security to say the least. I'd bet those documents are pretty damn secret.
  - lucasjung 15y ago
    Anyone with access to classified information is given extensive security training, with regular refreshers. This means that if classified documents to make their way onto an unclassified system, it was done by someone who was specifically trained not to do so. You are correct that, despite this training, classified information do sometimes accidentally make it onto unclassified computers. It is usually discovered almost immediately (most often by the person who did it), and almost always involves very small amounts of information (it's hard to "accidentally" copy large numbers of files). The bigger the collection of documents, the more likely it is to be discovered quickly. These events are a huge deal because the cleanup process is so extensive and thorough. I've read a lot of conflicting reports in various articles, probably because most journalists don't understand that words like "secret," "classified," "confidential," "restricted," and "sensitive" all have very specific meanings in a military context and are not interchangeable. As far as I can piece together, the documents in question were merely "restricted," not secret (not classified at all, for that matter).

deleted 15y ago

[deleted]

DrJokepu 15y ago

I'll just leave this here. DOSing Visa and Mastercard is one thing, espionage is something very different. USC Title 18 § 794 Gathering or delivering defense information to aid foreign government Whoever, with intent or reason to believe that it is to be used to the injury of the United States or to the advantage of a foreign nation, communicates, delivers, or transmits, or attempts to communicate, deliver, or transmit, to any foreign government, or to any faction or party or military or naval force within a foreign country, whether recognized or unrecognized by the United States, or to any representative, officer, agent, employee, subject, or citizen thereof, either directly or indirectly, any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, note, instrument, appliance, or information relating to the national defense, shall be punished by death or by imprisonment for any term of years or for life, except that the sentence of death shall not be imposed unless the jury or, if there is no jury, the court, further finds that the offense resulted in the identification by a foreign power (as defined in section 101(a) of the Foreign Intelligence Surveillance Act of 1978) of an individual acting as an agent of the United States and consequently in the death of that individual, or directly concerned nuclear weaponry, military spacecraft or satellites, early warning systems, or other means of defense or retaliation against large-scale attack; war plans; communications intelligence or cryptographic information; or any other major weapons system or major element of defense strategy.

scythe 15y ago
>Whoever, with intent or reason to believe that it is to be used to the injury of the United States or to the advantage of a foreign nation I don't think this qualifies.
- DrJokepu 15y ago
  > reason to believe that it is to be used to the injury of the United States I think it does. I'm no lawyer, however.
  - scythe 15y ago
    I don't know, maybe in the most trivial "if it wasn't going to cause a problem, why were they hiding it?" sort of way. But it's not "reason to believe it could be used", it's "reason to believe it was to be used". That is, Anonymous would have to have thought that the Internet intends to use this to hurt the United States, that the people to whom they deliver the information -- people like you and I -- intend to harm the US. Not that they could, but that they would. Harming the US is not among my goals, nor is it among the goals of most people who will see the documents. That's where I think it gets up in the air. I don't think most Anons want to start a war, they just want the American people to protest government secrecy. Bradley Manning didn't get hit with "delivering defense information to aid foreign government" and considering the amount of egg he got on the military's face I'm sure they would've liked to.