This Blog has Moved!

This blog is moving to


Thank you for visiting! Content will remain here for archival purposes.
Showing posts with label Anonymous. Show all posts
Showing posts with label Anonymous. Show all posts

Anon Steganography Cracked, Further Mysteries Lie Within

Flashback to January of this year when I posted that Anonymous has most likely been infiltrated by multiple organizations (including law enforcement and terror organizations) and may be unwillingly distributing terrorist messages.

I have finally successfully cracked open one of the Anonymous related images suspected of containing Steganography...and I'm quite intrigued by its contents. As far as I know, this is only the second Steganographic image found in the wild which has been successfully cracked. The first image was posted online by NBC back in 2001 as part of a news story, and had a very simple password of "abc".

Anonymous #OpPetrol Most Epic #Fail Yet - Full Analysis Of Results

Looking at the "damage" (and I use that term very loosely) done as part of OpPetrol, Anonymous support by actual hackers is fading fast.

Let's take a look at the original target list of what was supposed to be attacked.

United States, Canada, United Kingdom, Israel, Saudi Arabia (only Government), China, Italy, France, Germany, Kuwait (only government) and Qatar (only government)

Hackers News Bulletin released a live list of all the damage done as part of OpPetrol, and it's a rather short list. Let's run through the list and look to see if Anonymous actually succeeded in their operation.

Better grab some popcorn, this is going to be quite entertaining.

OpPetrol - It's Not About the Oil

I've posted a new Threat Watch bulletin for OpPetrol - a multi-target operation being run by Anonymous.

Updates to the bulletin can be read here.

Below is the bulletin posted in its entirety.


INTEL BRIEF
First Release: 19MAY2013
Updated: 19MAY2013
Subject: Anonymous "OpPetrol"

Target: United States, Canada, United Kingdom, Israel, Saudi Arabia (only Government), China, Italy, France, Germany, Kuwait (only government) and Qatar (only government)

Specific named targets:
Saudi Arabia government emails (Most likely Phishing - http://pastebin.com/0Yr6kyWA)

Additional high probability targets:
Pending

Date: June 20, 2013

Attackers:
AnonGhost
Others Pending
Attack types:
Distributed Denial of Service Attacks (DDoS)
Website Defacement
Possible leak of sensitive information
Details:
Original announcement on Pastebin: http://pastebin.com/Xsewfqvr
Second announcement on Pastebin: http://pastebin.com/38kvvD1S

Quote: “As petrol is sold with the dollar currency of the U S we find this not acceptable when the oil should be sold at the country of Origin, making petrol a lot less then what you the citizens is paying for it.”

Additional Analysis:
A look at the target list vs. top oil producers of the world (data from CIA World Factbook)
 Rank Target List Top Oil Producers Amount Produced (BBL/Day)
 1 No Russia 10,370,000
 2 Yes Saudi Arabia 10,000,000
 3 Yes United States 9,023,000
 4 No Iran 4,231,000
 5 Yes China 4,150,000
 6 Yes Canada 3,592,000
 7 No United Arab Emirates 3,087,000
 8 No Mexico 2,934,000
 9 No Iraq 2,900,000
 10 Yes Kuwait 2,682,000
 11 No Brazil 2,633,000
 12 No Nigeria 2,525,000
 13 No Venezuela 2,470,000
 14 No Norway 1,998,000
 15 No Algeria 1,885,000
 16 No Angolia 1,840,000
 17 No Kazakhstan 1,635,000
 18 Yes Qatar 1,631,000
 19 Yes United Kingdom 1,099,000
 ... ... ...
 43 Yes Germany 165,300
 50 Yes Italy 99,200
 60 Yes France 49,530
 101 Yes Israel 100
 102 No Jordan 20
 103 No Slovenia (Last Place) 5
Based upon the above target list, this attack has nothing to do with oil exports, especially since Israel only produces 100 BBL/Day and is third from the bottom.

Also of interesting note, the announcement speaks about Syria stealing your retirement and savings, but it was Cyprus, not Syria, that raided savings accounts when the country went bankrupt.

This operation appears to simply be an attempt at OpUSA and OpIsrael again, with a few extra countries thrown into the mix so that the operation can be declared a "success" even if only of the target countries is compromised.  This operation is simply a publicity stunt, and not by any means a meaningful attempt to change anything.


Recommendations: Standard recommendations apply
Note: Based upon the past failures of OpIsrael and OpUSA, do not expect a large turnout for this operation either.

Prior to June 20 - In order for multiple sites to be defaced at the same time, malware infection or compromise of credentials must occur ahead of time.  Change passwords, and perform full antivirus scans of systems.  Monitor firewall logs for suspicious activity involving external IP addresses.  Be vigilant, and warn employees of highly targeted phishing attacks.
On June 20 - Monitor network traffic, and coordinate with ISP should any signs of DDoS be seen.
After June 20 - Look for signs of compromise after DDoS attack.  A common technique now being employed by multiple organizations is to mask hacking attacks with DDoS attacks.

OpUSA Failure Shows Anonymous is Past Their Prime

There have been indications of this for quite a while now, but I think it's time someone finally came out and said it.

Anonymous is losing steam, and quickly dying.

That's right, Anonymous is quickly becoming an obsolete part of a forgotten era of the Internet.

OpUSA promised to be a major cyber threat against the United States Government and major banks.  Websites such as FBI.gov, Whitehouse.gov, and Bank of America were the key targets.

The actual damage? (per http://security.radware.com/Threats-Attacks/opusa/)

  • An alert system which was being decomissioned by the Honolulu Police Department
  • A Blood Bank
  • Embassy of Cape Verde in the US
  • ...and a handful of low-traffic websites which most people have never heard of.
So what happened? Simply put, most of the "smart" hackers in Anonymous have already been arrested, or have realized that prison orange does not look good on them.  Compound with this the fact that members of Anonymous now know that their organization has been compromised by terrorist groups and law enforcement alike, many members of Anonymous are now most likely finished with the group's illegal activities. A quick look at number of news headlines about "Anonymous Hacker" shows the group has definitely gone past their prime, and may soon be going the way of the dodo, at least for their hacking activities.




How much longer will Anonymous hacking groups last? Based upon current trends they may still be around for a while yet, but gone are the days where Anonymous should be considered a serious threat.

Instead, after the failure of OpUSA, they're now probably the laughing stock of the Internet.

If you're interested, you can pick up a #OpUSA #FAIL t-shirt from my CafePress shop.

#OpUSA - So far an Epic Failure

In the early hours of #OpUSA, in the words of Anonymous "Op has failed to deliver!"

Anonymous et al. actually started their "hacking spree" on May 4...but no one really noticed.  Probably because most of the websites were foreign hosted sites (you know, outside the target "USA"), or sites most people have never even heard of.  Somewhere the SEO marketing gurus of jrzydevilmarketing.info and clearseo.net are quietly cursing, but if a tree falls on a SEO marketer's website, but no one ever visits it, does it still make a sound?

The attackers stepped up their game on May 5 and hacked even more websites.  And by more, I mean more websites most people have never heard of in the USA.

Protip: Hacking Chinese, French, and Italian websites in the name of #OpUSA does not make a bit of difference to 99.999% of people in the USA.

May 6 - They HACKED BANK OF AMERICA.  OMG!!!! No...wait...they hacked Blood Bank of America.  Really guys? You hacked a blood bank? This speaks of fail on so many levels its not funny.  That's like using your bat to call out a home run, then hitting a ground rule double.  Sure, it just went out of the park, but it's nowhere near as effective.

Early hours of May 7 - A short list of websites was published (because these guys are clearly riding a "short bus"), and finally a target barely worth noting - the Honolulu Police Department alert system which isn't even used anymore.
“HPD Alerts was a pilot program (used) to provide breaking information to the public,” Yu said. “It was recently discontinued due to technical problems not associated with the cyberattack.”

So let's see - Anonymous and company planned to take down Whitehouse.gov, FBI, and Bank of America.

In fact, they even made this statement:
Anonymous will make sure that this May 7th will be a day to remember. On that day Anonymous will start phase one of operation USA. America you have committed multiple war crimes in Iraq, Afghanistan, Pakistan, and recently you have committed war crimes in your own country

So...you've got less than 24 hours for "OpUSA" to be a "day to remember".  So far it's been an epic failure which will be forgotten by Friday.

#TickTock

OpUSA to Strike US Government and Banking Infrastructure May 7

Anonymous and several other hacking groups are planning to attack the US Government and Banking Infrastructure on May 7, 2013.

I added a threat briefing on OpUSA, what's being targeted, and by who, to my Threat Watch site.

Currently, the only named targets of this attack are Whitehouse.gov, FBI, and Bank of America.  However, I'm sure other targets will be included.

If you work for a government agency, or in the banking agency, be vigilant, and be on the lookout for highly targeted phishing attacks.

You can read the full briefing at my Threat Watch site.

Anonymous OpIsrael - Prelude to a Hamas Attack?

On April 7th Anonymous plans to disable the Israel government's Internet capabilities through a massive hacking/denial of service attack.

It has been long suspected that Hamas has a great influence inside Anonymous.  Th3j35t3r and others, including myself, have repeatedly warned that Anonymous has been infiltrated by terror organizations - and #OpIsrael may be Hamas' way of disabling Internet communications of the Israel government prior to an attack.

Facebook Graph Search and OSINT

Facebook Graph Search is one of the newest features of Facebook.  It allows you to data-mine every person and page on the entire social network.  You can get an introduction at this page.

It's not available for everyone yet...but you can sign up for early access if you'd like.  It is extremely powerful as an OSINT (Open Source Intelligence) tool.  A tumblr site called Acutal Facebook Graph Searches show some of the more interesting search results.

Identity of @th3j35t3r Revealed

While this post is not directly related to security...I felt it was worth sharing with others.

Who is th3j35t3r?  That's the million dollar question now isn't it?

For those not familiar th3j35t3r is a cyber-activist known for attacking known terrorist websites as well as Westboro Baptist Church and factions of Anonymous.

There have been many attempts to identify the true identity of th3j35t3r...but according to him none have been correct.

The endless attempts to find th3j35t3r's true identity has become a humorous game for him...to the point that he has set his Twitter background picture to supposedly contain an encrypted version of his full identity.

If Anonymous is to Survive They Must Remove the Mask

Over the past couple years Anonymous has gone from a group of pranksters "doing it for the lulz" to a massive global collective of political activists and "hacktivists".

But there's trouble brewing for Anonymous.  As a group with "no membership roster" and no criteria for joining they have opened themselves up to infiltration. The flaw which will be Anonymous' downfall is that "anyone can be Anonymous."

Infiltration by who you might ask? For one...law enforcement agencies.  The best example of recent infiltration would be the cooperation of "Sabu" with the FBI.  His cooperation resulted in the arrest of multiple Anonymous members and should have served as a wakeup call to the rest of the group that they must reform or die.

But infiltration by law enforcement should be the least of Anonymous' worries.  It is beginning to come to light that Anonymous may be unwitting mules for terrorist organizations.  And let's not forget that the Mexican drug cartel "Zetas" were recently burned by Anonymous and swore revenge.  Anonymous members who had nothing to do with the confrontation with the Zetas may be subject to infiltration and revenge by the Zetas as "guilt by association."  Unlike law enforcement the Zetas don't really care about due process or burden of proof...and will simply snatch someone in the middle of the night and kill them.

So this is a message to any Anonymous members who will listen - if you want to survive you need to remove the mask.  Otherwise you will be led to your doom like lambs to the slaughter.  There are already leadership structures within Anonymous - everyone knows this.  Drop the Anonymous mask completely.  Start keeping membership rolls - and purge yourselves of the undesirables - especially terrorist organization members.  And finally - if you really want to make a difference stop the illegal activities, such as hacking or denial of service attacks.  You'll gain a lot more credibility if you start performing your political activism legally instead of through illegal means.

You can either be labeled as criminals, or heroes.  But not both.

Anonymous and Steganography - Blindly Distributing Terrorist Messages?

As previously warned multiple times by Th3J35t3r and myself - Anonymous may be unwitting pawns in a much larger chess game.

While their public support of terrorist organizations is being dismissed with "anyone can claim to be Anonymous" their blind distribution of encrypted files containing information from outside entities may not even be known to the inner-most circles of the organization.

What encrypted files? One of the most common means of distributing Anonymous related information is through social media - especially through the distribution of image files.  Little known to many outside the security field is that images can be used to hide information through a process called Steganography.  For those not familiar with the topic here is an excellent whitepaper on how Steganography works as well as how to detect it.  I have started using the StegDetect program from Outguess.org and have found some interesting results.

I recently started analyzing several images being re-posted by the Twitter handle @YourAnonNews.  Out of 51 images analyzed I found two images which returned "positive" as having embedded data, as well as two additional images which generated errors during analysis (possibly obfuscated?).

The first picture with a positive hit was an internet meme of the TV show "Game of Thrones".

The Anonymous Lies Keep Building - GoDaddy and Apple


UPDATE 9/11/2012: Anonymous Own3r is a fraud.  The GoDaddy outage was caused by an internal router issue, and not a hacking or denial of service attack. 

EDITOR'S NOTE: As of writing this article, "Anonymous Own3r" has not provided proof that he/she was responsible for this attack.

Earlier this year I wrote about an Anonymous plan to take down the internet through a massive Denial of Service attack against the root DNS servers, and how to take steps to avoid being affected.  However, this attack never impacted anyone.

Today a member of the group Anonymous, who goes by "Anonymous Own3r" claimed responsibility for knocking GoDaddy's DNS servers offline.  According to the hacker fraudster, he/she acted alone in this attack, and it was not assisted by the Anonymous collective.  However, no explanation has yet been posted as to how he/she took down GoDaddy's DNS servers further investigation reveals that Anonymous Own3r is a fraud, and was not responsible.

This revelation comes on the same day that it was revealed that leaked Apple device IDs were from a US company BlueToad, instead of the FBI, as Anonymous has claimed.

According to Netcraft.com the GoDaddy outage lasted approximately 3.25 hours, and affected eight out of GoDaddy's ten hosting locations.


While the percentage of the Internet affected by this attack is not clear, what is clear is that the thousands of web sites and email servers hosted by GoDaddy went dark today during business hours, wreaking havoc on businesses relying on GoDaddy for their web and email presence.

Does your Disaster Recovery Plan and Business Continuity Plan include massive outages by your hosting provider?  If not, now would be a good time to add it, especially if your organization relies on web and email for your critical business functions.

Related Reading:
Solution Brief: Disaster Recovery
Pre-Testing Disaster Recovery and Business Continuity Plans
Recent Lessons in Disaster Recovery

Mission Critical (FREE Subscription!)

How to Mitigate Anonymous' Internet Shutdown March 31

In case you haven't heard, Anonymous plans to shutdown the internet March 31 to protest a multitude of issues which I'm not going to bother to get into right now.

The plan is to attack all 13 root DNS servers with Denial of Service (DoS) attacks.

By shutting down all 13 root DNS servers, a domino effect will be felt throughout the internet and eventually all DNS queries will begin to time out.

Their plan is pretty bold, and will require a tremendous number of computer systems attacking at once.

While it is unknown if Anonymous' plan can succeed, there are a few things you can do to mitigate this threat from affecting your organization.

1) Don't panic. This shutdown is on a Saturday, so the number of employees this affects will be minimal.  If your organization isn't even open on Saturdays, then this won't affect your organization at all.

2) If you are open on Saturday, consider putting one of your local DNS servers in caching mode if it isn't already, and increase the DNS caching time to live (TTL) to 86400 seconds (24 hours).  Any commonly used sites should remain cached throughout the attack.  It's a good idea to revert to your original settings Monday morning.

3) Finally, if you absolutely must have access to certain websites with static IP addresses, such as business partners or suppliers, consider making available to your on-call support staff a hosts file with critical domain names and IP addresses pre-loaded, so that they can drop this file on any organizational systems which start to have DNS problems.  Once again, revert to your original settings Monday morning.

These three simple tips should help keep your organization up and running, should Anonymous actually succeed in taking down one or more root DNS servers.

For home users, I would recommend checking your local weekend weather forecast Friday evening.  If it's going to be nice out, be ready to go outside for a change, get some exercise and have some fun.  If not, consider breaking out some board games for the kids, or find yourself a nice book to read.  It's only one day, if it even happens, and it's not the end of the world.

Flash Farce: The Dangers of Social Media Influencing Real World Actions

We're lucky it hasn't happened yet.  Or maybe it has and we don't know it.

We've all heard how "flash mobs", protests such as "Occupy Wall Street", and even revolutions such as Arab Spring can be organized through social media such as Twitter or Facebook.

Viral videos, trending Twitter hash tags, Change.org petitions, Facebook pages...all of these are "tools" used to help bring about social change.

But how many people actually check the origins of a social change campaign or movement? And would it even do them any good?  How would anyone know the true origins, or motivations, behind an online campaign?

Anonymous: Friend or Foe?


Is Anonymous a force for good, or just another threat online? This video has been posted in response to the Stratfor hacking incident.

Misuse of Your Personal Information and Google Alerts

It's always a good idea to keep tabs on your online presence.  This can help prevent embarrassing situations, such as an ex girlfriend posting all your dirty laundry for the world to see, or keep someone from stealing your identity, or using your name or address for fraudulent activities, resulting in the police knocking on YOUR door instead of theirs.

Here is an excellent example...

One of my former co-workers had a rather interesting event happen to him after moving in to his new house... Someone was running a "women's retreat" business from his home address!

He found this out through randomly searching for his own home address using Google.

Apparently someone had setup an entire website for this fake business using the real estate information from his home before purchase.

Luckily, this site did not remain online for long, but things could have become really interesting if someone showed up with suitcases in hand expecting to spend a weekend at the "retreat" they already paid for in full...

A few other situations which could happen...
  • Someone decides to try to rent or sell your house without your knowledge
  • Someone posts your address for a "everything for free" event on Craigslist as a cover for looting your house
  • A former co-worker or client posts your personal information on an online bulletin board accusing you of something "bad", resulting in harassing phone calls from thousands of complete strangers
  • An online group such as Anonymous posts your name and address on bulletin boards to coordinate a "prank SWAT raid"
  • Your college or university accidentally publishes a list of student names and social security numbers
The above are very real situations which have occurred, and could possibly have been avoided (or at least provided some warning) if only the victim would have regularly checked the internet for their personal information.

So how can you protect yourself from these situations?


Anonymous Plans 'Day of Vengeance' to Protest Execution, Arrests

A massive cyber attack is planned for tomorrow, September 24.  If your business could be a possible target, you might want to review your Disaster Recovery and Continuity of Operations plans, and be ready to enact them this weekend...

From PCMag:
To avenge the Wednesday execution of Troy Davis, hacktivist group Anonymous has added the Atlanta Police Department to its list of targets for a nationwide cyber attack scheduled for this Saturday, September 24.
...
On Wednesday, Anonymous announced a "Day of Vengeance" starting at noon ET this Saturday, when aligned hackers would launch cyberattacks on targets like "Wall Street, corrupt banking institutions, and the New York City Police Department."


 Read more at PCMag