Middle East Cyber War Timeline (Part VIII)

This last week has seen some remarkable events an undoubtable revamp of data leaks inside the Middle East Cyberwar.

Not only the infamous 0xOmar, the initiator of the Middle East Cyber War, reappeared, leaking alleged secret data from some Israeli Virtual Israeli Air Force School websites; but also the Pakistani zCompany Hacking Crew has re-entered the scene unchaining the original weapon, that is the Credit Card leak. As a matter of fact ZHC published 5,166 records containing working credit cards, usernames, emails and addresses of individual supporters of the Zionist Organisation of UK & Ireland (zionist.org.uk).

On a different front, the massive defacements of websites all over the world in support of #OpFreePalestine continued. Under the label of the same operation, the Anonymous also “doxed” several companies and individuals on pastebin.

As far as the two main contenders (Iran and Israel) are concerned, the strategies seem quite different.

Iran has shown a cyber activity culminated in the alleged attack against the BBC Persian Service. For this nation, it is also important to notice its “cyber autarky”, maybe a choice forced by the embargo, that led to the creation of an internal email service, in contrast to the traditional Gmail, Yahoo, etc. This happens few weeks after the decision to develop an internal Antivirus.

On the opposite front, Israel keeps on its apparent cyber silence. Is it the prelude for the feared military action against Iran?

If you want to be constantly updated on the Middle East Cyber War, at this link you find the complete timeline. Also follow @paulsparrows on Twitter for the latest updates!

(more…)

Continue Reading Middle East Cyber War Timeline (Part VIII)

Timeline Of Cyber War Between Bangladesh and India

Update 03/26/12: List of Cyber Attacks Carried on by Pro-India Hackers against Bangladesh

Several days ago I tweeted a request of help to my tweeps for building a timeline of India and Bangladesh Cyber War Timeline.

Unexpectedly the day after I received a complete and detailed timeline from Catherine Anita. I was nearly risking to loose it since my Gmail account had marked the message as spam. As I do not completely trust the antispam engines and regularly check my Spam folder, fortunately I was able to retrieve her e-mail and the precious content.

Catherine did a complete review that I formatted according to my consolidated model, adding a couple of events for the last days.

Since the timeline of the mutual Cyber Attacks  is quite long, I decided to divide it into two parts, the first one covering the cyber attacks carried on by pro-Bangladesh hacking crews against India (I used a rigorous alphabetical Order). Expect for tomorrow the update with attacks carried on from the other side.

As usual after the Jump you find all the references.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @pausparrows on Twitter for the latest updates.

(more…)

Continue Reading Timeline Of Cyber War Between Bangladesh and India

Again On The Carrier IQ Saga

  • Post author:
  • Post last modified:December 13, 2011
  • Post category:MobileSecurity
  • Post comments:2 Comments
  • Reading time:5 mins read

Yesterday I posted evidence about the presence of the infamous Carrier IQ Software in Italy. Today another episode (I presume…

Continue Reading Again On The Carrier IQ Saga

Another Certification Authority Breached (the 12th!)

  • Post author:
  • Post last modified:December 10, 2011
  • Post category:CyberwarSecurity
  • Post comments:1 Comment
  • Reading time:4 mins read

2011 CA Attacks Timeline (Click To Enlarge)This year is nearly at the end but it looks like it is really endless, at least from an Information Security Perspective. As a matter of fact this 2011 will leave an heavy and embarassing heritage to Information Security: the Certification Authority authentication model, which has been continuously under siege in this troubled year; a siege that seems endless and which has shown its ultimate expression on the alleged compromise of yet another Dutch Certification Authority: Gemnet.

Gemnet, an affiliate of KPN, has suspended certificate signing operation after an intrusion on its publicly accessible instance of phpMyAdmin (a web interface for managing SQL Database) which was, against any acceptable best practice, exposed on the Internet and not protected by password. As in case of Diginotar, another Dutch Certification Authority which declared Bankrupt few days after being compromised by the infamous Comodo Hacker, Gamnet has  the Dutch government among its customers including the Ministry of Security and Justice, Bank of Dutch Municipalities and the police.

After the intrusion, the attacker claimed to have manipulated the databases, and to allegedly have been able to gain control over the system and all of the documents contained on it, although KPN, claims the documents contained on the server were all publicly available. Moreover the attacker claimed the attack was successful since he could obtain the password (braTica4) used for administrative tasks on the server. As a precaution, while further information is collected about the incident, Gemnet CSP, KPN’s certificate authority division, has also suspended access to their website.

The breach is very different, in purpose and motivations, from the one occurred to Diginotar, at the end of July, which led to the issuance of more than 500 bogus Certificates (on behalf of Google, Microsoft, and other companies). In case of Diginotar the certificates were used to intercept about 300,000 Iranians, as part of what was called “Operation Black Tulip“, a campaign aimed to eavesdrop and hijack dissidents’ emails. For the chronicles, the same author of the Diginotar hack, the Infamous Comodo Hacker, had already compromised another Certification Authority earlier this year, Comodo (which was at the origin of his nickname). In both cases, the hacks were performed for political reasons, respectively as a retaliation for the Massacre of Srebrenica (in which the Comodo Hacker claimed the Dutch UN Blue Helmets did not do enough to prevent it), and as a retaliation for Stuxnet, allegedly developed in a joint effort by Israel and US to delay Iranian Nuclear Program.

But although resounding, these are not the only examples of attacks or security incidents targeting Certification Authorities: after all, the attacks against CAs started virtually in 2010 with the infamous 21th century weapon Stuxnet, that could count among its records, the fact to be the first malware using a driver signed with a valid certificate belonging to Realtek Semiconductor Corps. A technique also used by Duqu, the so called Duqu’s son.

Since then, I counted 11 other breaches, perpetrated for different purposes: eavesdropping (as is the case of the Infamous Comodo Hacker), malware driver signatures, or “simple” compromised servers (with DDoS tools as in case of KPN).

At this point I wonder what else we could deploy to protect our identity, given that two factor authentication has been breached, CAs are under siege, and also SSL needs a substantial revision. Identity protection is getting more and more important, since our privacy is constantly under attack, but we are dangerously running out of ammunitions.

(Click below for references)

(more…)

Continue Reading Another Certification Authority Breached (the 12th!)

Beware Of The Red Dragon

  • Post author:
  • Post last modified:December 7, 2011
  • Post category:CyberwarSecurity
  • Post comments:0 Comments
  • Reading time:3 mins read

I have dedicated several posts to NG-IPS, the next step of the evolution in network security (or better to say…

Continue Reading Beware Of The Red Dragon