Anonymous Reveals The 24 hr Violence Cycle in Syria

Part of the Syrian government email dump that was published by Par-anoia.net contained daily reports from the Syrian government to its embassy at the U.N. on terrorist attacks occurring on its soil. These "terrorists" were, of course, Syrian rebels looking to overthrow Assad. While the country has been in a state of civil war for many months, it's eye-opening to see the level of violence when it's broken down by dozens of specific instances on a daily basis as it is done in these reports. There are literally dozens of them in the email dump. I arranged for the translation of two documents to share via this blog.


CHART: Attacks and Security Breaches by Armed Terrorist Groups on 11/5/2012 to 8 o’clock to 11/6/2012

 Martyrs:  Civilians- 0.  Military: 20

Wounded: Civilians- 1. Military 157

Kidnapped: Civilians- 0. Military 4

Militants: Under arrest- 0. Dead 4

Cases of shootings by militants: Civilians: 4. Military 44

Response by Military to shootings: 35

IED: Exploded- 6. Dismantled – 1. Exploded during Manufacturing- 0

Robberies: Public- 1. Private-1. Weapon theft- 3

Insurgent Infiltration Attempts- Lebanon- 1. Turkey- 0. Iraq- 1. Jordan- 0.

Cutting off/ burning of routes: Civilian – 1. Military- 1.

Physical damage: Public- 6. Private – 7

Violations committed by “armed terrorist groups” from 8 o’clock 11/5/2012 to 8 o’clock to 11/6/2012

#1. Place: Lebanese Border. Time: 10:30pm. Attempt to infiltrate from the Lebanese border to enter Syrian territory. Shots fired at Syrian Border Guards in the Talkalakh area.

# 2. Place: Iraqi Border. Time: 11:00pm. Shots fired inside Iraqi territory at Syrian Border guards. Attempted infiltration into Syrian territory Hassan station in Deir al-Zour.

# 3. Place: Damascus and surrounding areas. Time: 8:30pm. IED exploded in the Sahel region- According to a supervisor of the order keeping officers two members were wounded.

# 4. Place: Damascus and surrounding areas. Time: 11:00am. An assistant was kidnapped in Harasata area and his weapons were stolen.

# 5. Place: Damascus and surrounding areas. Time: 11:15 am. A thermal Rocket was launched at a health vehicle belonging to the order keeping forces in Doma, wounding one member.

# 6. Place: Damascus and surrounding areas. Time: 6:00am. Shots fired at order keeping forces in Zamalaka, killing one member and wounding 3 others.

# 7. Place: Damascus and surrounding areas. Time: 6:30am. Shots fired at order keeping forces in Wadi al-Qarn, killing two members and wounding 14 others.

# 8. Place: Damascus and surrounding areas. Time: 7:30am. Shots fired at order keeping forces in Harmala- wounding two members.

# 9. Place: Daraa and surrounding areas. Time: 9:00pm. Armed ambush of a car killing members of the order keeping forces in Noa, resulting in the deaths of two members and the robbery of their weapons.

# 10. Place: Daraa and surrounding areas. Time: 11:00 pm.  Shots were fired civilians in Cannula.

# 11. Place: Daraa and surrounding areas. Time: 11:00 am. A road was cut off near Sheikh Meskeen, leading to the investigation of cars for military members.

# 12. Place Daraa and surrounding areas. Time: 3:00pm. A Mazda car was stolen from the electric company during a repair mission in Sheikh Messkeen.

# 13.  Place: Daraa and surrounding areas. Time: 2:00pm. Shots fired at an UN vehicle located in Noa, resulting in damage to the car.

# 14. Place: Daraa and surrounding areas. Time: 3:30pm. Shots fired at order keeping forces in Noa, wounding two members.

# 15. Place: Daraa and surrounding areas. Time: 4:00pm. Shots fired at order keeping forces in a displaced persons camp in Daraa, killing one member and a policeman, injuring 18 members.

# 16. Place: Quneitra. Time: 12:00pm. Shots fired at order keeping forces in Beer Al-Ajam accompanied by the explosion of an IED, injuring 9 members, 3 were officers.

# 17. Place: Quneitra. Time: 1:30pm. Shots fired at order keeping forces in Khan Arriba, wounding an officer.

# 18. Place: Homs and surrounding areas. Time: 9:30pm. Explosion of an IED on the public road of Homs- at the junction- injuring two members.

#19. Place: Homs and surrounding areas. Time: 6:00am. Shots fired at order keeping forces in Sultania, killing 3 members.

# 20. Place: Homs and surrounding areas. Time: 12:00pm. Shots fired at order keeping forces in Homs, injuring one member.

# 21. Place: Homs and surrounding areas. Time 1:30pm. Armed ambush of a car killing order keeping members in Abel and injuring two officers.

#22. Place: Homs and surrounding areas. Time: 2:00pm. Shots fired at order keeping forces, injuring 3.

# 23. Place: Hama and surrounding areas. Time 9:00pm. A Hyundai car was stolen number /520866/ in Sooq Al-Gahnim.

# 24. Place: Hama and surrounding areas. Time 11:00am. Shots fired at order keeping forces in Sooq al Shajra, injuring one member.

#25. Place: Hama and surrounding areas. Time: 3:00pm. Shots fired at order keeping forces between Moorook and Kafir Zeta, injuring one member.

# 26. Place Hama and surrounding areas. Time: 5:00 pm. Shots fired at citizens in the village of Zhoria, injuring one member.

# 27. Place: Aleppo and surrounding areas. Time: 5:00am. Shots fired at security forces in several areas, killing 2 assistants, a policeman, a soldier, an order-keeping member, and wounding 64 members 7 of them were officers.

# 28. Place: Aleppo and surrounding areas. Time: 9:30am. Shots fired at General Mohammad Ako during his return from his house on the public road of Aleppo. Resulting in his martyrdom.

# 29.  Place: Aleppo and surrounding areas. Time 12:00pm. Mortars fired in several neighborhoods in Aleppo with limited damage to the area.

# 30. Place: Idlib and surrounding areas. Time: 8:00pm. Shots fired at order keeping forces in Wadi al-Deif, injuring 6 members.

# 31. Place: Idlib and surrounding areas. Time 6:30 am. Shots fired at order keeping forces in Gissr al-Sogoor, injuring one member.

# 32. Place: Idlib and surrounding areas. Time: 8:00am. An IED was planted in Bilal Mosque in Jericho.

# 33. Place: Idlib and surrounding areas. Time: 8:30am. A suicide terrorist attacker blew himself up in a car bomb with an estimated weight of explosives at 500 kilograms, close to a military checkpoint located near the Center of Agricultural Development. This resulted in the death of two members and wounded 11 others including two officers. It also destroyed 3 cars and 6 armored vehicles.

# 34. Place: Idlib and surrounding areas. Time: 9:00am. Shots fired at order keeping members in Jericho, killing Colonel Ahmed Kamal Mustafa and injuring two members.

# 35. Place Idlib and surrounding areas. Time: 11:30am. IED explosion during a vehicle patrol by order keeping forces on Idlib Road- Mosstoma, wounding an officer and a Brigadier General.

# 36. Place Idlib and surrounding areas. Time: 1:00pm. Shots fired at order keeping forces on Idlib Road-Mosstoma, injuring 4 members.

# 37. Place: Idlib and surrounding areas. Time: 2:30om. Shots fired at order keeping forces in Mara Al-Naman- Wadi al-Deif, killing the Captain Ahmed Mahmoud al-Waray and injuring 5 members.

# 38. Place: Idlib and surrounding areas. Time: 3:15pm. Shots fired at order keeping forces in Jina al-Qoora, wounding two including one Brigadier General and destroying an armored car.

CHART: Attacks and Security Breaches by Armed Terrorist Groups on 11/4/2012 to 8 o’clock to 11/5/2012

Martyrs:  Civilians- 2.  Military: 31

Wounded: Civilians- 2. Military 81

Kidnapped: Civilians- 7. Military 5

Militants: Under arrest- 0. Dead 4

Cases of shootings by militants: Civilians: 3. Military 40

Response by Military to shootings: 32

IED: Exploded- 2. Dismantled – 0. Exploded during Manufacturing- 0

Robberies: Public- 3. Private-4. Weapon theft- 6

Insurgent Infiltration Attempts- Lebanon- 0. Turkey- 0. Iraq- 1. Jordan- 0.

Cutting off/ burning of routes: Civilian – 1. Military- 0.

Physical damage: Public- 4. Private - 2

Violations committed by “armed terrorist groups” from 8 o’clock 11/4/2012 to 8 o’clock to 11/5/2012

# 1. Place: The Lebanese Border. Time: 1:00 am Description: Shots fired from within Lebanese territory at Syrian Border Guards in Al Qusayr.

# 2. Place: The Lebanese Border. Time: 6:00 pm Description: Shots fired from within Lebanese territory at Syrian Border Guards.

# 3. Place: Iraqi Border. Time: 7:30 pm. Description : Attempt to sneak from Iraqi territory to Syrian territory and shots fired on Syrian Border Guards from the area of Zaraya.

# 4. Place: Damascus and surrounding areas. Time: 8:10 pm. Description: Shots fired at Syrian order keeping forces in Harasta and Kantara resulting in martyrdom of six guards.

# 5. Place: Damascus and surrounding areas. Time: 8:10 pm Description: Explosion of an IED in front of a police station following shots fired at order keeping forces, damaging the building.

# 6. Place: Damascus and surrounding areas. Time: 6:00 am. Description: Shots fired at order keeping forces in Zmalaka resulting in the martyrdom of three soldiers.

# 7. Place: Damascus and surrounding areas. Time: 7:20 am. Shots fired at order keeping forces in Arabeen, wounding two.

# 8. Place: Damascus and surrounding areas. Time: 8:00 am. Description: Shots fired at a vehicle carrying order-keeping forces in Alibaug, wounding two.

# 9. Place: Damascus and surrounding areas. Time: 9:00 am. Description: Shots fired at order keeping forces in Madaya resulting in the martyrdom of Raed Abdel Rahman Salama.

# 10. Place: Damascus and surrounding areas. Time: 10:00 am. Description: Shots fired at order keeping forces in Biblia, martyring one and wounding another.

# 11. Place: Damascus and surrounding areas. Time: 4:30 pm. Description: Shots and mortars fired at the order keeping forces’ barracks in Harasat, destroying the building and burning the furniture.

# 12. Place: Damascus and surrounding areas. Time: 9:00 pm. Shots fired at order keeping forces in Harasta-Kantara, wounding four.

# 13. Place: Damascus and surrounding areas. Time: 11:30 am. Shots fired at order keeping forces in Haraan, injuring one.

# 14. Place: Daraa and surrounding areas. Time: 8:00 pm. A citizen was killed in Jassim.

# 15. Place: Daraa and surrounding areas. Time: 9:00 pm. A citizen was kidnapped in Darra.

# 16. Place: Daraa and surrounding areas. Time: 12:00 pm. Shots fired at order keeping forces in Sheikh Misken, wounding one.

# 17. Place: Daraa and surrounding areas. Time 1:30 pm. Shots fired at order keeping forces at a camp for displaced people, killing 2 police officers and two order keeping members as well as wounding 5 others including an officer.

# 18. Place: Daraa and surrounding areas. Time 2:30 pm.  A citizen was robbed of 30,000 Lera.

# 19. Place: Quneitra. Time: 5:00 am. Shots fired at order keeping forces in the village of Beer Ajam, resulting in the deaths of 4 assistants and injuring 14 others.

# 20. Place: Homs and surrounding areas. Time: 8:00 pm. Shots fired at order keeping forces in Bab Hood, injuring two members.

# 21. Place: Homs and surrounding areas. Time: 9:30 pm. Shots fired at order keeping forces at the junction of two villages, resulting in the death of Officer Ahmad Ismaial Dayoob and the policeman Mohammad Yusef and the policeman Hussein Ganam.

# 22. Place: Homs and surrounding areas. Time: 4:00am. Shots fired at order keeping forces in Alqaseer, wounding one member.

# 23. Place: Homs and surrounding areas. Time 3:00 pm. Mortar fire on houses in the village Son Al-Aswad, wounding two civilians

# 24. Place: Homs and surrounding areas. Time 4:00 pm. Thermal rocket fired at order keeping forces in Sooq al-Gahnim, wounding one member.

# 25. Place: Hama and surrounding areas. Time: 9:20 am. A government car was stolen model number /63314/ belonging to the Chairman of the Board of Hama in west Al-Mashtal.

# 26. Place: Hama and surrounding areas. Time: 12:00 pm. A citizen was kidnapped, Hyyan Gahnim in Arbaeen, in the city of Hama.

# 27. Place: Hama and surrounding areas. Time: 12:15 pm. A Hyundai car was stolen number /74275/ in the neighborhood Sooq Al-Shjra  and shots were fired at its driver, the citizen Abd Al-Aziz Al-Saman.

# 28. Place: Hama and surrounding areas. Time: 12:40 pm. A Kia car was stolen number /624931/ in Arbaeen in the city of Hama.

# 29.  Place: Hama and surrounding areas. Time: 1:15 pm. An IED exploded during order keeping members’ patrol of the public street - Mahrada in Hama. This resulted in the wounding of one officer and damage to the area.

# 30. Place: Hama and surrounding areas. Time: 3:00 pm. The citizens, Ibrahim al-Rahama, Mohamad Al-Jasam, Jamaa al-Mahmoud,  Mohammad Al-Hassan, Basam Bedoya, were kidnapped and shots were fired killing the civilian Ibrahim Al-Rahmoon.

# 31. Place: Hama and surrounding areas. Time: 7:00 pm. The citizen Mustafa Whabe stole a motorcycle and fired shots in Soran- wounding one civilian.

# 32. Place: Aleppo and surrounding areas. Time: 9:00pm. Shots were fired at order keeping members in Haritan, killing the officer Hasam Yusef and Mojnd Husein Ali Khlil and wounding three members.

  

# 33. Place: Aleppo and surrounding areas. Time: 5:00am. Shots fired on order keeping forces in various areas resulting in the deaths of several officers and policemen and wounding 22 members.

# 34. Place: Aleppo and surrounding areas. Time: 4:00am. Three members of the order keeping forces were kidnapped and a car was stolen in the region of Safera.

# 35. Place: Aleppo and surrounding areas. Time 6:00am. Several mortars were fired towards residences in various areas of Aleppo, resulting in limited damage to the area.

# 36. Place: Idlib and surrounding areas. Time: 8:30pm. Shots fired at order keeping forces in Maarrat al-Nu’man, killing an officer and wounding 12 members.

#37. Place Idlib and surrounding areas. Time 6:00 am. Shots fired at order keeping forces in Jericho – Mahampel- wounding 4 members.

# 38. Place: Idlib and surrounding areas. Time: 11:00 am. The Colonel, Mustafa Abd Al-Rzaq was kidnapped.

# 39. Place: Idib and surrounding areas. Time: 11:00 am. Armed attacked using several types of weapons at Taftanaz airport, wounding one officer.

# 40. Place: Deir Ezzor. Time: 6:00am. Shots fired at order keeping forces in Meadeen, resulting in the death of one officer.

Add to Cart View detail

Anonymous Attacks Israeli Air Force Website and Other Targets

English language page of Israeli Air Force Website

A Middle East faction of Anonymous has taken the side of the Palestinian settlers in Gaza and announced that it would be attacking Israeli government websites. One of them belonged to Israel's Air Force according to this tweet:

Screenshot captured on 11/16/2012 0658 PST

Screenshot captured by AnonymousSky and referenced in the above tweet

In less than two days after Israel launched Operation Pillar of Defense (the English version of the more obscure Pillar of Cloud designation), civilian supporters on both sides of the conflict have begun launching cyber attacks against key websites (see my original post on this conflict). 88 defacements have been posted to Pastebin today and much more are expected to occur.

UPDATE 16NOV12 0944PST: The following Israeli gov't websites have been attacked by Anonymous per @AnonymousSKY: 

• Israel Security Agency (Shabak.gov.il)
• Ministry of Justice (Justice.gov.il)

@YourAnonNews has reported that cyber attacks from pro-Israel hackers have impacted VoxAnon - an IRC network popular with Anons.

UPDATE 16NOV12 1628PST:

• Israel's Ministry of Foreign Affairs is down (mashav.mfa.gov.il)
• More than 663 Israeli websites defaced 

Related 

The Cyber Warfare Component to Israel's Pillar of Cloud Op

Add to Cart View detail

Have iSight Partners - PayPal - Skype Bypassed Due Process?

The recent incident involving the release of Skype user data to law enforcement by iSight Partners raises serious due process questions; especially considering the rapid growth of the cyber intelligence sector. iSight Security, Inc. dba iSight Partners is a privately owned cyber intelligence firm based in Dallas, TX that was founded by John Watters after he sold iDefense to Verizon. According to their website, the company provides insight into malware actors and threats to their corporate and government clients.

Two of iSight's corporate clients are PayPal and Microsoft's Skype. According to the Dutch journalist who broke the story, PayPal hired iSight to investigate Anonymous after it coordinated DDoS attacks against it in protest to PayPal's blocking payments to Wikileaks in 2011. In the course of doing work for PayPal, iSight discovered the alias of a person who they believed was a member of Anonymous and found that it matched a Skype name. An iSight employee then contacted Skype, another client company of iSight's, and asked for the user data that accompanied the Skype name. Skype complied since it had a contractual relationship with iSight.

NOTE: Apparently if you're a Skype customer, your data can be shared with any other company that partners with Skype per its Privacy policy:

Except as provided below, Skype will not sell, rent, trade or otherwise transfer any personal and/or traffic data or communications content outside of Microsoft and its controlled subsidiaries and affiliates without your explicit permission, unless it is obliged to do so under applicable laws or by order of the competent authorities. 

Skype may disclose personal information to respond to legal requirements, exercise our legal rights or defend against legal claims, to protect Skype’s interests, fight against fraud and to enforce our policies or to protect anyone's rights, property, or safety.

Either Skype sees its relationship with iSight as an affiliate or it sees its sharing of info as a way to protect its interests. Either way, it completely bypasses the necessity for a warrant. However, iSight turned that protected information over to the Dutch authorities without being presented with a warrant or having been part of any due process to protect the Dutch citizen's rights.

I understand from a confidential source that Skype (or possibly Microsoft) is investigating iSight's actions in that regard to ensure that it never happens again. This could be especially damaging to Microsoft since it's already on the EU's radar from past legal disputes regarding anti-trust matters. Although I've tried to get iSight to comment on this incident, no one from the company has replied to my email requests.

UPDATE (13 NOV 2012): The larger issue is the question that iSight refuses to answer. Does iSight co-mingle this type of data between client companies and share it with law enforcement or other  government organizations thus bypassing privacy rights in the U.S., E.U. and elsewhere?

Add to Cart View detail

OSCE's Cyber Security Confidence Building Measures Revealed by Anonymous

Anonymous has been able to exfiltrate a second, smaller batch of documents from OSCE's webserver (OSCEPA.AT) on November 11, 2012; even after the company knew that they had been attacked. This second batch of documents contains up-to-date information on the OSCE's Internal Working Group 1039 whose mandate (.pdf) is to create cyber security Confidence-Building Measures (CBMs) that would reduce the risk of cyber conflicts. The chairman of the IWG 1039 is U.S. Ambassador Ian Kelly.

The latest revised draft set of CBMs was circulated in a document marked RESTRICTED among IWG 1039 members on November 7, 2012 in preparation for their meeting today, November 13, 2012 in Dublin. They are as follows:

1. Participating States will voluntarily provide their national views on some aspects of national and transnational ICT security. These may include, but are not necessarily limited to, views on doctrine; strategy; norms; lessons learned; real and potential threats; protective measures; concepts of operating in cyberspace.
2. Participating States will voluntarily share information on national organizations, programmes, or strategies relevant to their ICT security. This information will include the organization of the structures and a description of their mandate. Participating States will nominate a contact point to facilitate communications and dialogue on ICT-security matters.
3. Participating States will voluntarily provide contact details of existing official national Computer Security Incident Response Teams (CSIRTs), or equivalent official national structures, so that national experts can enter into a direct dialogue. Participating States will update contact information annually but in any event no later than thirty days after a change has occurred.
4. In order to reduce the risk of misunderstandings in the absence of agreed terminology, participating States will on a voluntary basis provide a list of national terminology related to ICT security accompanied by an explanation or definition of each term. It will be for each participating State to select those terms they deem most relevant for sharing.
5. Participating States will voluntarily exchange views on how existing OSCE mechanisms, such as the OSCE Communications Network, maintained by the OSCE Secretariat's Conflict Prevention Centre, could be used to facilitate communications regarding incidents involving ICTs, (e.g. establishing protocols to ensure rapid communication at high levels of authority, to permit concerns to be raised at the national security level.)
6. Participating States will, at the level of national experts, meet at least three times each year, within the framework of the Security Committee and its Informal Working Group established by PC Decision 1039 to discuss information exchanged and explore appropriate development of this initial list of confidence building measures as well as others that might be candidates for future consideration.

This set of draft CBMs are for discussion by the members. One of the documents included in the latest batch (Comments_AZE_IWB_1039.doc) offers comments from the delegation of Azerbaijan and Lithuania who both want to considerably beef up the language with a few intriguing suggestions:

General comment: Proposed list of CBMs, in general is not result-oriented and does not identify any imperative actions. All proposed CBMs are based on voluntary actions and most of them are already carried out by pS through other various international and regional organizations. We need some more concrete actions that define the responsibilities of the Participating States for the incidents stemming from the use of ICTs. 

Specific comments:

• Support the proposal made by Lithuania to add the following CBM to the list: “Participating States will refrain from directing malicious cyber activities against critical infrastructure vital to the wellbeing of civilians, such as telecommunications, energy, transportation and financial systems”;

• We support the following proposal made by Lithuania, as well: “Participating States will accept responsibility for their national cyberspace jurisdictions”.

• Moreover, in addition to the CBMs defining the responsibilities of the states for their actions in the cyber-space, it is very important to identify also the responsibilities of the States over their ICT companies to act in accordance with national legislation of other Participating States.

The concept of a nation state being held responsible for attacks emanating from servers within its borders has come up for discussion within U.S. DoD too. It would certainly make attribution a lot easier if we could simply point to the geolocation of an IP address and say case closed. Unfortunately, that's a completely unrealistic scenario since Internet Service Providers aren't regulated entities and because web servers are easy to compromise (i.e., OSCEPA.AT).

Most of the suggested CBMs are voluntary and fairly ineffective even if put into practice. That's probably due to the fact that the membership of this committee is heavily loaded with policy makers and lawyers and has very few technologists or security engineers. The attack that was levied against the OSCE by Anonymous was apparently of the same variety that its members prefer - looking for easy pickings against poorly-protected web servers. The first confidence building measure that these OSCE national experts should draft is to invoke an Assumption of Breach security framework. In other words, expect to be breached and keep your sensitive documents in a separate, controlled and monitored environment ; i.e., not on a web server.

Add to Cart View detail

OSCE Breached; Internal Documents Posted by Anonymous

The Organization for Security and Cooperation in Europe decided in 2011 to take on cyber security as one of its missions. The reality of threats in cyber space for the OSCE has become even more real now that their internal network has been breached in early November, 2012 by an unknown person or persons and the stolen files uploaded to Par-AnoIA.net. There has been no public acknowledgment from the OSCE that they have even had a breach. Frane Maroevic, Deputy Head of Press and Information for the OSCE told me in an email that "We condemn any illegal publication of confidential documents and will not comment on any such material."

The documents that Anonymous have posted are clearly genuine although it isn't known how they were obtained nor has anyone claimed responsibility for the attack. In addition to election monitoring reports and briefing books for Ukraine, Bosnia and the United States, there are internal RESTRICTED documents as well as emails and contact lists whose contents could be leveraged by bad actors to target members of OSCE and others with spear phishing or other types of targeted attacks.

Several of the documents referred to the "Informal Working Group Established Pursuant to PC Decision 1039" along with a list of its members. The purpose of this group is to establish "a breakthrough on Confidence Building Measures (CBM) designed to enhance cyber security. Our goal must be to maintain the momentum so as to outline a set of Confidence Building Measures in time for adoption at the Ministerial Council in Dublin." I asked Mr. Maroevic if he saw the value in demonstrating such CBMs right now in the face of their own breach. As of the time of this posting there's been no response from Mr. Maroevic.

The Dublin Council meeting mentioned in that document is scheduled to meet on December 6-7, 2012, however a captured Bi-weekly work schedule shows a meeting of the 1039 Working Group happening in Ireland on November 13, 2012 at 15:00. I expect this incident will be the highlight of their meeting especially since the names and email addresses of all of the members were part of the collection of documents posted to Par-AnoIA.net.

I'll update this post with any new developments from OSCE and/or from our examination of the documents.

UPDATE (09NOV12 2314GMT): A source representing Anonymous has claimed credit for the attack against OSCE. They breached the oscepa.at server which is the OSCE Parliamentary Authority hosted by Telekom.at; an Austrian service provider. The attack vector was not revealed although it may have been SQLi or perhaps an employee was compromised via a malicious payload delivered in a .pdf attachment.

Mr. Maroevic told me after my original article was posted that due to the sensitivity of the issue, the OSCE was unable to comment any further.

Add to Cart View detail

Anonymous Declares War Against the U.S.; And Calls "Bullshit" At The Same Time

Here's a glimpse at the confusing landscape of a "stateless nation". I spent some time yesterday on Twitter speaking with a variety of individuals who associate themselves with Anonymous over a literal declaration of war against the U.S. by Anonymous. Here are links to the video and its transcript. It contains pretty inflammatory language:

We are not calling upon the collective to deface or use a distributed denial of service attack on a United States government agency website or affiliate. We are not calling upon the people to occupy a city or protest in front of a local building. This has not brought on us any legislative change or alternate law. It has only brought us bloodshed and false criticism. For the last 12 years, voting was useless. Corporations and lobbyists are the true leaders of this country and are the ones with the power to control our lives. To rebuild our government, we must first destroy it.
Our time for democracy is here.
Our time for real change is here.
This is America’s time, to have its own revolution.
Therefore, Anonymous has decided to openly declare war on the United States government. This is a call to arms. We call upon the Citizens of the United States to stand beside us in overthrowing this corrupted body and call upon a new era. Our allegiance is to the American people, because they are us, and we are them.
Operation V, engaged.

Although the video in question looks like other Anonymous videos, the operation has been called "bull shit" by Anonymous IRC and other individuals who consider themselves part of the collective. It's also been labeled a "fake op" on YouTube. 

Operation V points out a serious problem for Anonymous. By having no centralized authority, it leaves itself open to suffering repercussions by the U.S. government for these questionable operations launched by pretty much anyone who feels like it. The organizers or "old fags" could easily see the non-violent protest organization that they worked to create over the years become radicalized by "new fags" who have no respect for their efforts and will subvert it to their own ends. A declaration of war against the U.S., fake or not, may come with serious consequences for the group and its members, including those who don't support it.

Add to Cart View detail

Was Stratfor Breached By An Insider?

While waiting for the other shoe to drop on the Stratfor breach (the release of a few million emails), I took a look at who works for the company in an attempt to understand how they could have made so many mistakes in handling their customer and client data as well as their network security. The adage that a company is only as good as its employees is certainly true about Stratfor.

The company was founded in Austin, TX in 1996 by George Friedman, an academic. LinkedIn has profiles on 63 of its employees. According to those profiles none have a background in information security. The company doesn't have a Chief Information Officer, Chief Security Officer, or Chief Information Security Officer. None of its employees' profiles show that any of them have ever worked at NSA, CIA or any other 3-letter agency. Two senior executives (Fred Burton and Scott Stewart) came from State's Diplomatic Security Service. Many of Stratfor's employees came to the company just after they graduated from college including, most importantly, their IT director for almost 13 years Michael Mooney. Mooney graduated from UT Austin in 1994, joined Stratfor in 1997 and left in September, 2011. I've tried to contact Mr. Mooney by email to find out his side of the story, why he left the company, etc., but so far, no joy. Stratfor's Chief Technology Officer Frank Ginac apparently didn't care for his work based upon his "Mooney's Turds" comment posted by Anonymous:

"It blew my mind to discover that our email server backups are being stored on the same physical server. I'm affectionately referring to these little discoveries as 'Mooney turds'."

If Mooney was fired and held a grudge against Ginac and/or Stratfor, then he would certainly have a motive for payback by helping Anonymous root the company's servers. The timing is certainly interesting. Mooney left the company and a new replacement was found for him almost immediately (October, 2011) which suggests that Ginac was unhappy with Mooney and was looking for a replacement before letting him go. Considering the shabby state of Stratfor's network security, the attacker(s) could have been in there for a few months prior to the December 24th event.

I'm not accusing Michael Mooney of being involved. I am, however, stating that attacks by insiders who hold a grudge against their employer are commonplace and Mooney's position along with the circumstances around his departure will certainly be explored by law enforcement as part of the investigation. Apart from who was allegedly involved, there's no mystery about why Stratfor's network was in the state that it was in. Security wasn't a priority and there was no in-house expertise to make it one. Next comes the consequences to Stratfor's customers, which George Friedman (CEO), Frank Ginac (CTO), and Darryl O'Connor (COO) all need to be held responsible for.

UPDATE (0337PST 03JAN12): According to Stratfor CTO Frank Ginac's Twitter stream, he had been looking to hire a System Administrator (Michael Mooney's job) since January 24, 2011. He repeated his need for a Sys Admin on 28 February and 22 July. It turns out that Michael Mooney wasn't the only Stratfor employee to leave the company in September 2011. So did a Cloud engineer named Trent Geerdes. Neither person has responded to my request for comment.

Ironically, four days before tweeting his first announcement (Jan 24, 2011), Ginac had this to say about security:

UPDATE (1850 PDT 18MAY12): To date there has not been any evidence that an insider was involved in this attack. The FBI has made arrests in the case.

Add to Cart View detail