In February, Aaron Barr, CEO of cybersecurity consulting firm HBGary Federal, unwittingly picked a fight with the pro-Wikileaks band of hackers when he boasted in an online article that his company had successfully infiltrated Anonymous by trolling online social media and had gathered personal data on its members. In retaliation, Anonymous hacked into the email accounts of HBGary (the parent company of HBGary Federal) and posted thousands of their emails online. They also hacked Barr’s iPad, iPhone, and his online accounts. Discovered among the cache of emails was a proposed project on which HBGary Federal was to team up with two other cybersecurity contracting firms, Berico Technologies, and Palantir Technologies, to conduct a campaign to “sabotage or discredit” Wikileaks, Wikileaks supporters (including prominent blogger Glenn Greenwald), and other perceived “threats” to two potential clients, Bank of America and the U.S. Chamber of Commerce.
On Monday morning “hacktivist” group Anonymous promised that it would be releasing results of an attack it made on the intelligence community compromised of government agencies around the world like the CIA or Mi6 in the United Kingdom and the companies that support them.
The first wave of results have just been released, (Pirate Bay link) which Anonymous is calling #MilitaryMeltdownMonday. Anonymous targeted consulting firm Booz Allen Hamilton that often works the with U.S. Department of Defense and National Security Administration and gained access to 90,000 military emails, four gigabytes of source code (which was erased from the Booz Allen Hamilton servers) along with login credentials and other sources of information that Anonymous can hack along the intelligence community’s digital infrastructure. What did Anonymous find in Boox Allen Hamilton’s servers and how damaging could be it be to American homeland security?
Keeping with the previous themes of ships (Lulz Security called itself the Lulz Boat), Anonymous calls Booz Allen Hamilton a wooden barge with no security at all. Here is how Anonymous described the attack on Booz Allen Hamiliton:
“We infiltrated a server on their network that basically had no security measures in place,” Anonymous wrote. “We were able to run our own application, which turned out to be a shell and began plundering some booty. Most shiny is probably a list of roughly 90,000 military emails and password hashes (md5, non-salted of course!). We also added the complete sqldump, compressed ~50mb, for a good measure.”
For a trove of articles about the original HBGary hack, check here.
In terms of what Anonymous found in the Booz Allen Hamilton servers, there are certainly items that will get people fired. One of the bigger items is Booz Allen Hamilton’s association with security company HBGary. Booz Allen Hamilton and HBGary Federal proposed software for a sophisticated program (dubbed Metal Gear by Anonymous) that would allow security teams to control “sock puppet” online identities in social media spheres that would attempt to steer conversation about certain topics. One way or another because of this program, Anonymous claims that all U.S. military personnel will now have to change their passwords.90,000 Military Emails Leaked After Anonymous Attack (via metamorphoseandbodhi)
Clearly offensive cyber operations far predate the 2009 founding of USCYBERCOM.
The email conversations make clear what many have known, that offensive cyber operations against individuals and nation states have been going on for a long, long time.
Experts who claim otherwise are misinformed at best, or actively spreading misinformation at worst. When it comes to cyberwar, the matter is best handled by William Gibson’s famous quote: “The future is already here - it’s just not very evenly distributed.”
Palantir never has and never will condone the sort of activities that HBGaryrecommended” and “Palantir did not participate in the development of the recommendations that Palantir and others find offensive.
OK.
From the Email:
Apologies for taking this long to get back to you. Eli and I had to run this way up the chain (as you can imagine). The short of it is that we got approval from Dr. Karp and the Board to go ahead with the modified 40/30/30 breakdown proposed. These were not fun conversations, but we are committed to this team and we can optimize the cost structure in the long term(let’s demonstrate success and then take over this market :)).
We will have to amend a few things in the T&Csprovided to account for this. Sean, can you please amend the T&Cs sent to Berico to reflect 100k for Phase I and 800k for Phase II. Additionally, for Phase II, please reduce the number of cores to 196. I believe we are also working out the language for exclusivity on Corporate Campaign work.
We think that the issues you raised below are valid. Know that while we understand Berico/HBGary will be shouldering the analysis work, we expect that Palantir will still be providing needed infrastructure and support services to make this happen. I imagine we will ALL know more about what this breakdown will look like once work begins. I have a feeling that either way it will seem like money falling from the sky for those of us used to working in the govt sector.
As always, please let me know if you would like to discuss anything.
Hey! This is fantastic. More juicy cyberspying tidbits from the leaked emails of HBGary. The link to the FedBizOpps post detailing solicitation for fake social network Personas is here.
“Whether Woods’ dealings with practitioners of the digital dark arts–and those of his two colleagues–add up to grounds for losing his ability to practice is now in the hands of the Bar association.”
Corporate Hacker Tries to Take Down WikiLeaks - Glenn Greenwald
Glenn Greenwald praises WikiLeaks for shining a light on what government and corporations do in secret. (03:54)
Stephen Colbert lays out the HBGary story for us. Messing with Anonymous is like putting your penis in a hornet’s nest.
