Attacks/Breaches
6/21/2012
12:05 PM
50%
50%

Feds Bust Hacker For Selling Government Supercomputer Access

Pennsylvania man allegedly offered to sell login access to two Department of Energy supercomputers, as well as remote administration capabilities, for $50,000.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
The FBI last week announced the arrest of Andrew James Miller, 23, in Devon, Penn., on charges of hacking into numerous computers and selling stolen access credentials.

According to a grand jury indictment unsealed last week, Miller (a.k.a., Green, man, manual, libuuid, news, asfjp) was a member of a hacking group known as the Underground Intelligence Agency (UIA), and worked with another group member known as "Intel," who wasn't indicted.

According to the indictment, from 2008 to 2011 "Miller and others allegedly remotely hacked into computer networks belonging to RNK Telecommunications Inc., a Massachusetts company; Crispin Porter and Bogusky Inc., a Colorado advertising agency; the University of Massachusetts; the U.S. Department of Energy; and other institutions and companies."

"Miller and other members of the conspiracy remotely, surreptitiously, and without authorization, installed 'backdoors' onto computer servers and created 'magic passwords' that provided 'root' access to these compromised servers," according to the indictment. "Miller and other members of the conspiracy sold, or otherwise transferred, these 'magic passwords' and other stolen login credentials to others, including to an undercover agent from the Federal Bureau of Investigation."

[ Privacy Rights Clearinghouse has logged 266 breaches so far this year. Which are the worst? See 6 Biggest Breaches Of 2012. ]

Authorities said that in February 2011, Miller offered to sell the undercover FBI agent "root access to RNK's computer network" in exchange for two $500 payments, sent through Western Union, and addressed to "Andrew Miller" in Lancaster, Penn. After an agent transferred the first $500, "Miller provided the FBI [undercover agent] with the backdoor credentials and a list of hundreds of usernames and passwords that allowed root access to the RNK network." After transferring the other $500, authorities said that Miller then sold them access credentials for Crispin Porter and Bogusky, as well as the University of Massachusetts Amherst.

In April 16, 2011, meanwhile, the indictment said that Miller chatted with the undercover agent and said he'd accessed two nersc.gov supercomputers owned by the National Energy Research Scientific Computer Center (NERSC), which provides computer resources for the U.S. Department of Energy. In July 2011, authorities said that for $50,000, he offered to sell the undercover agent "login credentials to a series of computer networks that would enable remote access to the domain 'nersc.gov.'"

The charges filed against Miller include conspiracy, computer fraud, and access device fraud. If convicted of all charges, Miller faces up to 30 years in prison, as well as three years of supervised release, a $250,000 fine, and having to pay restitution.

Interestingly, the NERSC website notes that the type of data theft allegedly practiced by Miller is the center's top information security concern. "Credential theft represents the single greatest threat to security here at NERSC," according to the site. "We are addressing this problem by analyzing user command activity and looking for behavior that is recognizably hostile."

To help, the center said it uses a special version of Secure Shell (SSH) that makes it easier for the center to monitor session activity, as well as investigate breaches. "The data collected with this version of SSH is sent to one of our security systems where it is analyzed by an intrusion detection system called Bro," according to NERSC. "Using various signatures, some complex and some fairly simple, Bro is able to alert us when an account appears compromised. Furthermore, once a compromise is confirmed, the logs from this version of SSH will help us determine the extent of the compromise and what, precisely, the intruder did."

Geared specifically toward the federal government, its agencies, and third parties, FISMA is a set of requirements aimed at establishing a baseline level of computer and network security. In our FISMA Lifts All Compliance Boats report, we show that when you reach FISMA compliance, you'll likely be compliant with just about every security mandate out there. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/23/2012 | 2:28:39 PM
re: Feds Bust Hacker For Selling Government Supercomputer Access
That's a good point Paul. It is telling that it took undercover work to get an arrest. It underscores the complexity of the security problem, because it is always going to be an arms race between security technologies and the attackers.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
PJS880
50%
50%
PJS880,
User Rank: Ninja
6/21/2012 | 6:14:10 PM
re: Feds Bust Hacker For Selling Government Supercomputer Access
30 years and $250,000 dollar fine, doesnGt seem like that $1000 was such a good deal after all. WhatGs more disturbing than Miller gaining access to these systems is that NERSC security measures did not catch him, it was the work of an undercover Fed. If you are going to hack systems for their credentials, you probably shouldnGt ask to be paid via Western Union. Maybe PayPal would have been a better payment option, they have seller protection!

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.