Attacks/Breaches
2/28/2012
12:14 PM
50%
50%

WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure

Hacktivist group Anonymous said it obtained the intelligence contractor's clear-text emails, and shared them with whistleblower and information-release website WikiLeaks, as part of a new working relationship.

On a related note, early news reports had questioned how WikiLeaks had received the Stratfor archive. But a Twitter post from AnonOps said Monday, "To clarify to all journalists - YES, #Anonymous gave the STRATFOR emails obtained in the 2011 LulzXmas hack to WikiLeaks. #GIFiles." The GIFiles tag refers to "The Global Intelligence Files" campaign being run by WikiLeaks, which appears to be updated naming for "The Spy Files" program WikiLeaks announced in December 2011, when it said it planned to release "hundreds of documents from as many as 160 intelligence contractors in the mass surveillance industry."

With that possibility still looming, Michael Ross, a Canadian expert on intelligence gathering and former Israeli Mossad officer, noted that the release of Stratfor emails, which he's begun reviewing, highlights the dangers of attempting to spy on others--especially in today's WikiLeaks world.

But writing in Canada's National Post, he said the bigger question is whether such services offer any real value. "Stratfor, and other similar outfits that have cropped up like weeds in the post 9/11 era, are cashing in by offering up a lot of so-called expert opinion that isn't worth anything more than what can be found in a Robert Ludlum novel," he said. "The difference between an intelligence service and a company like Stratfor is that they know how to focus their resources and assess information by separating the wheat from the chaff. By all accounts of the Wikileaks Stratfor emails, their clients are getting nothing but a lot of chaff."

Ironically, according to the internal emails, Stratfor employees had looked for a way to cash in the information-leakage "gravy train" created by the WikiLeaks release of U.S. cables. "Could we develop some ideas and procedures on the idea of 'leak-focused' network security that focuses on preventing one's own employees from leaking sensitive information... In fact, I'm not so sure this is an IT problem that requires an IT solution," read one email.

But Forrester Research information security analyst John Kindervag said that Stratfor should have paid attention to its own IT problems--namely, its failure to encrypt its own, sensitive emails. "They would have saved themselves a ton of embarrassment--not to mention all of the costs associated with the breach--had they deployed encryption on their toxic data stores," he said. "Compared to all of the costs, hassles, embarrassment, and brand damage, the cost to do enterprise quality encryption would have been trivial."

Instead, he said, the firm is following Fred's #2 rule: "Admit nothing, deny everything and make counter-accusations." That rule was cited during a Stratfor missing-lunch email chain, tracking the whereabouts of a missing pesto tortellini from a company refrigerator. Unfortunately for Stratfor, denial or no, that won't be the only company secret to be made public.

The effort to achieve and maintain compliance with Sarbanes-Oxley requirements remains one of the primary drivers behind many IT security initiatives. In our Security Via SOX Compliance report, we share 10 best practices to meet SOX security-related requirements and help ensure you'll pass your next compliance audit. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sabrina
50%
50%
Sabrina,
User Rank: Apprentice
3/1/2012 | 7:01:43 AM
re: WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure
Thanks for sharing the info
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.