Attacks/Breaches
2/28/2012
12:14 PM
50%
50%

WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure

Hacktivist group Anonymous said it obtained the intelligence contractor's clear-text emails, and shared them with whistleblower and information-release website WikiLeaks, as part of a new working relationship.

On a related note, early news reports had questioned how WikiLeaks had received the Stratfor archive. But a Twitter post from AnonOps said Monday, "To clarify to all journalists - YES, #Anonymous gave the STRATFOR emails obtained in the 2011 LulzXmas hack to WikiLeaks. #GIFiles." The GIFiles tag refers to "The Global Intelligence Files" campaign being run by WikiLeaks, which appears to be updated naming for "The Spy Files" program WikiLeaks announced in December 2011, when it said it planned to release "hundreds of documents from as many as 160 intelligence contractors in the mass surveillance industry."

With that possibility still looming, Michael Ross, a Canadian expert on intelligence gathering and former Israeli Mossad officer, noted that the release of Stratfor emails, which he's begun reviewing, highlights the dangers of attempting to spy on others--especially in today's WikiLeaks world.

But writing in Canada's National Post, he said the bigger question is whether such services offer any real value. "Stratfor, and other similar outfits that have cropped up like weeds in the post 9/11 era, are cashing in by offering up a lot of so-called expert opinion that isn't worth anything more than what can be found in a Robert Ludlum novel," he said. "The difference between an intelligence service and a company like Stratfor is that they know how to focus their resources and assess information by separating the wheat from the chaff. By all accounts of the Wikileaks Stratfor emails, their clients are getting nothing but a lot of chaff."

Ironically, according to the internal emails, Stratfor employees had looked for a way to cash in the information-leakage "gravy train" created by the WikiLeaks release of U.S. cables. "Could we develop some ideas and procedures on the idea of 'leak-focused' network security that focuses on preventing one's own employees from leaking sensitive information... In fact, I'm not so sure this is an IT problem that requires an IT solution," read one email.

But Forrester Research information security analyst John Kindervag said that Stratfor should have paid attention to its own IT problems--namely, its failure to encrypt its own, sensitive emails. "They would have saved themselves a ton of embarrassment--not to mention all of the costs associated with the breach--had they deployed encryption on their toxic data stores," he said. "Compared to all of the costs, hassles, embarrassment, and brand damage, the cost to do enterprise quality encryption would have been trivial."

Instead, he said, the firm is following Fred's #2 rule: "Admit nothing, deny everything and make counter-accusations." That rule was cited during a Stratfor missing-lunch email chain, tracking the whereabouts of a missing pesto tortellini from a company refrigerator. Unfortunately for Stratfor, denial or no, that won't be the only company secret to be made public.

The effort to achieve and maintain compliance with Sarbanes-Oxley requirements remains one of the primary drivers behind many IT security initiatives. In our Security Via SOX Compliance report, we share 10 best practices to meet SOX security-related requirements and help ensure you'll pass your next compliance audit. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sabrina
50%
50%
Sabrina,
User Rank: Apprentice
3/1/2012 | 7:01:43 AM
re: WikiLeaks Stratfor Disclosure Highlights Email Encryption Failure
Thanks for sharing the info
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7241
Published: 2014-12-19
The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.

CVE-2014-7249
Published: 2014-12-19
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 992...

CVE-2014-7267
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7268.

CVE-2014-7268
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7267.

CVE-2014-8272
Published: 2014-12-19
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.