Attacks/Breaches
5/8/2014
02:45 PM
Connect Directly
RSS
E-Mail
50%
50%

Navy Nuclear Carrier Sysadmin Busted For Hacking Databases

Boredom cited as excuse for alleged hack campaign that may have compromised more than 30 government and private sites.

 

10 Ways To Fight Digital Theft & Fraud
10 Ways To Fight Digital Theft & Fraud
(Click image for larger view and slideshow.)

A former US Navy systems administrator is part of a group that's been charged with hacking into 30 different sites and stealing sensitive information, while working in the nuclear reactor department aboard the USS Harry S. Truman aircraft carrier.

A 22-page indictment filed this week in US District Court in Oklahoma charged alleged members of "Team Digi7al" with hacking and stealing sensitive information from sites run by the likes of the Department of Homeland Security, Los Alamos National Laboratory, Harvard University, AT&T U-verse, and the Toronto Police Department.

According to the indictment, the gang comprised at least five people: Nicholas Paul Knight (a.k.a. Inertia, Logic, nickmc01, Solo, INER7IA), 27, a former enlisted Navy member and self-described "nuclear black hat" who handled publicity; Daniel Trenton Krueger (Thor, Orunu, Gambit, Chronius, 7hor, G4mbi7), 20, a network administration student at an Illinois community college who handled the technical side; and three minors -- based in Alabama, Georgia, and Louisiana -- who performed technical hacking work.

If a Team Digi7al Pastebin post is to be believed, however, the group counted eight members: Logic, 7hor, Shr00mi3, Sp3ctrum, Ichi, Kalypto, Th1nkT0k3n, and ThePonyWizard.

[Those serving in the military are twice as likely to fall victim to identity theft as the general public. How can we mitigate the risk? Read Defending Against Identity Theft In The Military.]

Regardless, the group drew the attention of the Naval Criminal Investigative Service (NCIS) after the gang's members began posting to Twitter (@TeamDigi7al) links to dumps of partial personal information pertaining to 20 Navy personnel.

"So heres that #Dump i was talking about. #US #Navy was our target," read a June 17, 2012, post. About a week later, the group also posted a link to the Navy's Smart Web Move site. Launched in June 2001, the web-based service was developed

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Moderator
5/13/2014 | 6:58:16 PM
Rank amateurs
I'm glad were catching the rank amateurs, who boast of their exploits on Twitter. That's helpful to investigators. I wonder how we're doing against the true professionals.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/12/2014 | 11:54:59 AM
Re: Lack of PII security
Many organizations do not employ (citing cost or low risk) internal IDS/IPS.  I would be surprised if the Navy was any different.  Unfortunately, it will take many more of these insider events before companies take the issue more seriously.
electronbee
50%
50%
electronbee,
User Rank: Apprentice
5/9/2014 | 2:04:28 PM
Lack of PII security
The real reason for this was their sense of invincibility and not properly securing the network. Where is the IDS/IPS and the access control for the databases? Hello?
jwaters974
50%
50%
jwaters974,
User Rank: Apprentice
5/9/2014 | 1:06:57 PM
Re: Insider Threat
It seems the gravity of the crime and the potential sentences do not match up.

A clearly bad "risk : reward ratio" must exist to discourage this behavior. Five year sentences are reduced for good behavior but the bribes for info and hacking could well be worth it - considering the deep pockets of our adversaries... both state and non state actors.

Hacking military assets is the most serious crime anyone in the military could do- certainly more perilous to the services than an individual throwing down their rifle and deserting in battle. (Not participating in battle out of fear vs. swinging an advantage to the enemy by exposing personnel and information, sharing classified access with MINORS who don't know sqat about national security and its consequences all because you are bored).

Playing "black hat" on an aircraft carrier - potentially compromising the safety of the crew (and in the wrong scenario - possibly many other military and civillian personnel) and billions of dollars of taxpayers assets

- in this cloaked world of secretive and ongoing wars (physical and cyber), we are always at war - and so this crime seems worthy of capital punishment. As is the case for desertion in battle.

I'm just saying......

 

 
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/8/2014 | 3:45:44 PM
Insider Threat
Insider threats are always the hardest to defend, your employees have to be able to do the job they are hired to do but so often they are the ones who post the biggest risk.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8243
Published: 2014-11-01
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote a...

CVE-2014-8244
Published: 2014-11-01
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote a...

CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.