Risk
7/18/2013
11:40 AM
50%
50%

Anonymous To FEMA: Shall We Play A Game?

Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
"Hello FEMA, Anonymous here, shall we play a game?"

So read a Wed. communication from the hacktivist group Anonymous, which appears to be catching up on unfinished business in the form of a data dump -- aka dox -- of a database obtained from the Federal Emergency Management Agency (FEMA).

The dox, posted to Pastebin late Wednesday, has since been deleted. But according to a mirrored copy of the post, it appeared to include numerous names, mailing addresses, email addresses, MD5-hashed passwords and database ID numbers associated with people who were designated by FEMA to respond to national emergencies. "Anonymous has purposefully redacted logins, passwords, SSNs and other details that might genuinely endanger the United States from this document, our intent is not to harm, merely to issue a firm warning," read the Anonymous post.

[ FBI and Homeland Security tried to slow attacks by sharing IP addresses of suspected Chinese hackers with U.S. service providers. Read more: Feds Shared Chinese Hacker Data With Service Providers. ]

The delayed impetus for the dox was a "Cyber Capabilities Tabletop Exercise" conducted in May 2012 by FEMA, involving what organizers said were "three dozen Federal Government departments and agencies, 10 states and territories, scores of private sector companies and trade associations, and four international partners." The exercise simulated a series of online attacks by a fictional group known as "The Void," which targeted critical infrastructure and private businesses' systems. "This cyber scenario based exercise ... is designed to increase understanding of cyber threat alerts, warning, and information sharing across sectors, and to test and evaluate government-private sector coordinating structures, processes, and capabilities regarding cyber event response and recovery," read FEMA's description of the war-gaming exercise.

Anonymous said it objected to the fictional hacktvist group in the FEMA exercise being portrayed as anti-American, and for having attempted to transfer funds from a breached business into an overseas account. "We are not against any one country or corporation. However if you are an enemy of anonymity, if you oppose free speech, you are our foe, it is as simple as that," the group said. Seemingly not one to miss a trick, the Anonymous message even included a quote from philosopher Friedrich Nietzsche: "If you look long enough into the void the void begins to look back through you."

The group also appears to have been offended by the ease with which the hypothetical hacktivist group was dispatched by federal defenders, with the help of a "turncoat informant." "Good thing Anonymous is a little more persistent than a shoddy knockoff group dreamed up by corporate shills for the sole purpose of being thwarted by an apparently unassailable US government and one of their many highly paid corporate bootlickers," they said.

The hacktivists behind the dox also noted that the FEMA exercise was organized by security consulting firm Obsidian Analysis. "It should shock nobody that former FEMA chief of staff Jason McNamara has since joined Obsidian's executive management team as vice president," said Anonymous.

Beyond the dox being meant as a warning against future "oblique and cowardly implied threats" against Anonymous, the group also lodged a demand: "Please return to us Barrett Brown, we are asking nicely. Pretty please, with sugar on top." Brown, a former Anonymous spokesman, was charged in Dec. 2012 in a 12-count indictment that included accusations of access device fraud, ID theft and possessing stolen credit card numbers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:19:30 PM
re: Anonymous To FEMA: Shall We Play A Game?
Anonymous took the exercise too personally. When you run gaming and training scenarios you have to come up with these composite fictional groups and people to get through the training in the time allocated. A lot of times the "government" or the "good guy" loses. The training participants learn from both "wins" and "loses".
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:14:01 PM
re: Anonymous To FEMA: Shall We Play A Game?
+1
UberGoober
50%
50%
UberGoober,
User Rank: Apprentice
7/19/2013 | 2:44:27 PM
re: Anonymous To FEMA: Shall We Play A Game?
Wow... Anonymous vs FEMA? Kinda like al Qaeda vs Bashar Asad, you regret the war but its a pity that either would win.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9209
Published: 2015-03-30
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.