Risk
7/18/2013
11:40 AM
50%
50%

Anonymous To FEMA: Shall We Play A Game?

Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
"Hello FEMA, Anonymous here, shall we play a game?"

So read a Wed. communication from the hacktivist group Anonymous, which appears to be catching up on unfinished business in the form of a data dump -- aka dox -- of a database obtained from the Federal Emergency Management Agency (FEMA).

The dox, posted to Pastebin late Wednesday, has since been deleted. But according to a mirrored copy of the post, it appeared to include numerous names, mailing addresses, email addresses, MD5-hashed passwords and database ID numbers associated with people who were designated by FEMA to respond to national emergencies. "Anonymous has purposefully redacted logins, passwords, SSNs and other details that might genuinely endanger the United States from this document, our intent is not to harm, merely to issue a firm warning," read the Anonymous post.

[ FBI and Homeland Security tried to slow attacks by sharing IP addresses of suspected Chinese hackers with U.S. service providers. Read more: Feds Shared Chinese Hacker Data With Service Providers. ]

The delayed impetus for the dox was a "Cyber Capabilities Tabletop Exercise" conducted in May 2012 by FEMA, involving what organizers said were "three dozen Federal Government departments and agencies, 10 states and territories, scores of private sector companies and trade associations, and four international partners." The exercise simulated a series of online attacks by a fictional group known as "The Void," which targeted critical infrastructure and private businesses' systems. "This cyber scenario based exercise ... is designed to increase understanding of cyber threat alerts, warning, and information sharing across sectors, and to test and evaluate government-private sector coordinating structures, processes, and capabilities regarding cyber event response and recovery," read FEMA's description of the war-gaming exercise.

Anonymous said it objected to the fictional hacktvist group in the FEMA exercise being portrayed as anti-American, and for having attempted to transfer funds from a breached business into an overseas account. "We are not against any one country or corporation. However if you are an enemy of anonymity, if you oppose free speech, you are our foe, it is as simple as that," the group said. Seemingly not one to miss a trick, the Anonymous message even included a quote from philosopher Friedrich Nietzsche: "If you look long enough into the void the void begins to look back through you."

The group also appears to have been offended by the ease with which the hypothetical hacktivist group was dispatched by federal defenders, with the help of a "turncoat informant." "Good thing Anonymous is a little more persistent than a shoddy knockoff group dreamed up by corporate shills for the sole purpose of being thwarted by an apparently unassailable US government and one of their many highly paid corporate bootlickers," they said.

The hacktivists behind the dox also noted that the FEMA exercise was organized by security consulting firm Obsidian Analysis. "It should shock nobody that former FEMA chief of staff Jason McNamara has since joined Obsidian's executive management team as vice president," said Anonymous.

Beyond the dox being meant as a warning against future "oblique and cowardly implied threats" against Anonymous, the group also lodged a demand: "Please return to us Barrett Brown, we are asking nicely. Pretty please, with sugar on top." Brown, a former Anonymous spokesman, was charged in Dec. 2012 in a 12-count indictment that included accusations of access device fraud, ID theft and possessing stolen credit card numbers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:19:30 PM
re: Anonymous To FEMA: Shall We Play A Game?
Anonymous took the exercise too personally. When you run gaming and training scenarios you have to come up with these composite fictional groups and people to get through the training in the time allocated. A lot of times the "government" or the "good guy" loses. The training participants learn from both "wins" and "loses".
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:14:01 PM
re: Anonymous To FEMA: Shall We Play A Game?
+1
UberGoober
50%
50%
UberGoober,
User Rank: Apprentice
7/19/2013 | 2:44:27 PM
re: Anonymous To FEMA: Shall We Play A Game?
Wow... Anonymous vs FEMA? Kinda like al Qaeda vs Bashar Asad, you regret the war but its a pity that either would win.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5075
Published: 2014-12-27
Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and panic) via a crafted IOCTL_ASWFW_COMM_PIDINFO_RESULTS DeviceIoControl request to \\.\aswFW.

CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2011-4722
Published: 2014-12-27
Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2012-1302
Published: 2014-12-27
Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ammap.swf, or (3) the data_file parameter to amtimeline.swf.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.