Risk
7/18/2013
11:40 AM
Connect Directly
RSS
E-Mail
50%
50%

Anonymous To FEMA: Shall We Play A Game?

Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
"Hello FEMA, Anonymous here, shall we play a game?"

So read a Wed. communication from the hacktivist group Anonymous, which appears to be catching up on unfinished business in the form of a data dump -- aka dox -- of a database obtained from the Federal Emergency Management Agency (FEMA).

The dox, posted to Pastebin late Wednesday, has since been deleted. But according to a mirrored copy of the post, it appeared to include numerous names, mailing addresses, email addresses, MD5-hashed passwords and database ID numbers associated with people who were designated by FEMA to respond to national emergencies. "Anonymous has purposefully redacted logins, passwords, SSNs and other details that might genuinely endanger the United States from this document, our intent is not to harm, merely to issue a firm warning," read the Anonymous post.

[ FBI and Homeland Security tried to slow attacks by sharing IP addresses of suspected Chinese hackers with U.S. service providers. Read more: Feds Shared Chinese Hacker Data With Service Providers. ]

The delayed impetus for the dox was a "Cyber Capabilities Tabletop Exercise" conducted in May 2012 by FEMA, involving what organizers said were "three dozen Federal Government departments and agencies, 10 states and territories, scores of private sector companies and trade associations, and four international partners." The exercise simulated a series of online attacks by a fictional group known as "The Void," which targeted critical infrastructure and private businesses' systems. "This cyber scenario based exercise ... is designed to increase understanding of cyber threat alerts, warning, and information sharing across sectors, and to test and evaluate government-private sector coordinating structures, processes, and capabilities regarding cyber event response and recovery," read FEMA's description of the war-gaming exercise.

Anonymous said it objected to the fictional hacktvist group in the FEMA exercise being portrayed as anti-American, and for having attempted to transfer funds from a breached business into an overseas account. "We are not against any one country or corporation. However if you are an enemy of anonymity, if you oppose free speech, you are our foe, it is as simple as that," the group said. Seemingly not one to miss a trick, the Anonymous message even included a quote from philosopher Friedrich Nietzsche: "If you look long enough into the void the void begins to look back through you."

The group also appears to have been offended by the ease with which the hypothetical hacktivist group was dispatched by federal defenders, with the help of a "turncoat informant." "Good thing Anonymous is a little more persistent than a shoddy knockoff group dreamed up by corporate shills for the sole purpose of being thwarted by an apparently unassailable US government and one of their many highly paid corporate bootlickers," they said.

The hacktivists behind the dox also noted that the FEMA exercise was organized by security consulting firm Obsidian Analysis. "It should shock nobody that former FEMA chief of staff Jason McNamara has since joined Obsidian's executive management team as vice president," said Anonymous.

Beyond the dox being meant as a warning against future "oblique and cowardly implied threats" against Anonymous, the group also lodged a demand: "Please return to us Barrett Brown, we are asking nicely. Pretty please, with sugar on top." Brown, a former Anonymous spokesman, was charged in Dec. 2012 in a 12-count indictment that included accusations of access device fraud, ID theft and possessing stolen credit card numbers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:19:30 PM
re: Anonymous To FEMA: Shall We Play A Game?
Anonymous took the exercise too personally. When you run gaming and training scenarios you have to come up with these composite fictional groups and people to get through the training in the time allocated. A lot of times the "government" or the "good guy" loses. The training participants learn from both "wins" and "loses".
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:14:01 PM
re: Anonymous To FEMA: Shall We Play A Game?
+1
UberGoober
50%
50%
UberGoober,
User Rank: Apprentice
7/19/2013 | 2:44:27 PM
re: Anonymous To FEMA: Shall We Play A Game?
Wow... Anonymous vs FEMA? Kinda like al Qaeda vs Bashar Asad, you regret the war but its a pity that either would win.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3352
Published: 2014-08-30
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh...

CVE-2014-3908
Published: 2014-08-30
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.