Risk
7/18/2013
11:40 AM
50%
50%

Anonymous To FEMA: Shall We Play A Game?

Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
"Hello FEMA, Anonymous here, shall we play a game?"

So read a Wed. communication from the hacktivist group Anonymous, which appears to be catching up on unfinished business in the form of a data dump -- aka dox -- of a database obtained from the Federal Emergency Management Agency (FEMA).

The dox, posted to Pastebin late Wednesday, has since been deleted. But according to a mirrored copy of the post, it appeared to include numerous names, mailing addresses, email addresses, MD5-hashed passwords and database ID numbers associated with people who were designated by FEMA to respond to national emergencies. "Anonymous has purposefully redacted logins, passwords, SSNs and other details that might genuinely endanger the United States from this document, our intent is not to harm, merely to issue a firm warning," read the Anonymous post.

[ FBI and Homeland Security tried to slow attacks by sharing IP addresses of suspected Chinese hackers with U.S. service providers. Read more: Feds Shared Chinese Hacker Data With Service Providers. ]

The delayed impetus for the dox was a "Cyber Capabilities Tabletop Exercise" conducted in May 2012 by FEMA, involving what organizers said were "three dozen Federal Government departments and agencies, 10 states and territories, scores of private sector companies and trade associations, and four international partners." The exercise simulated a series of online attacks by a fictional group known as "The Void," which targeted critical infrastructure and private businesses' systems. "This cyber scenario based exercise ... is designed to increase understanding of cyber threat alerts, warning, and information sharing across sectors, and to test and evaluate government-private sector coordinating structures, processes, and capabilities regarding cyber event response and recovery," read FEMA's description of the war-gaming exercise.

Anonymous said it objected to the fictional hacktvist group in the FEMA exercise being portrayed as anti-American, and for having attempted to transfer funds from a breached business into an overseas account. "We are not against any one country or corporation. However if you are an enemy of anonymity, if you oppose free speech, you are our foe, it is as simple as that," the group said. Seemingly not one to miss a trick, the Anonymous message even included a quote from philosopher Friedrich Nietzsche: "If you look long enough into the void the void begins to look back through you."

The group also appears to have been offended by the ease with which the hypothetical hacktivist group was dispatched by federal defenders, with the help of a "turncoat informant." "Good thing Anonymous is a little more persistent than a shoddy knockoff group dreamed up by corporate shills for the sole purpose of being thwarted by an apparently unassailable US government and one of their many highly paid corporate bootlickers," they said.

The hacktivists behind the dox also noted that the FEMA exercise was organized by security consulting firm Obsidian Analysis. "It should shock nobody that former FEMA chief of staff Jason McNamara has since joined Obsidian's executive management team as vice president," said Anonymous.

Beyond the dox being meant as a warning against future "oblique and cowardly implied threats" against Anonymous, the group also lodged a demand: "Please return to us Barrett Brown, we are asking nicely. Pretty please, with sugar on top." Brown, a former Anonymous spokesman, was charged in Dec. 2012 in a 12-count indictment that included accusations of access device fraud, ID theft and possessing stolen credit card numbers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:19:30 PM
re: Anonymous To FEMA: Shall We Play A Game?
Anonymous took the exercise too personally. When you run gaming and training scenarios you have to come up with these composite fictional groups and people to get through the training in the time allocated. A lot of times the "government" or the "good guy" loses. The training participants learn from both "wins" and "loses".
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:14:01 PM
re: Anonymous To FEMA: Shall We Play A Game?
+1
UberGoober
50%
50%
UberGoober,
User Rank: Apprentice
7/19/2013 | 2:44:27 PM
re: Anonymous To FEMA: Shall We Play A Game?
Wow... Anonymous vs FEMA? Kinda like al Qaeda vs Bashar Asad, you regret the war but its a pity that either would win.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

CVE-2015-2922
Published: 2015-05-27
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?