Risk
7/18/2013
11:40 AM
50%
50%

Anonymous To FEMA: Shall We Play A Game?

Offended by FEMA's portrayal of fictional hacktivists as anti-American and easily defeated, Anonymous strikes back with data dump.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
"Hello FEMA, Anonymous here, shall we play a game?"

So read a Wed. communication from the hacktivist group Anonymous, which appears to be catching up on unfinished business in the form of a data dump -- aka dox -- of a database obtained from the Federal Emergency Management Agency (FEMA).

The dox, posted to Pastebin late Wednesday, has since been deleted. But according to a mirrored copy of the post, it appeared to include numerous names, mailing addresses, email addresses, MD5-hashed passwords and database ID numbers associated with people who were designated by FEMA to respond to national emergencies. "Anonymous has purposefully redacted logins, passwords, SSNs and other details that might genuinely endanger the United States from this document, our intent is not to harm, merely to issue a firm warning," read the Anonymous post.

[ FBI and Homeland Security tried to slow attacks by sharing IP addresses of suspected Chinese hackers with U.S. service providers. Read more: Feds Shared Chinese Hacker Data With Service Providers. ]

The delayed impetus for the dox was a "Cyber Capabilities Tabletop Exercise" conducted in May 2012 by FEMA, involving what organizers said were "three dozen Federal Government departments and agencies, 10 states and territories, scores of private sector companies and trade associations, and four international partners." The exercise simulated a series of online attacks by a fictional group known as "The Void," which targeted critical infrastructure and private businesses' systems. "This cyber scenario based exercise ... is designed to increase understanding of cyber threat alerts, warning, and information sharing across sectors, and to test and evaluate government-private sector coordinating structures, processes, and capabilities regarding cyber event response and recovery," read FEMA's description of the war-gaming exercise.

Anonymous said it objected to the fictional hacktvist group in the FEMA exercise being portrayed as anti-American, and for having attempted to transfer funds from a breached business into an overseas account. "We are not against any one country or corporation. However if you are an enemy of anonymity, if you oppose free speech, you are our foe, it is as simple as that," the group said. Seemingly not one to miss a trick, the Anonymous message even included a quote from philosopher Friedrich Nietzsche: "If you look long enough into the void the void begins to look back through you."

The group also appears to have been offended by the ease with which the hypothetical hacktivist group was dispatched by federal defenders, with the help of a "turncoat informant." "Good thing Anonymous is a little more persistent than a shoddy knockoff group dreamed up by corporate shills for the sole purpose of being thwarted by an apparently unassailable US government and one of their many highly paid corporate bootlickers," they said.

The hacktivists behind the dox also noted that the FEMA exercise was organized by security consulting firm Obsidian Analysis. "It should shock nobody that former FEMA chief of staff Jason McNamara has since joined Obsidian's executive management team as vice president," said Anonymous.

Beyond the dox being meant as a warning against future "oblique and cowardly implied threats" against Anonymous, the group also lodged a demand: "Please return to us Barrett Brown, we are asking nicely. Pretty please, with sugar on top." Brown, a former Anonymous spokesman, was charged in Dec. 2012 in a 12-count indictment that included accusations of access device fraud, ID theft and possessing stolen credit card numbers.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
UberGoober
50%
50%
UberGoober,
User Rank: Apprentice
7/19/2013 | 2:44:27 PM
re: Anonymous To FEMA: Shall We Play A Game?
Wow... Anonymous vs FEMA? Kinda like al Qaeda vs Bashar Asad, you regret the war but its a pity that either would win.
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:14:01 PM
re: Anonymous To FEMA: Shall We Play A Game?
+1
davidhoffman
50%
50%
davidhoffman,
User Rank: Apprentice
7/19/2013 | 7:19:30 PM
re: Anonymous To FEMA: Shall We Play A Game?
Anonymous took the exercise too personally. When you run gaming and training scenarios you have to come up with these composite fictional groups and people to get through the training in the time allocated. A lot of times the "government" or the "good guy" loses. The training participants learn from both "wins" and "loses".
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.