Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/27/2013
11:06 AM

9 Notorious Hackers Of 2013

This year's hacking hall of shame includes members of Anonymous and the Blackhole cybercrime gang, plus state-sponsored groups.
3 of 10

Stratfor hacker Jeremy Hammond
(Source: Jim Newberry, FreeHammond.com)

Anonymous-allied Jeremy Hammond hacked into the private intelligence contractor Strategic Forecasting (known as Stratfor) in late 2011 and then posted the stolen files to a server that now appears to have been owned by the FBI. He also distributed the stolen information to WikiLeaks, which published it as part of its Global Intelligence Files program.
Hammond was indicted in 2012. In May 2013, he pleaded guilty to one count of conspiracy to engage in computer hacking. He admitted to masterminding the Stratfor hack, compromising account information for approximately 860,000 Stratfor users, and publishing stolen data pertaining to 60,000 credit cards. Anonymous later used the cards to make $700,000 in unauthorized donations to nonprofit groups. In addition, Hammond admitted to hacking numerous other organizations, ranging from the FBI's Virtual Academy and the Arizona Department of Public Safety to the Jefferson County Sheriff's Office in Alabama and the Boston Police Patrolmen's Association. Thanks to the hacking count, Hammond faced up to 10 years in prison and up to $2.5 million in restitution.
After Hammond pleaded guilty, but before Judge Loretta Preska sentenced him in November, Hammond's supporters launched a letter-writing campaign in pursuit of leniency, arguing in part that Hammond had been entrapped by the former LulzSec leader Sabu, who'd become an FBI informant six months before Hammond hacked Stratfor, and who was being monitored around the clock by handlers at the bureau. 
At the sentencing hearing, Hammond read a statement saying that Sabu had provided him with passwords and root access information for 2,000 different websites. 'These intrusions, all of which were suggested by Sabu while cooperating with the FBI, affected thousands of domain names and consisted largely of foreign government websites, including those of Turkey, Iran...' Hammond said, before being cut off by the judge, who told him that the list of target names was to be redacted. 
Preska sentenced Hammond to 10 years in prison, to be followed by three years of supervised release.
(Source: Jim Newberry, FreeHammond.com)

Anonymous-allied Jeremy Hammond hacked into the private intelligence contractor Strategic Forecasting (known as Stratfor) in late 2011 and then posted the stolen files to a server that now appears to have been owned by the FBI. He also distributed the stolen information to WikiLeaks, which published it as part of its Global Intelligence Files program.

Hammond was indicted in 2012. In May 2013, he pleaded guilty to one count of conspiracy to engage in computer hacking. He admitted to masterminding the Stratfor hack, compromising account information for approximately 860,000 Stratfor users, and publishing stolen data pertaining to 60,000 credit cards. Anonymous later used the cards to make $700,000 in unauthorized donations to nonprofit groups. In addition, Hammond admitted to hacking numerous other organizations, ranging from the FBI's Virtual Academy and the Arizona Department of Public Safety to the Jefferson County Sheriff's Office in Alabama and the Boston Police Patrolmen's Association. Thanks to the hacking count, Hammond faced up to 10 years in prison and up to $2.5 million in restitution.

After Hammond pleaded guilty, but before Judge Loretta Preska sentenced him in November, Hammond's supporters launched a letter-writing campaign in pursuit of leniency, arguing in part that Hammond had been entrapped by the former LulzSec leader Sabu, who'd become an FBI informant six months before Hammond hacked Stratfor, and who was being monitored around the clock by handlers at the bureau.

At the sentencing hearing, Hammond read a statement saying that Sabu had provided him with passwords and root access information for 2,000 different websites. "These intrusions, all of which were suggested by Sabu while cooperating with the FBI, affected thousands of domain names and consisted largely of foreign government websites, including those of Turkey, Iran..." Hammond said, before being cut off by the judge, who told him that the list of target names was to be redacted.

Preska sentenced Hammond to 10 years in prison, to be followed by three years of supervised release.

3 of 10
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
SaneIT
50%
50%
SaneIT,
User Rank: Apprentice
1/6/2014 | 7:40:57 AM
Re: Have to agree
I really thought this would be addressed when we the country got a CIO... Then we had the summer of Anonymous attacking sites and we never really got a main stream explanation of what was going on or why.  I think part of it is just a lack or understanding by the media and the attitude toward attacks on web sites is that it's just childish pranks.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/3/2014 | 7:52:40 AM
Re: Have to agree
That's a great question. There's really no shortage of public news and information for anyone who wants to learn more and stay on top of the situation. It's the age-old dilemna of how to raise security awareness. You would think our leaders would take it upon themselves to have at least a basic understanding of digital security issues. Yet even security professionals struggle with the issue. Ira Winkler wrote a great piece about it recently: Why Security Awareness is Like an Umbrella. 
SaneIT
50%
50%
SaneIT,
User Rank: Apprentice
1/3/2014 | 7:14:28 AM
Re: Have to agree
I guess the question then would be how do we raise awareness without overblowing the situation.  We don't want to make them all out to be public enemy number one but we do need to draw enough attention that people are aware of what is possible, what is happening and hopefully educate themselves on how to avoid it.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/2/2014 | 10:33:17 AM
Re: Have to agree
I tend to agree with you @jg, that outside the security community, the general public is unaware of most of the notorious hackers and why they are important. What's worse, I don't have a lot of confidence that our public leaders (elected and appointed) truly get what they need to know to develop policies that protect us.
SaneIT
50%
50%
SaneIT,
User Rank: Apprentice
12/30/2013 | 8:32:36 AM
Re: Have to agree
I don't think the NSA are doing themselves any favors but I also wonder how many people would recognize any of the other individuals listed.  We all know about Snowden because he's been a daily news story but what about Sabu? Aside from those that were burned when the started working with the government to turn in other hackers and IT folks who follow things like this does anyone know who he is or why he was news worthy?
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
12/30/2013 | 6:00:03 AM
Have to agree
Have to agree with the NSA being at the #1 spot. The revelation of its involvement in worldwide sureillance was the biggest rug pulling on internet privacy that's ever come to light. 
virsingh211
50%
50%
virsingh211,
User Rank: Apprentice
12/30/2013 | 3:36:03 AM
Re: 10
I would like thank author for including Edward Snowden in blog, Snowden was one to change my thinking towards hacker, he revealed the spying that is taking place. Many consider him a villain. I, on the other hand, hold him up in the hero category for one simple reason, His disclosure of classified documents unveiled the NSA's mass surveillance program. I was reading an article on WSJ which says Snowden Will Speak More in 2014, source: http://blogs.wsj.com/washwire/2013/12/29/snowden-will-speak-more-in-2014-adviser-says/.

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/28/2013 | 11:36:06 PM
10
A suggestion for the tenth: Those behind the Target hack on customer credit card numbers.  We're still somewhat in the dark about that.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25273
PUBLISHED: 2021-07-29
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVE-2021-36741
PUBLISHED: 2021-07-29
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the ...
CVE-2021-36742
PUBLISHED: 2021-07-29
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privile...
CVE-2021-23418
PUBLISHED: 2021-07-29
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CVE-2020-5329
PUBLISHED: 2021-07-29
Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.