 |
| Image via Wikipedia |
By John Leyden • Get more from this author
The website of global intelligence-analysing firm Stratfor remains offline - a week after hacktivists broke into its poorly secured systems and extracted passwords and credit card details.
Members of Anonymous claimed to have broken into the website and slurped 200GB of sensitive information on Christmas Eve. The hackers claim to have made off with tens of thousands of credit card numbers, emails and other details relating to Stratfor's clients, including login credentials.
Hacktivists boasted that they planned to use the purloined credit card data to make donations to various charities, though whether or not this happened remains unclear.
Samples from the 200GB of lifted data have been leaked online. Subsequent analysis of the login credentials reveals that many were easily guessable passwords and therefore vulnerable to brute-force attacks.
Stratfor has pulled its website in the aftermath of the attack, which has been reported to the police. In place of the usual content the website has been replaced with a holding statement apologising for the cock-up:
As you may know, an unauthorized party illegally obtained and disclosed personally identifiable information and related credit card data of some of our subscribers.
We are currently investigating this unfortunate event and are working diligently to prevent it from ever happening again. As a result, we have delayed restoring our website until we can perform a thorough security review. Stay tuned for our relaunch.
In the meantime, our main concern is the impact on our customers. As a result, we have provided paid subscribers with identity protection coverage from CSID, a leading provider of global identity protection, at our expense for 12 months.
Security firms slammed Stratfor for making schoolboy errors, such as not encrypting its password database.
Commenting on the hack, Check Point's UK managing director Terry Greer-King said: "It’s not clear exactly how the hackers gained access to the servers, but once they’d breached the perimeter, sensitive business and personal data was unprotected. This made it easy to access and use for illicit purposes.
"It’s another clear lesson that this type of information needs to be encrypted, no matter how strong the organisation believes its perimeter security measures are. Encryption protects critical data against both accidental disclosure and hacking attempts."
Stratfor clients include the US military as well as banks and other corporations. Reuters reports that hackers have threatened to upload copied mail spools.
This has yet to happen. The exact motives of the attack are unclear, but the fact that Stratfor provides intelligence services for law enforcement, among others, made them target for anti-sec hacktivists, who delight in exposing the security failings of White Hat infosec firms and consultancies. ®
Read more:
http://www.theregister.co.uk/2012/01/03/stratfor_mega_hack/
