Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: Another Defense Contractor Hacked in AntiSec Hacktivism Spree - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Another Defense Contractor Hacked in AntiSec Hacktivism Spree

A torrent just popped up on the Pirate Bay a few hours ago that leaks 90,000 emails and unsalted MD5 hashes as well as other reportedly damanging information about Booz Allen Hamilton, a contractor to the US government.  Several news sites already have the story, or at least what we know of it.  The hashes themselves are relatively easy to crack using commodity cracking tools, but likely that isn't the real damage here.  Anonymous has claimed credit for the hack.

At this point, the means by which BAH was breached is unknown and likely pure speculation.  That said, it is no longer secure to hash your passwords with MD5, much less when it is unsalted.  Take a look at using a SHA-2 variant, if possible.  Also, require strong and long passwords while minimizing password re-use to avoid compromised credentials being used to dig deeper into an organization.  As more facts are known, this port will be updated.

--
John Bambenek
bambenek at gmail /dot/ com
Bambenek Consulting

John

245 Posts
ISC Handler
how much forensics do they have on the issue...
were there any forensics measures taken?
Anonymous
Posts
There is little doubt that this will turn into a federal case. Booz-Allen is one of the heavy hitters in the field of US defense contracting. Whether or not the forensics teams will find anything is something of a crapshoot, and not just due to any countermeasures that AntiSec may or may not have taken.
No Love.

37 Posts Posts
This is a serious blow to defense contractors. With the fall of Lockheed Martin, L3, etc. it has the potential to cast a doubtful light on the current providers on “security” to the US government. I realize that judgment should also consider how these companies handle/respond to the breach but given that government entities as well as private companies look to these organizations as “experts” may leave most folks scratching their heads wondering what exactly are they getting for their dollar.
Anonymous
Posts
I'd have to agree with JimS, and in many cases these 'so called security specialists' armed with top secret clearance just look foolish when incidents like this occur. What do other companies think when BAH and IRC Federal (which is still offline, internet wise) get compromised via security holes that should have been closed a LONG time ago?

I suspect that companies like this are ripping off the US taxpayer for millions/billions of dollars annually.
Anonymous
Posts
On a completely separate note, Laura Callahan, the former senior director at the United States Department of Homeland Security who resigned after an investigation revealed that she had obtained academic degrees from a diploma mill back in 2004. Well, she's back working for the federal government as a GS-14 employee at the United States Cyber Command.

Ms. Callahan was also a former CIO at the Department of Labor, and was also involved in the White House e-mail subpoena scandal known as Project-X.
Anonymous
Posts
These guys write the IRS FTI audit guidelines.
Anonymous
Posts
Given that a recently conducted audit of the IRS shows that at least 2200 of it's computer systems and networks have serious security vulnerabilities, this should not make anyone feel confident at all regarding the ability of BAH or IRC Federal.
Anonymous
Posts
Let's not be too quick to condemn. We don't have enough information about how the system was hacked. There could have been an inside assist or a zero-day exploit. I've been in the business long enough to know that this kind of thing can happen to anyone. Let's find out what happened before passing judgement. As for farploop's comment, all audits show vulnerabilities, esp. for servers designed to serve the public. A server can be vulnerable in an audit but be almost completely safe (no machine is completely safe unless it is powered off and melted) due to peripheral defenses and other defense strategies. You can't just look at the numbers, they mean nothing. You have to look at the whole security strategy. No, I don't work for BAH or IRS and I'm not defending them. I just think everyone's being a bit hasty.
Anonymous
Posts
I have been in the commercial side of the business for years now, but 'bump into' Government types all the time. I'll stick with the 'for profit, I can get fired if this is not right' types any day of the week.
Charles

2 Posts Posts
> this kind of thing can happen to anyone. Let's find out what happened before passing judgement.

That's exactly the thinking that causes the problem.

The issue is not that they were hacked.
Steven

42 Posts Posts
Whether or not you agree with their motives/methodology, LulzSec/AntiSec are surely making the big players (both Govt and private) sit up and take a long hard look at their security, which has to be a good thing for the protection of the consumer. The bad thing is the collateral damage when these groups release screeds of personal data - apparently the only currently effective way to draw some attention to the issue.
Anonymous
Posts
The IRC Federal hack happened due to a SQL injection + phpBB issue (which is a well-known) issue. Any decent penetration scanner (nessus, nikto, etc) could have detected the issue and alerted staff to correct the vulnerabilities. The credentials which were hijacked were administrator level, and from that point on, it was a free for all.
Anonymous
Posts
re: Laura Callahan,

Glad to see she found her soft landing after the tragic loss of her $175K a year job. Maybe everyone's inferiority complex vis-a-vis "those guys up there" will be ameliorated now that it is known they are hiring scumbag charlatans like her.

The fact that she was too lazy to even chug her way through UoP or Strayer on the government's dime is a little disturbing. Sociopaths always seem to do well in hierarchical bureaucracies though...

She even has her own Wiki page:
http://en.wikipedia.org/wiki/Laura_Callahan
Anonymous
Posts

Sign Up for Free or Log In to start participating in the conversation!