Another Defense Contractor Hacked in AntiSec Hacktivism Spree

Published: 2011-07-11
Last Updated: 2011-07-11 21:49:24 UTC
by John Bambenek (Version: 1)
13 comment(s)

A torrent just popped up on the Pirate Bay a few hours ago that leaks 90,000 emails and unsalted MD5 hashes as well as other reportedly damanging information about Booz Allen Hamilton, a contractor to the US government.  Several news sites already have the story, or at least what we know of it.  The hashes themselves are relatively easy to crack using commodity cracking tools, but likely that isn't the real damage here.  Anonymous has claimed credit for the hack.

At this point, the means by which BAH was breached is unknown and likely pure speculation.  That said, it is no longer secure to hash your passwords with MD5, much less when it is unsalted.  Take a look at using a SHA-2 variant, if possible.  Also, require strong and long passwords while minimizing password re-use to avoid compromised credentials being used to dig deeper into an organization.  As more facts are known, this port will be updated.

--
John Bambenek
bambenek at gmail /dot/ com
Bambenek Consulting

13 comment(s)

Comments

how much forensics do they have on the issue...
were there any forensics measures taken?
There is little doubt that this will turn into a federal case. Booz-Allen is one of the heavy hitters in the field of US defense contracting. Whether or not the forensics teams will find anything is something of a crapshoot, and not just due to any countermeasures that AntiSec may or may not have taken.
This is a serious blow to defense contractors. With the fall of Lockheed Martin, L3, etc. it has the potential to cast a doubtful light on the current providers on “security” to the US government. I realize that judgment should also consider how these companies handle/respond to the breach but given that government entities as well as private companies look to these organizations as “experts” may leave most folks scratching their heads wondering what exactly are they getting for their dollar.
I'd have to agree with JimS, and in many cases these 'so called security specialists' armed with top secret clearance just look foolish when incidents like this occur. What do other companies think when BAH and IRC Federal (which is still offline, internet wise) get compromised via security holes that should have been closed a LONG time ago?

I suspect that companies like this are ripping off the US taxpayer for millions/billions of dollars annually.
On a completely separate note, Laura Callahan, the former senior director at the United States Department of Homeland Security who resigned after an investigation revealed that she had obtained academic degrees from a diploma mill back in 2004. Well, she's back working for the federal government as a GS-14 employee at the United States Cyber Command.

Ms. Callahan was also a former CIO at the Department of Labor, and was also involved in the White House e-mail subpoena scandal known as Project-X.
These guys write the IRS FTI audit guidelines.
Given that a recently conducted audit of the IRS shows that at least 2200 of it's computer systems and networks have serious security vulnerabilities, this should not make anyone feel confident at all regarding the ability of BAH or IRC Federal.
Let's not be too quick to condemn. We don't have enough information about how the system was hacked. There could have been an inside assist or a zero-day exploit. I've been in the business long enough to know that this kind of thing can happen to anyone. Let's find out what happened before passing judgement. As for farploop's comment, all audits show vulnerabilities, esp. for servers designed to serve the public. A server can be vulnerable in an audit but be almost completely safe (no machine is completely safe unless it is powered off and melted) due to peripheral defenses and other defense strategies. You can't just look at the numbers, they mean nothing. You have to look at the whole security strategy. No, I don't work for BAH or IRS and I'm not defending them. I just think everyone's being a bit hasty.
I have been in the commercial side of the business for years now, but 'bump into' Government types all the time. I'll stick with the 'for profit, I can get fired if this is not right' types any day of the week.
> this kind of thing can happen to anyone. Let's find out what happened before passing judgement.

That's exactly the thinking that causes the problem.

The issue is not that they were hacked.

Diary Archives