Why the Anonymous Fed Hack Matters
- Feb 06, 2013 2:17 PM EST
- [num] Comments
The hacker collective anonymous released the personal information for over 4,000 bank executives this past weekend as part of OpLastResort. But now that the information is freely available, the real danger might come from others using the information to construct further attacks.
OpLastResort is reportedly a protest of the Justice Department's handling of Aaron Schwartz's case. The group had already hijacked several state government websites in order to display tributes to Schwartz. A Twitter account associated with the group confirmed the disclosure.
We note that the Federal Reserve minidrop earlier was just a counter-distraction to the superbowl distraction. We await the DOJ's statement.— OpLastResort (@OpLastResort) February 4, 2013
This new attack reportedly culled the information from the Emergency Communication System of the St. Louis Federal Reserve, which is used to send messages to banking employees in the event of a natural or man-made disaster.
The Federal Reserve released a statement indicating that the situation was under control. "The Federal Reserve System is aware that information was obtained by exploiting a temporary vulnerability in a website vendor product," reads the statement. "The exposure was fixed shortly after discovery. It is no longer an issue. This incident did not affect critical operations of the Federal Reserve system."
The news is particularly disconcerting coming just days after the disclosure that the personal information of several hundred Department of Energy employees was stolen during a cyberattack. PC Magazine quoted the DOE as saying, "As individual affected employees are identified, they will be notified and offered assistance on steps they can take to protect themselves from potential identity theft."
While many of us assume that these headline grabbing attacks on major institutions were minor because they didn't make off with nuclear secrets from the DOE or access to billions of dollars from the Fed that might not be the case at all. The personal information lifted in these attacks could be used as part of longer, elaborate attacks carefully targeted at its victims.
Speaking to ZDNet's Violet Blue, Jon Waldman from Secure Banking Solutions commented on the leaked information from Anonymous. "Both the institutions and the individuals contained in this list WILL be specific targets of Social Engineering and hacking attacks," said Waldman. "Not only was business information (phone numbers and emails) included in this list, but personal information (cell numbers and email addresses) as well."
One only has to look at the recent Red October attacks to see the damage that a well-crafted, specific phishing attack can do over a long period of time.
For its part, the @OpLastResort account continues to mock the DOJ, promising that more attacks are coming. What happens with the information they've disclosed may prove far more damaging.
For more from Max, follow him on Twitter @wmaxeddy.