Feeds

Climate change hackers leave breadcrumb trail

Is anyone looking?

Internet Security Threat Report 2014

The hackers who leaked more than 1,000 emails from one of the top climate research centers may have used an open proxy to cover their tracks, but that doesn't mean authorities can't figure out who they are.

Rob Graham, CEO of penetration testing firm Errata Security, said his analysis suggests that the hackers used three open proxies when they posted a 61 MB Zip file of email belonging to staff at the University of East Anglia's Climate Research Unit. CRU officials say they've brought in police to assist in their investigation into the leak of the internal documents without permission.

Open proxies have long been a favorite of people trying to hide their online identities. By funneling web requests through the third-party, websites see only the IP address of the proxy, rather than the IP address where the request is actually being made. This post by the hackers on ClimateAudit was made using an open proxy located in Russia, while another of their posts used a proxy located in Saudi Arabia.

CRU representatives have said the hackers used a Turkish IP address when breaching CRU security and posting the Zip file on its servers. One would presume its an open proxy as well.

But that doesn't mean the posts were anonymous. Graham tested the Russian proxy used by the hackers and has found it adds the originating IP address in HTTP request headers sent to websites being visited. Assuming ClimateAudit admins log the "X-Forwarded-For:" header, the hacker's identity may already be known.

Of course, the folks at ClimateAudit aren't on the best of terms with CRU, so it's not clear if they'd be willing to reveal the identity of someone who has brought so much scrutiny to one of their adversaries. So far, CRU representatives haven't said much about their investigation, but it's safe to assume the people poring over their web logs are looking for precisely the same type of data.

Graham's analysis is here. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.