Feeds

Climate change hackers leave breadcrumb trail

Is anyone looking?

Intelligent flash storage arrays

The hackers who leaked more than 1,000 emails from one of the top climate research centers may have used an open proxy to cover their tracks, but that doesn't mean authorities can't figure out who they are.

Rob Graham, CEO of penetration testing firm Errata Security, said his analysis suggests that the hackers used three open proxies when they posted a 61 MB Zip file of email belonging to staff at the University of East Anglia's Climate Research Unit. CRU officials say they've brought in police to assist in their investigation into the leak of the internal documents without permission.

Open proxies have long been a favorite of people trying to hide their online identities. By funneling web requests through the third-party, websites see only the IP address of the proxy, rather than the IP address where the request is actually being made. This post by the hackers on ClimateAudit was made using an open proxy located in Russia, while another of their posts used a proxy located in Saudi Arabia.

CRU representatives have said the hackers used a Turkish IP address when breaching CRU security and posting the Zip file on its servers. One would presume its an open proxy as well.

But that doesn't mean the posts were anonymous. Graham tested the Russian proxy used by the hackers and has found it adds the originating IP address in HTTP request headers sent to websites being visited. Assuming ClimateAudit admins log the "X-Forwarded-For:" header, the hacker's identity may already be known.

Of course, the folks at ClimateAudit aren't on the best of terms with CRU, so it's not clear if they'd be willing to reveal the identity of someone who has brought so much scrutiny to one of their adversaries. So far, CRU representatives haven't said much about their investigation, but it's safe to assume the people poring over their web logs are looking for precisely the same type of data.

Graham's analysis is here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.