Feeds

Stratfor so very, very sorry in wake of mega-hack

Private spook biz still reeling from credit card data raid

Beginner's guide to SSL certificates

The website of global intelligence-analysing firm Stratfor remains offline - a week after hacktivists broke into its poorly secured systems and extracted passwords and credit card details.

Members of Anonymous claimed to have broken into the website and slurped 200GB of sensitive information on Christmas Eve. The hackers claim to have made off with tens of thousands of credit card numbers, emails and other details relating to Stratfor's clients, including login credentials.

Hacktivists boasted that they planned to use the purloined credit card data to make donations to various charities, though whether or not this happened remains unclear.

Samples from the 200GB of lifted data have been leaked online. Subsequent analysis of the login credentials reveals that many were easily guessable passwords and therefore vulnerable to brute-force attacks.

Stratfor has pulled its website in the aftermath of the attack, which has been reported to the police. In place of the usual content the website has been replaced with a holding statement apologising for the cock-up:

As you may know, an unauthorized party illegally obtained and disclosed personally identifiable information and related credit card data of some of our subscribers.

We are currently investigating this unfortunate event and are working diligently to prevent it from ever happening again. As a result, we have delayed restoring our website until we can perform a thorough security review. Stay tuned for our relaunch.

In the meantime, our main concern is the impact on our customers. As a result, we have provided paid subscribers with identity protection coverage from CSID, a leading provider of global identity protection, at our expense for 12 months.

Security firms slammed Stratfor for making schoolboy errors, such as not encrypting its password database.

Commenting on the hack, Check Point's UK managing director Terry Greer-King said: "It’s not clear exactly how the hackers gained access to the servers, but once they’d breached the perimeter, sensitive business and personal data was unprotected. This made it easy to access and use for illicit purposes.

"It’s another clear lesson that this type of information needs to be encrypted, no matter how strong the organisation believes its perimeter security measures are. Encryption protects critical data against both accidental disclosure and hacking attempts."

Stratfor clients include the US military as well as banks and other corporations. Reuters reports that hackers have threatened to upload copied mail spools.

This has yet to happen. The exact motives of the attack are unclear, but the fact that Stratfor provides intelligence services for law enforcement, among others, made them target for anti-sec hacktivists, who delight in exposing the security failings of White Hat infosec firms and consultancies. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.