Feeds

Stratfor slaps website back online after Anon mega-hack

CEO: Hacktivists can't silence us - and soz about the credit cards

Choosing a cloud hosting partner with confidence

Stratfor has restored its website to normal operation on Wednesday, more than two weeks after a hack attack by Anonymous that made the global intelligence analyst firm a byword for information insecurity.

Members of Anonymous made off with stolen emails and credit-card data after breaking into Stratfor's chronically insecure website in early December, much earlier than previously acknowledged. The website, torched during the attack, was restored on Wednesday to normal operation, along with an apology of sorts from its chief exec for its poor pre-hack security.

Chief among Stratfor's mistakes was the failure to encrypt the credit card files that hacktivists stole and later dumped online. George Friedman, chief exec of Stratfor, blamed the rapid growth of the firm for this school boy error, which it has belatedly rectified.

The FBI made it clear that it expected the theft to be exposed by the hackers. We were under no illusion that this was going to be kept secret. We knew our reputation would be damaged by the revelation, all the more so because we had not encrypted the credit card files.

This was a failure on our part. As the founder and CEO of Stratfor, I take responsibility for this failure, which has created hardship for customers and friends, and I deeply regret that it took place. The failure originated in the rapid growth of the company. As it grew, the management team and administrative processes didn't grow with it.

The trickster hacktivists who hit Strafor not only stole its data but defaced its website and thrashed its systems, as Friedman explains.

With the credit card information stolen, I assumed that the worst was done. I was wrong.

Early in the afternoon of Dec 24, I was informed that our website had been hacked again. The hackers published a triumphant note on our homepage saying that credit card information had been stolen, that a large amount of email had been taken, and that four of our servers had been effectively destroyed along with data and backups. We had expected they would announce the credit card theft. We were dismayed that emails had been taken. But our shock was at the destruction of our servers. This attack was clearly designed to silence us by destroying our records and the website, unlike most attacks by such groups.

Strafor specialises in geopolitical analysis, but judging from Friedman's post it remains pretty much in the dark about the motives of the hackers who hit it with such force, beyond suggesting that they supposedly perceived Stratfor as the intelligence hub in a non-existent global conspiracy. Friedman suggests Anonymous was trying to silence it, defiantly boasting that these efforts have failed.

The attempt to silence us failed. Our website is back, though we are waiting for all archives to be restored, and our email is working again. Our failures have been reviewed and are being rectified. We deliberately shut down while we brought in outside consultants to rebuild our system from the ground up.

A video statement from Friedman can be found here.

Anonymous boasted of stealing Stratfor’s confidential client list as well as email spools and more than 4,000 credit card details after extracting 20GB of data from Stratfor's systems. One member boasted of plans to use the stolen credit card data to make donations to charities including the Red Cross. Such transactions are highly likely to be identified and reversed, potentially leaving charities worse off in the process (as a result of charge-back fees) but more likely just achieving a huge inconvenience all round.

Hacktivists threatened to release stolen emails but nothing much has come of this threat so far. Strafor provides intelligence services for law enforcement agencies, among others, making them target for anti-sec hacktivists, who enjoy exposing the security failings of infosec consultancies and FBI affiliates.

Various comments from the semi-official AnonymousIRC account gently mocked Stratfor's statement and Wednesday and mocked the supposed ability of the firm to keep its website available. "What's that? stratfor.com - Not able to keep up your site for just a few hours!?" Later the hacktivists added: "To avoid misinterpretations: we're NOT dosing #Stratfor. We just interpreted their statement. :)" ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.