Anonymous Hackers Play Tricky 21st-Century Robin Hood
A holiday-themed attack into on the Stratfor Global Intelligence service has left various charities with as much as $1 million in unauthorized donations, all thanks to the warm-hearted hackers at Antisec. The Austin-based private intelligence firm more widely known as STRATFOR admitted to a breach in a Sunday evening Facebook post bearing a worrisome warning: "We have reason to believe that your personal and credit card data could have been included in the information that was illegally obtained and disclosed." Apparently, Antisec cracked into one of STRATFOR's customer database at the e-commerce service Ubercart last week and stole about 200 gigabytes worth of data, including an estimated 30,000 credit card numbers which they then used to make small donations to a number of international charities around Christmastime. Among the charities was the Red Cross which, according to The New York Times, received at least one $200 donation from a retired Texas banker. On Tuesday, we spoke the Red Cross, and it couldn't say what's happened to that money. "Right now we're looking into the issue and telling anyone that believes an unauthorized donation has been made to contact their credit company," a Red Cross spokesperson told The Atlantic Wire.
RELATED: LulzSec Document Release Targets Arizona Law Enforcement
The good news for hacker fans is that this latest attack appears to mark a comeback of sorts for the LulzSec-Anonymous spinoff group, AntiSec. First announced back in June, AntiSec serves both as the Internet's Robin Hood and as its equivalent of the Sheriff of Nottingham. The Robin Hood part is well illustrated by the transfer of wealth from STRATFOR's customers to charities like the Red Cross, but the Sheriff part is more nuanced. Rather than simply stealing a bunch of money -- it's unclear if AntiSec kept anything for themselves or simply moved it from STRATFOR's customers' bank accounts to the various charities -- AntiSec is also committed to holding the company accountable for the intelligence analysis services it provides to folks at the United States military. Wired's Quinn Norton describes the spoils of AntiSec's war on STRATFOR so far:
Antisec breached Stratfor’s networks several weeks ago, according to sources within the group that attacked the firm. On Saturday, Antisec began posting credit card details of a few Stratfor customers on Internet Relay Chats. But that’s just the start of a much larger data dump, the group claims. Anonymous is planning to release much more information — up to 200 gigabytes worth, in parts throughout the week leading up to New Year’s Eve. That trove allegedly includes 860,000 usernames, emails, and md5-hashed passwords; data from 75,000 credit cards, including security codes used for no card present transactions; and over 2.5 million Stratfor emails, internal Stratfor documents from the company’s intranet, and support tickets from it.stratfor.com. …
Usernames and emails are usually most useful in offering a way to access people's bank accounts or credit cards, but STRATFOR apparently stored those details on its database, too. Norton explains:
The first information to be released was a client list culled from Stratfor’s report subscribers, showing self reported employment data. Next was over 30,000 credit cards, accompanied by the announcement that they’d been used to ‘expropriate’ money from banks for charities via small dollar donations. Anonymous participants estimated they had donated between $500,000 and $1,000,000 to charities fraudulently.
RELATED: The Hacks That Mattered in the Year of the Hack
One of AntiSec's hackers told Norton, "Four servers were rooted and wiped … Charred like ashes, just like what we plan on doing with their old crumbling world." For now, STRATFOR's website appears to be down, marked only with a placeholder "currently undergoing maintenance" message. When we tried calling the company (several times) the closest thing we got to a response was a busy signal on the other end of the line. As we mentioned, The Red Cross is aware of the issue but passing the buck to the credit card companies when it comes to the reportedly unauthorized donations. We contacted Mastercard, a known enemy of Anonymous, to learn more about how its customers are responding to the attack, and a spokesperson promised to get back to us with more details. Obviously, many companies are short-staffed due to the holiday season, making a massive hacker crisis even more troublesome than usual. Even charities like The Red Cross are undoubtedly dealing with some unexpected headaches as a result of AntiSec's attack.
RELATED: Anonymous Retaliates Against Arrests With Massive Police Hack
Norton's source within AntiSec, for one, could care less if Mastercard or even The Red Cross is inconvenienced by the breach. "I understood that that was could be a procedural consequence," he said, "but the credit card corporations have a choice, to either bite it themselves (poor them, with all their billion dollar bailouts), punish the client, or worst of all, punish the charities that have had nothing to do with this."
RELATED: Anonymous Marks Bahrain Protest by Hacking U.S. Tear Gas Company
Note: It's unclear whether or not Oprah played a role in the attack -- we're pretty sure she didn't -- but AntiSec chose to use her face to illustrate its attack, when it took over STRATFOR's website as the above screenshot indicates. The full announcement for Anonymous's LulzXmas, courtesy of Quinn Norton:
RELATED: Anonymous's and LulzSec's Overlapping, FBI-Thwarting Pasts
