Anonymous Just Leaked a Trove of NSA Documents

http://gizmodo.com/anonymous-just-leaked-a-trove-of-nsa-documents-511854773

In the wake of last night’s revelation that everyone in the world has a creepy NSA-shaped stalker, defenders of online liberty and generally angry internet people Anonymous have leaked a treasure trove of NSA documents, including seriously important stuff like the US Department of Defense’s ‘Strategic Vision’ for controlling the internet.

The documents — 13 in total — were posted online, along with an accompanying message full of the normal Anonymous bluster: people won’t be silenced, they have the memory of trivia-master elephants, the governments of the world will fall, your average press release really.

The documents seem to mostly relate to PRISM and supporting operations, and mostly date from around 2008, supposedly not long after PRISM first reared its ugly head. One of the key things Anonymous has highlighted from the documents is the existence of an “intelligence-sharing network” that shares data gleaned from PRISM with “intelligence partners” around the world. Although we’re still in the process of combing through the documents, you can bet your last Bitcoin that ‘intelligence’ has been shared with British security services.

Hit up the documents for further details; just be warned that although this might look like the plot of a B-list movie starring Aston Kutcher, the docs themselves are incredibly dry and full of more acronyms than whatever presentation you should be working on. [Pastebin]

Update: As several have pointed out below, the papers Anonymous "leaked" were already publicly available. It's since been reported that the US does, in fact, share PRISM information with UK intelligence officials.

Image by Getty 

For more information on what PRISM is and what it means to you, head here.

Federal Reserve data hacked by Anonymous

Federal Reserve building.(AFP Photo / Saul Loeb)

Days after the personal information of over 4,000 banking executives was leaked to the Web by a group affiliated with the hacktivist movement Anonymous, the Federal Reserve admits to having suffered an online security breach.

Spokespeople for the Fed alerted customers on Tuesday that private information stored online was compromised during a weekend hack, all but confirming the source for a trove of data published two days earlier by the loose-knit Anonymous collective.

"The Federal Reserve system is aware that information was obtained by exploiting a temporary vulnerability in a website vendor product," a spokeswoman for the bank tells Reuters.

Currently, the Fed maintains that the incident was mild in nature, “did not affect critical operations” of the bank and has been resolved. An admission from the Fed does suggest, however, that hackers are capable of compromising data that is presumably well protected.

During Sunday’s Super Bowl, the Twitter account @OpLastResort announced that personal info pertaining to thousands of banking executives had been obtained, and a tweet directing followers to a hacked Alabama Criminal Justice Information Center website linked to the data. Now the Fed says that an emergency notification system was indeed breached, thus compromising private but not necessarily secret user names, phone numbers and other credentials stored on the server.

The exploit, admits the Fed, allowed for the release of user contact data stored within its Emergency Communications System, or ECS, “a system used by the Federal Reserve and state banking departments to notify depository institutions of operational status in the event of natural or other disasters.”

“Information obtained from the registrants consisted of mailing address, business phone, mobile phone, business email and fax. Some registrants also included optional information consisting of home phone and personal email. Despite claims to the contrary, passwords were not compromised, but nonetheless, have been reset as a precautionary measure,” continues a spokesperson for the St. Louis Fed in a statement first obtained by ZDNet.

A source speaking to ZDNet on condition of anonymity adds, "The banks on the list were not compromised." On the website Reddit, however, one user claims to have called some of the phone numbers published on the Alabama CJIC site and adds some insight into the severity of the breach.
“What must be so problematic for the Federal Reserve is not the information so much as this file was stolen from their computers at all. The ramifications of that kind of loss of control is severe,” Reddit user PericlesMortimer writes.

OpLastResort is an Anonymous faction of sorts that was spawned after last month’s untimely death of Reddit co-founder and computer whiz Aaron Swartz, who committed suicide at age 26 while awaiting trial. The US government was charging Swartz with violating the Computed Fraud and Abuse Act because he allegedly accessed millions of academic and scholarly articles from the website JSTOR without explicit authorization. Swartz was facing decades in prison if convicted, but OpLastResort and similar campaigns have strived in recent weeks to make progress in reforming the CFAA.

Source: https://rt.com/usa/news/federal-reserve-anonymous-oplastresort-585/

Anonymous posts over 4000 U.S. bank executive credentials

Summary: Anonymous appears to have published login and private information from over 4000 American bank executive credentials its Operation Last Resort, demanding US computer crime law reform.

By Violet Blue for Zero Day | February 4, 2013 -- 07:28 GMT (23:28 PST)

Following attacks on U.S. government websites last weekend, Anonymous seems to have made a new "Operation Last Resort" .gov website strike Sunday night.

Anonymous appears to have published login and private information from over 4,000 American bank executive accounts in the name of its new Operation Last Resort campaign, demanding U.S. computer crime law reform.

A spreadsheet has been published on a .gov website allegedly containing login information and credentials, IP addresses, and contact information of American bank executives.

If true, it could be that Anonymous has released banker information that could be connected to Federal Reserve computers, including contact information and cell phone numbers for U.S. bank Presidents, Vice Presidents, COO's Branch Managers, VP's and more.

The website used in this attack belongs to the Alabama Criminal Justice Information Center (ACJIC). The page extension URL is titled, "oops-we-did-it-again."

The spreadsheet document contains usernames, names of individuals and their titles at banks across the U.S., hashed passwords (not passwords in plain text). It was placed on a .gov website and on Pastebin, and publicized via various Anonymous accounts on Twitter and Facebook.

A Reddit member called the numbers and commented,

OK, I called a few of them. What must be so problematic for the Federal Reserve is not the information so much as this file was stolen from their computers at all.

The ramifications of that kind of loss of control is severe.

Banks listed on the document claim credentials from management at community banks, community credit unions, and more, across the United States.


A visit to the bank websites on the document shows that these are current employees at each of the banks.

Anonymous stated in its first Operation Last Resort defacement last friday (ussc.gov) it had infiltrated multiple federal websites over a period of time. The hacktivist entity dropped enough technical details to make it clear that its tracks were covered and that Anonymous still had access to .gov websites.

Significance of Monday, February 4?

While today in the United States it is the day of a major American sporting event (the Superbowl), this Sunday night's timing of Anon's document release coincides with another event more important to the new Anonymous campaign Operation Last Resort - a campaign anchored on the Swartz tragedy.

After the Anonymous OpLastResort hacks last weekend, last Monday a House panel issued a letter to Attorney General Eric Holder (.pdf link) with seven specific questions, and demanding answers regarding the Swartz prosecution.

Tomorrow, Monday February 4, is the deadline for Attorney General Eric Holder to answer specific questions regarding the Aaron Swartz prosecution.

Anonymous may be focusing on that deadline, as well.

Previously on the defaced ussc.gov website Anonymous cited the recent suicide of hacktivist Aaron Swartz as a "line that has been crossed."

The statement suggested retaliation for Swartz's tragic suicide, which many - including the family - believe was a result of overzealous prosecution by the Department of Justice and what the family deemed a "bullying" use of outdated computer crime laws.

With the letter to Holder, the House Oversight and Government Reform Committee requests a briefing with the Justice Department. CNET writes,

"Many questions have been raised about the appropriate level of punishment sought by prosecutors for Mr. Swartz's alleged offenses, and how the Computer Fraud and Abuse Act, cited in 11 of 13 counts against Mr. Swartz, should apply under similar circumstances," [Reps. Issa and Cummings] say in the letter, which requests a briefing no later than February 4.

The letter is another voice from the Federal side of the discussion, joining a chorus led by Democratic congresswoman Rep. Zoe Lofgren who has authored a bill called "Aaron's Law" that aims to change the 1984 Computer Fraud and Abuse Act (with which Swartz was being prosecuted).

Last friday February 1, Lofgren submitted a draft of the bill to be reviewed on Reddit. Ars Technica reported that after its online critique, a revised version of the bill was published today, with more far-reaching reforms.

• Read more: Feds stumbling after Anonymous launches 'Operation Last Resort'
  

Last weekend Anonymous commandeered the US Sentencing website to launch Operation Last Resort "warheads" (encrypted files suggested by Anonymous to be sensitive US government documents).

The defacement demanded reform on US computer crime laws, citing the January 11 tragic suicide of young hacker and digital rights activist Aaron Swartz.

• See also: Anonymous hacks US Sentencing Commission, distributes files
• Tragedy cited as cause behind the attacks: Hacker, Activist Aaron Swartz Commits Suicide

Anonymous spent last weekend playing cat-and-mouse with the Department of Justice after taking over the ussc.gov website (still decimated and now "under construction" over a week later).

After the US government regained control of the .gov website used in the hacks and defacements, Anonymous regained control of two .gov sites and turned the sites into a mocking video game of Asteroids.

Public interest in Sunday's Asteroids game created a crowdsourced DDoS, downing the websites for days.

It is possible that banks and user information on tonight's new "oops we did it again" document may be connected to accounts at The Fed (The Federal Reserve Bank).

The Fed has a collection of services called Fedline, which operates at highly critical junctures across the U.S. banking system.

For instance, one of the services offered by Fedline is money and funding transfers via the U.S. Federal Reserve.

It enables financial institutions to transfer funds between member participants. These participants are estimated to be around more than 9,000 financial entities (such as banks).

Fedline is the primary U.S. network for high value, time-critical and international payments.

In 2007 the estimated average daily value of funds transferred via Fedline products was 2.7 trillion (an estimated 537,000 payments daily, the average was over $5 million per transaction).

At this point, the information on the document is unverified and exactly what banking systems the information may affect is not known. ZDNet will update this article with new information as it becomes known.

The Operation Last Resort video, posted Friday on the U.S. Sentencing Commission website now has 1,183,000 views. 

It is interesting to note that this second "official" #OpLastResort salvo does not cite AntiSec, as seen in the Asteroids game.

Anonymous appears intent to influence federal action - one way or another.

Anonymous Hacks Department of Justice Website, Threatens to Launch ‘Multiple Warheads’

The website belonging to the United States Sentencing Commission is down this morning, following a hack by Anonymous overnight. The site, which normally bears information about sentencing guidelines for federal crimes, instead showed a nearly 10 minute long YouTube video and the same message typed below it.

The hacktivist collective claims its takedown of the site belonging to the U.S. Department of Justice is in response to the suicide of Reddit programmer Aaron Swartz. At the time of his death, Swartz faced up to 35 years in prison on federal computer fraud charges. According to Anonymous, Swartz was "killed" and a "line was crossed":

Two weeks ago today, a line was crossed. Two weeks ago today, Aaron Swartz was killed. Killed because he faced an impossible choice. Killed because he was forced into playing a game he could not win — a twisted and distorted perversion of justice — a game where the only winning move was not to play.
Anonymous immediately convened an emergency council to discuss our response to this tragedy. After much heavy-hearted discussion, the decision was upheld to engage the United States Department of Justice and its associated executive branches in a game of a similar nature, a game in which the only winning move is not to play.

The "game" involves releasing a file ("warhead") containing sensitive information about the Justice Department. What that information is, Anonymous isn't saying.

The contents are various and we won't ruin the speculation by revealing them. Suffice it to say, everyone has secrets, and some things are not meant to be public. At a regular interval commencing today, we will choose one media outlet and supply them with heavily redacted partial contents of the file. Any media outlets wishing to be eligible for this program must include within their reporting a means of secure communications.

The hacked site also contained links to "warheads" named after each of the Supreme Court justices, each links to a website containing a 503 service unavailable error message, meaning the server is for some reason unavailable.

If you're interested, here's the full text of Anonymous' message:

Citizens of the world,
Anonymous has observed for some time now the trajectory of justice in the United States with growing concern. We have marked the departure of this system from the noble ideals in which it was born and enshrined. We have seen the erosion of due process, the dilution of constitutional rights, the usurpation of the rightful authority of courts by the "discretion" of prosecutors. We have seen how the law is wielded less and less to uphold justice, and more and more to exercise control, authority and power in the interests of oppression or personal gain.

We have been watching, and waiting.

Two weeks ago today, a line was crossed. Two weeks ago today, Aaron Swartz was killed. Killed because he faced an impossible choice. Killed because he was forced into playing a game he could not win — a twisted and distorted perversion of justice — a game where the only winning move was not to play.

Anonymous immediately convened an emergency council to discuss our response to this tragedy. After much heavy-hearted discussion, the decision was upheld to engage the United States Department of Justice and its associated executive branches in a game of a similar nature, a game in which the only winning move is not to play.

Last year the Federal Bureau of Investigation revelled in porcine glee at its successful infiltration of certain elements of Anonymous. This infiltration was achieved through the use of the *same tactics which lead to Aaron Swartz' death. It would not have been possible were it not for the power of federal prosecutors to thoroughly destroy the lives of any hacktivists they apprehend through the very real threat of highly disproportionate sentencing.

As a result of the FBI's infiltration and entrapment tactics, several more of our brethren now face similar disproportionate persecution, the balance of their lives hanging on the severely skewed scales of a broken justice system.

We have felt within our hearts a burning rage in reaction to these events, but we have not allowed ourselves to be drawn into a foolish and premature response. We have bidden our time, operating in the shadows, adapting our tactics and honing our abilities. We have allowed the FBI and its masters in government — both the puppet and the shadow government that controls it — to believe they had struck a crippling blow to our infrastructure, that they had demoralized us, paralyzed us with paranoia and fear. We have held our tongue and waited.

With Aaron's death we can wait no longer. The time has come to show the United States Department of Justice and its affiliates the true meaning of infiltration. The time has come to give this system a taste of its own medicine. The time has come for them to feel the helplessness and fear that comes with being forced into a game where the odds are stacked against them.

This website was chosen due to the symbolic nature of its purpose — the federal sentencing guidelines which enable prosecutors to cheat citizens of their constitutionally-guaranteed right to a fair trial, by a jury of their peers — the federal sentencing guidelines which are in clear violation of the 8th amendment protection against cruel and unusual punishments. This website was also chosen due to the nature of its visitors. It is far from the only government asset we control, and we have exercised such control for quite some time...

There has been a lot of fuss recently in the technological media regarding such operations as Red October, the widespread use of vulnerable browsers and the availability of zero-day exploits for these browsers and their plugins. None of this comes of course as any surprise to us, but it is perhaps good that those within the information security industry are making the extent of these threats more widely understood.
Still there is nothing quite as educational as a well-conducted demonstration...
Through this websites and various others that will remain unnamed, we have been conducting our own infiltration. We did not restrict ourselves like the FBI to one high-profile compromise. We are far more ambitious, and far more capable. Over the last two weeks we have wound down this operation, removed all traces of leakware from the compromised systems, and taken down the injection apparatus used to detect and exploit vulnerable machines.

We have enough fissile material for multiple warheads. Today we are launching the first of these. Operation Last Resort has begun...

Warhead - U S - D O J - L E A - 2013 . A E E 256 is primed and armed. It has been quietly distributed to numerous mirrors over the last few days and is available for download from this website now. We encourage all Anonymous to syndicate this file as widely as possible.

The contents are various and we won't ruin the speculation by revealing them. Suffice it to say, everyone has secrets, and some things are not meant to be public. At a regular interval commencing today, we will choose one media outlet and supply them with heavily redacted partial contents of the file. Any media outlets wishing to be eligible for this program must include within their reporting a means of secure communications.
We have not taken this action lightly, nor without consideration of the possible consequences. Should we be forced to reveal the trigger-key to this warhead, we understand that there will be collateral damage. We appreciate that many who work within the justice system believe in those principles that it has lost, corrupted, or abandoned, that they do not bear the full responsibility for the damages caused by their occupation.

It is our hope that this warhead need never be detonated.

However, in order for there to be a peaceful resolution to this crisis, certain things need to happen. There must be reform of outdated and poorly-envisioned legislation, written to be so broadly applied as to make a felony crime out of violation of terms of service, creating in effect vast swathes of crimes, and allowing for selective punishment. There must be reform of mandatory minimum sentencing. There must be a return to proportionality of punishment with respect to actual harm caused, and consideration of motive and mens rea. The inalienable right to a presumption of innocence and the recourse to trial and possibility of exoneration must be returned to its sacred status, and not gambled away by pre-trial bargaining in the face of overwhelming sentences, unaffordable justice and disfavourable odds. Laws must be upheld unselectively, and not used as a weapon of government to make examples of those it deems threatening to its power.

For good reason the statue of lady justice is blindfolded. No more should her innocence be besmirked, her scales tipped, nor her swordhand guided. Furthermore there must be a solemn commitment to freedom of the internet, this last great common space of humanity, and to the common ownership of information to further the common good.
We make this statement do not expect to be negotiated with; we do not desire to be negotiated with. We understand that due to the actions we take we exclude ourselves from the system within which solutions are found. There are others who serve that purpose, people far more respectable than us, people whose voices emerge from the light, and not the shadows. These voices are already making clear the reforms that have been necessary for some time, and are outright required now.

It is these people that the justice system, the government, and law enforcement must engage with. Their voices are already ringing strong with a chorus of determined resolution. We demand only that this chorus is not ignored. We demand the government does not make the mistake of hoping that time will dampen its ringing, that they can ride out this wave of determination, that business as usual can continue after a sufficient period of lip-service and back-patting.

Not this time. This time there will be change, or there will be chaos...

-Anonymous