Department of Homeland Security Issues Warning about Potential Cyber-attacks and Civil Protests from Hacking Group “Anonymous”
Cyber-hacking groups have gotten the attention of the Department of Homeland Security, which recently issued a warning about potential cyber-attacks and civil protests from the hacking group known as “Anonymous.”
The bulletin from the DHS National Cyber-Security and Communications Integration Center warned financial services companies to be aware of attackers operating under the Anonymous agenda to “solicit ideologically dissatisfied, sympathetic employees” to the cause.
The group recently went on Twitter to persuade employees within the financial sector to hand over information and access to enterprise networks. Though it seems such attempts may not have been unsuccessful, the DHS bulletin warned, “unwilling coercion through embarrassment or blackmail may be a risk to personnel.”
The first attack, titled “Occupy Wall Street,” is scheduled for September 17 and hopes to get 20,000 individuals to gather on Wall Street to protest various U.S. government policies.
The call for protest, issued through an Anonymous video on YouTube, asked followers to “flood into lower Manhattan, set up tents, kitchens, peaceful barricades and occupy Wall Street for a few months.” Similar rallies targeting other financial districts are planned for Madrid, Milan, London, Paris and San Francisco.
The DHS warning cited another protest may be planned for October on the National Mall in Washington to mark the 10th anniversary of the American invasion of Afghanistan. That protest, DHS said, may be followed by Operation Facebook on November 11 in protest of the social media company’s alleged privacy violations, and by Project Mayhem, which could bring physical disruptions and cyber-attacks, scheduled for December 21, 2012.
The unclassified DHS document was addressed mainly to those in charge of cyber security and critical infrastructure protection and warns that Anonymous brags to use new tools in launching future cyber-attacks. One piece of software that has caught the attention of the information security community is called #RefRef, which is said to be capable of using a server’s resources and processing power to conduct a denial of service attack against itself, paralyzing the network.
securityorb.com/ advises those who are in charge of cyber security and critical infrastructure protection to verify the integrity of their organization’s security controls and to increase logging capabilities with an emphasis on analytic analysis.
Conducting security awareness training to inform users of the situation, of their responsibilities and of the appropriate use of company equipment is also helpful.