Hackers Hijack Cryptome and Delete Everything

Originally posted by insubordinate
It couldn't of hosted that much sensitive data... Especially enough to delete the entire site

On the contrary. Cryptome has presented lots of content that arguably could get under the government's skin. Photos of SIGINT facilities and many many other locations, persons and documents have probably put Cryptome squarely in their sights. I check the site frequently and on occasion insider memos are fully displayed. The owner, John Young, typically lists entire email conversations so viewers get the full details. I'm certainly not implying classified material is revealed but looking from the outside I can understand this attack. Whoever did this, and it reeks of gov't participation, did it as a show of force knowing full well the sites content is archived.

brill

If this is the best government hackers can do then I'm pretty disappointed with their so called skills. From reading the information on the hack it looks more like some kind of script kiddie who doesn't speak english as their primary language was trying to get initiated into a group somewhere and picked cryptome to be his initiation target. I will be infinitely more worried and impressed when they start going after SCADA systems, a simple defacement is elementary stuff.

Originally posted by Helig
If this is the best government hackers can do then I'm pretty disappointed with their so called skills.
...
I will be infinitely more worried and impressed when they start going after SCADA systems, a simple defacement is elementary stuff.

Who doesn't have backups of sorts these days. The hole was most likely identified and the data restored. In practical terms I would think permanently wiping out a sites data is pretty tough. I don't think there is any question that if a military operation (assumed here) wanted to inflict more damage that a DDoS could be done with effect. This certainly could have been script kiddies but given the site and what they represent that seems highly unlikely, in my opinion.

brill

so does this make groups like Anonymous kind of like internet militias?

\o/

reply to post by Helig


Actually if there were one file, or a small number of files at issue, a sloppy hack and a total wipe would be exactly how I'd think about covering my tracks.

Then again, this could simply have been a message. Or the exclamation point on a previously, less publicly stated one.

~Heff

Another anonymous tipster alerted Cryptome of a WikiLeaks IRC chat that happened a few hours before Cryptome was hacked. The tipster thought the IRC chat might be related to the hack. A person in the chat claimed to have uploaded a file to WikiLeaks and it still was not published two weeks later. Since the WikiLeaks site was down, the secret-document leaker was advised to upload it to Cryptome. Within the chat, a person stated, "[18:59] Dont trust pgpboard. And Cryptome has poor security. Call your local paper and release it to them."

Link

Thought that was interesting

Could be skiddies, could be someone trying to prevent a certain document being published. Either way I find it interesting and don't think it's an auto dismiss as some here seem to believe.

there was two messages left on the site, one apprently from trainreq, and the other from ruxpin
both leaving "I are a member NAO, Dis wuz my challenge."

might have been a challenge to join a hacking group.

also it is suggested on the site that it was done by Xyrix, aka corey Barnhill

reply to post by MR BOB


Yeah I saw that too. Still as previously stated by another, simply knocking the site offline and deleting files wouldn't be that difficult (I'm just glad I can restart my computer). The thing I still find most interesting is the theory that information was posted to the email account or even onto the site itself that was deemed too sensitive (they are unsure if all information was actually retained). Blaming a couple of hackers seems like a good cover.

If you have a website of business you are supposed to back up all of your data off site in another city so it can prevent stuff like this from causing too much damage. So atleast if you lose the website you still have all of your files. That sucks that happened to them, but if they didn't back up their data they were asking for it to happen. Thats why so many businesses go under because they get hacked without backing up elsewhere.

reply to post by CX


Guys, I wouldn't go on cryptome.org. It's a classic honey pot trap.

en.wikipedia.org...(computing)

Originally posted by The Baby Seal Club
reply to post by CX

 

Guys, I wouldn't go on cryptome.org. It's a classic honey pot trap.
en.wikipedia.org...(computing)

Your going to have to do more than that if your attempting to convince anyone. Is this is a personal interpretation of the site and its content or do you have proof of sorts to back this assertion ?

brill

reply to post by The Baby Seal Club


There is always that possibility. Sadly we have no real idea what is or is not a honeypot. Do you have any documentation or proof of it's honeypotidness?

reply to post by abrowning


Good thing this was posted ASAP otherwise the coincidence would be just too much

ATS Was Not Hacked, Attacked, or Otherwise Messed-With
www.abovetopsecret.com...

Timing is everything

As to Cryptome, been using it for years, never had any issues with them. Get some of my best leads from there

All you claiming the government is doind all this...can you supply proof...or is it just another paranoid rant?
second line

Originally posted by The Baby Seal Club
reply to post by CX

 

Guys, I wouldn't go on cryptome.org. It's a classic honey pot trap.

en.wikipedia.org...(computing)

I'm not quite sure what your definition of a honeypot is. The true definition of a honeypot doesn't fit here, as it's a system configured to attract the attention of would be hackers in order to draw attention away from the real servers/network. That being said, point taken.

Now, what Cryptome should probably be more worried about is what did the attackers leave behind? Did they leave a worm, trojan or logic bomb? I don't know how the site works, but if its made to allow users upload information "anonymously" then anybody uploading information to the site could very well now be tracked by a program the attackers left behind. Those providing classified documents that the government doesn't want leaked now know who to go after, personally.

I'm not going to give an opinion on who hacked the site as I have no way of knowing.

I would however just say that anyone can download huge suits of hacker tools from the internet for free and you don't have to be a genius or the government to be able to use them either.
The tools have a legitimate use in the computer security world for "penetration testing" i.e seeing how secure your own network is, but in reality they are mostly used by hackers

reply to post by kerazeesicko


A conspiracy theory does not need proof. I was presenting a theory hoping that others would discuss it. I am open to all possibilities in this case. I brought this information to the forum because I find it a wonderful site for discussion.

I think that there might be someone associated with Wikileaks. I don't really like the way that guy is behaving lately and I really think he might be serving some nefarious purpose with his so called "disclosures'. But then again it might be just paranoia

Wired.com just released a nice article about the Cryptome Hack with a lot of details. Yet some of those details still need confirmation.

Wired.com - Cryptome Hack

A little resume for the lazy ones :

* No Data was deleted or altered
* Apparently the hacker did it for 'the fame', a rivalry with an alleged Cryptome hacker and because 'Cryptome was popular'
* The hacker entered trough a security flaw in the Earthlink e-mail account system
* Read the story, it's very interessting

*Edit: I lurked the Wikileaks IRC to get some update news on the site's status and the Guest#randomnumber asked the whole time about his documents not yet beeing released...

The question that's still in my mind: Why does the Wikileak maintenance take so long? Their IRC message still says 'back in a week'. And why would a Wikileaks Insider (if it was one of them who said this) send a whistleblower to Cryptome? I'm sure they know about the sites security (issues)

Hmmm. Very interesting. I have often wondered about this type scenario. Good thing this can't happen to ATS. Right? Right!?

I honestly have no idea what I would do. . .but I would assume that it would work, on. . .say. . .a rotating "frequency". Well, encryption, RE-encryption. In fact, I am sure that someone at ATS probably rewrites something or other every other hour. At least, that's what I would do.

Strangely enough, I've never heard of the site. . .I suppose that's a good thing since there's nothing there to see now. Right?