Military, NASA other agencies hit in series of attacks
Connecting state and local government leaders
A U.K. hacker has been charged with breaching thousands of U.S. networks over the past year, including systems run by the Army, NASA, EPA and other agencies.
Prosecutors have charged a U.K. hacker in connection with a year-long series of attacks on U.S. government and other networks that resulted in the theft of the personal information of government employees and massive amounts of other sensitive data, causing damages in the millions of dollars.
The U.S. Attorney’s Office in Newark, N.J., said Lauri Love, 28, of Stradishall, England, and three unnamed co-conspirators exploited weaknesses in Structured Query Language databases and the Adobe ColdFusion Web application development platform to carry out the attacks, which they said began at least as early as October 2012 and continued into this month. Love was arrested Friday at his home by the Cyber Crime Unit of the U.K.’s National Crime Agency.
Among the thousands of computer systems breached in the attacks were networks run by Army, U.S. Missile Defense Agency, Environmental Protection Agency and NASA, prosecutors said in an indictment filed in New Jersey.
Prosecutors said Love and his cohorts — two in Australia and one in Sweden — aimed “to disrupt the operations and infrastructure” of the government by stealing large amounts of confidential data.
“This … stuff is really sensitive,” Love, operating under the handle “peace,” at one point told another conspirator via Internet Relay Chat, the indictment says. “It's basically every piece of information you'd need to do full identity theft on any employee or contractor for the” agency. In Some cases, they stole contracting and budget data, prosecutors said.
The hackers used proxy and Tor servers to hide their identities, while also changing their nicknames in online chats. They used automated scanners to look for vulnerabilities among a large array of IP addresses. They would then use SQL injection attacks, exploit ColdFusion exploits and other tactics to gain access, and plant shells or backdoors on the networks so they could return, according to the indictment.
Prosecutors released a partial list of attacks, on dates ranging from Oct. 2, 2012 to Jan. 3, 2013.
| Date | Organization | Type of attack | Data involved |
|---|---|---|---|
| Oct. 2-6, 2012 | Army Corps — Engineer Research and Development Center, Vicksburg, Miss. | ColdFusion | Demolition and disposal of military facilities |
| Oct. 6, 2012 | Army Corps, Vicksburg, Miss. | ColdFusion | Natural resource management |
| Oct. 6-9, 2012 | U.S. Army — Network Enterprise Technology Command, Aberdeen Proving Ground, Md. | SQL injection | PII (more than 1,000 individuals) |
| Oct. 7-8, 2012 | U.S. Army — Army Contracting command, Redstone Arsenal, Ala | SQL injection | Nonpublic competitive acquisition bid data and attachments |
| Oct. 9, 2012 | U.S. military — Plans and Analysis Integration Office, Aberdeen Proving Ground, Md. | ColdFusion | Defense program budgeting data |
| Oct. 12, 2012 | U.S. Department of Defense — Missile Defense Agency, location not specified in indictment | ColdFusion | PII (more than 4,000 individuals) |
| Dec. 23, 2012 | Army Corps — Engineer Research and Development Center, Vicksburg, Miss. | ColdFusion | Not specified in indictment |
| Jan. 11, 2013 | U.S. Army War College — Strategic Studies Institute, Carlisle, Pa. | ColdFusion | Not specified in indictment |
| July 10, 2013 | NASA, location not specified in indictment | ColdFusion | PII of numerous NASA employees |
| Jan. 3, 2013 | Environmental Protection Agency — Federal Facilities Environmental Stewardship and Compliance Assistance Center, Newark, Del. | ColdFusion | Non-PII personnel data |
After the arrest, investigators emphasized the importance of international cooperation in going after cybercrime. “Computer intrusions present significant risks to national security and our military operations,” said Daniel Andrews, director of the Army Criminal Investigation Command’s Computer Crime Investigative Unit, which investigated the attacks with the FBI. “The borderless nature of Internet-based crime underscores the need for robust law enforcement alliances across the globe. We appreciate the bilateral support of the National Crime Agency in bringing cyber criminals to justice.”
Love is charged with one count of accessing a U.S. agency computer without authorization and one count of conspiracy. He’s also been charged in the Eastern District of Virginia with alleged conduct related to other intrusions, prosecutors said.