Parastoo’s message announcing the release suggests that their demands regarding investigation into Israel’s nuclear capabilities remains the same.

LETS SEE HOW A $1.3B BIZ, ACCORDING TO THEIR REPORT TO JPMORGAN, COLLAPSES , THEN CONTINUE
WITH PARASTOO’s DEMAND IN ITS FIRST PUBLIC MESSAGE.

A Trove of Intelligence Information

In their original statement Parastoo claimed to have accessed the following hacked information:

• More than 450,000 Credit Card records and purchase histories belonging to IHS’s customers covering a 10-year period.
• Identity information of roughly 800 individuals linked to the nuclear programs of 17 active countries.
• The identification of 4500 companies who produce parts for nuclear programs and CBRN.
• 11000 companies engaged in research, parts manufacture, parts sales, consultations, regulation, mining, sensitive material fabrication, waste processing, waste plants, CBRN detection and defense, and educational training.
• Detailed information on roughly 3000 CBRN incidents dated 1999 – Jan 2013, some with valuable expert comments.
• Geo-spatial intelligence on roughly 180 active CBRN facilities worldwide, with an estimated 100 facilities of government or military nature.
• Global geo-data on decommissioned CBRN sites – some origins as canceled projects and some considered active threats.
• Information on roughly 1900 hazardous products with CBRN roots and more than 300 companies selling detection and protection equipment.
• Roughly 400 interviews with CBRN product and program-related individuals with ballistics, missile, chemistry hazard, bio-terrorism and nuclear knowledge.
• Discovery of the IHS portal source code, and a laptop that had access to millions of medical records on U.S. citizens.

The IHS breach and released information seems to confirm a lot of what they initially reported to have. The scope within is vast and reaches into numerous topics including politics, elections, terrorism, official military data, energy industry, private security, airport data and transportation.

Hackers Said IHS hack – It Was EASY

– WE DID NOT MEET ANY CONSIDERABLE IT DEFENSE (emphasis mine)

The statement reports in detail how the attack completely compromised 22 servers hosted at Hosting.com which has its headquarters and main operations in Denver, CO.  They also detail how they were able to breach numerous technologies in their six-month long information-gathering efforts, boasting their prowess and having their way with such technologies as:

“ASP.NET, WEBAPP, JBOSS, SPARC SUN SERVERS, BIG IP LOAD-BALANCE, ENTERPRISE REDHAT LINUX SERVERS, WINDOWS 2003 SERVERS, WINDOWS 7 CLIENT USED BY INTERNZ”

Somehow, six long months passed and nobody noticed the worldwide movement of 14 TB of data within IHS’s own infrastructure.  AMAZING, yet sadly we see it repeatedly in significant breach reports.

14 TB , UNCOMPRESSED FORMATTED DOX ,DB
DUMPZ , DATABASE FILES NEEDED FOR FURTHER
ANALYSIS , AND LOGS.. WAS JUST TOO MUCH TO
MOVE . IN SHORT PARASTOO SPLIT DATA ON
VARIOUS PLACES INSIDE THE IHS’s OWN
INFRASTRUCTURE , HIDDEN IN PLAIN SIGHT DURING
THE OP SINCE WE HAVEN’T BEEN SURE YET THAT
SUCH CAREFULNESS WOULDN’T BE NEEDED AT ALL
AND LATER EACH PIECE TRANSFERRED TO BOUNCING
SERVERS , NONE BELONG TO US OR REGISTERED OR
BOUGHT BY ANYBODY INSIDE PARASTOO LOCATED IN
ISRAEL , GERMANY , CANADA , FRANCE , UKRAINE
AND ROMANIA , USING COSTUME PROTOCOL CODED AT
NIGHTS WHILE HAD TO HANDLE NONE-CYBER FACTORS
TO KEEP PARASTOO FLYING GETTING SHOT AT “IN
DAY LIFE”

Notably, the group also took to taunting Mandiant, the security group that was  recently all over the news for its direct identification of the Chinese military as a major source of cyber-espionage again the U.S.

WE OFFER MANDIANT GUYZ GET BUSY
INVENTING A FORMULA TO CALCULATE EXACT
MAN/HOUR AND COMPILE A REPORT ON POTENTIAL
CYBER-PHYSICAL ATTACK SCENARIOS TO HELP
PUBLIC LEARN HOW EVIL IS “USSR” AND CHINA

Limited Contact

From what we can tell, it appears at the moment the group is laying low, claiming to not have internet or social activities of any kind.  They have said what they wanted to say, and released what they wanted to release to date.  They have mainly communicated however with Wikileak.ir – an Iranian information publishing site that states the following guidelines

1.     Published information must not contain threatening contents to Iranian institutions, organizations and individual citizens around the world.

2.    Published information must not contain any blasphemy against recognized religions.

3.    Information with obscene content such as any adult related materials will not be published due to nature of this website, social and filtering issues.

The only form of contact they have is a fax number found in the original statement. You can bet that with threats of this kind that a number of three-letter agencies are out to locate this group to ask a few questions.

Analysis – A serious 9/11-style threat

Some weeks ago,  former US Secretary of Defense Leon Panetta said that we were in a “pre-9/11 moment”.  Though some scoffed at the alarmist tone, I am personally starting to believe this.

If all of this information is true, this has to be one of the most significant national intelligence compromises in history – because of its specificity, because of the parties behind the threats, and the confirmation of leaked sensitive data.  The threats were enacted in response to global events, particularly interested on the Middle East, Israel and Iran.

One of the most disturbing things if true, is that the hackers in this group were able to attack and collect information with ease and were utterly unchallenged.  The hackers stated time and time again they encountered almost no protection on the systems they breached and one some occasions, no antivirus protection, outdated insufficient systems and unsecured databases.  This makes for a grossly egregious lapse in fundamental security and we should all be shocked at the ramifications of such sloppy protection.  There is just no reason for that kind of information to be put at risk by such a lack of even standard security – whether it was financial constraints, staff, knowledge gaps, whatever – if you can’t secure it don’t put it online.   IHS’s trademark is “The Source for Critical Information and Insight” – well, it certainly seems that way except that information and insight is in the wrong hands now.

At any rate, a good deal of sensitive information was leaked here and of course it is now seen all over the world.  The genie is out of the bottle.  Enemy or rival states – whatever you want to call them are surely analyzing this intelligence at this point.  Even more threatening is the fact that any number of rogue groups have collected this information as well.

Not only are waste sites threatened, but information on the national infrastructure, power plants, internet facilities, water facilities, highways, freight lines, ports – all of it has been exposed.  To the uneducated or dishonest, these may sound like encyclopedia or almanac materials, or even ‘publicly available information’ – but to a determined enemy it is actionable military intelligence. One significant strike alone could send the country into chaos and a frenetic state for weeks on end.

If you look at the constant raiding and targeting of this country’s most sensitive secrets over the last few years, the cyber-espionage being committed from China and other countries, it paints a very alarming picture. Cyber-defense and intelligence as an industry have to get better right away.