Defense Contractor Vanguard Network Hit by AntiSec Hackers

Another defense contractor s network and data has apparently fallen to the combined skills of hackers attacking Websites under the "AntiSec" banner.

Members of hacktivist collective Anonymous have reportedly breached servers belonging to defense contractor Vanguard Defense Industries as part of the movement to steal and publicize documents from government agencies, according to a report in the TechHerald. Anonymous may have extracted nearly 4,713 emails and thousands of documents in this attack.

Anonymous has gone after a number of defense contractors and government agencies recently as part of AntiSec, including Booz Allen Hamilton and InfraGard, a public-private partnership organization working with the Federal Bureau of Investigation.

"Any private corporation s supporting U.S. military or law enforcement operations are legitimate targets in our eyes," a member told the TechHerald, justifying the attack on VDI.

The attack seems to have exploited vulnerabilities in the popular WordPress blogging platform. VDI apparently had not upgraded two out-dated plug-ins, leaving security holes wide open for the cyber-attackers to waltz through.

"Recent large hacks making headlines are thought to have been performed by compromising just one plug-in in an enterprise," Michael Sutton, vice-president of security research at Zscaler ThreatLabZ, told eWEEK. According to Zscaler’s latest "State of the Web" report, even if the software has been updated to the most up-to-date version, many organizations tend to fall behind in updating plug-ins, making it a lucrative attack vector.

"The government requires stringent security methods in place for its contractors and VDI appears to have failed to implement even the most basic security, patching its Website," Josh Shaul, CTO of Application Security, told eWEEK. 

Attackers also compromised the password used by Richard Garcia, VDI’s senior vice president and the former assistant director in charge of the FBI’s field office in Los Angeles, and gained access to his emails. The attack on Garcia’s account is slightly reminiscent of how Anonymous compromised emails at HBGary Federal because CEO Aaron Barr and chief operating officer Ted Vera had reused weak passwords across several systems.

Attacks like these show that even with all the cyber-attacks and data breaches in 2011 so far, some organizations still don’t take information security "seriously," Shaul said. Simply monitoring database access and regularly patching software could have thwarted many of the basic attacks this year, according to Shaul. 

To read the original eWeek article, click here: Anonymous AntiSec Breaches Defense Contractor Vanguard Network