HBGary Federal CEO Aaron Barr Steps Down (In Wake of 'Anonymous' Attack)

[Hissyspit]

Source: ThreatPost.com

February 28, 2011, 12:54PM

HBGary Federal CEO Aaron Barr Steps Down

By Paul Roberts

Embattled CEO Aaron Barr says he is stepping down from his post at HBGary Federal to allow the company to move on after an embarassing data breach.

The announcement comes three weeks after Barr became the target of a coordinated attack by members of the online mischief making group Anonymous, which hacked into HBGary Federal's computer network and published tens of thousands of company e-mail messages on the Internet. HBGary did not respond to telephone and e-mail requests for comments on Barr's resignation.

- snip -

The group conducted a preemptive strike on HBGary after Barr was quoted in a published article saying that he had identified the leadership of the group and planned to disclose their identities at the B-Sides Security Conference in San Francisco.

By combining a SQL injection attack on HBGary's Web site with sophisticated social engineering attacks, the group gained access to the company's Web- and e-mail servers as well as the Rootkit.com Web site, a site also launched by HBGary founder Greg Hoaglund. Ultimately, the group defaced HBGary's Web site and disgorged the full contents of e-mail accounts belonging to Barr, Hoglund and other company executives.

Read more: http://threatpost.com/en_us/blogs/hbgary-federal-ceo-aaron-barr-steps-down-022811?utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed:+hackernewsyc+(Hacker+News+YC)

[DontTreadOnMe]

1. The Most Embarrassing Web Attack... EVER!

And the guy's company PROMOTES Web Security!

one word describes this guy... "PAWNED!"

[MrMickeysMom]

15. How bout a phrase that describes how he "delivered"?

b a d l y...... :dunce:

[uncle ray]

30. PAWNED?

one of us isn't up on our memes.

and i'll be damned if i know which one it is.

[rhett o rick]

2. Wouldnt it be funny if the authorities found nasty stuff on his hard drive.

Like in "The Girl with the Dragon Tattoo"? Lisbeth is Anonymous.

[Mojeoux]

3. A Kick for the Anonomous Cajones to Pull This OFFF!!!!! NT

[Bonhomme Richard]

4. Falling on his sword so they can keep their nefarious business. n/t

[AndyTiedye]

8. Who Would Take Them Seriously as Security Consultants Now?

They're finished and they know it.

They pretty much admitted as much when they ran away from the RSA conference with their tail between their legs.

[Bonhomme Richard]

9. They are providing a service their clients want so they....

are not going to change their business model though they may change their name. They will lay low and hope the spotlight goes elsewhere.

[Snagglepuss2]

28. If this is what they're saying in public, you have to wonder what they're saying in private

According to ars technica, one of HBGary's Vice Presidents, said:

Asked if HBGary has in fact seen a financial impact from the Anonymous attack, Butterworth would only say, "Time will tell." He did admit that the hack had an impact on the company—"the tainting of a brand name, a company that has a very good product"—and that "we've received indications that folks are having second thoughts" about working with the firm.

Consider... if this is what they're willing to put on the record, you have to wonder just how bad the real state of affairs must be. Robert X. Cringely nailed it when he said:

"I'll bet within a year that if parent company HBGary survives this debacle, it decides on a name change. There's no getting the stink off now."

[dixiegrrrrl]

5. Woot!!!!!

rec'cing and sharing and etc.

Hissyspit, have ya had a hug today?
You deserve one for this story alone!

:hug:

[Hissyspit]

7. LOL

O.K... :hug:

[Kurovski]

6. K&R (nt)

[annabanana]

10. all together now:

Dum, Dum, Dum, Dum,

Another one bites the dust
Another one bites the dust
And another one gone, and another one gone
Another one bites the dust

[RoccoR5955]

11. Anonymous 2, HBGary -1 n/t

[liberation]

12. As the kids of today say: PWNED!

LOL

[juxtaposed]

13. once an ass always an ass

[AtheistCrusader]

14. AAAAAAHAHAHAHAHAHAAAAA

Too awesome for coherent speech.

[gristy]

16. emails in searchable form are here

http://search.hbgary.anonleaks.ch/

[Poll_Blind]

19. (dives into the serial numbers)

Splishy, splashy!

PB

[boppers]

21. Lots of serial numbers in there.

Shareware numbers, spendy enterprise software numbers, and a shit-ton of numbers used by HBGary's clients calling about support for their products....

Also, love letters, breakup threats, office gossip, names and sites of security personnel that "didn't exist".

"SCIF"

[Poll_Blind]

22. Hey how long you been digging through these? Aside from the...

...sparkly things, the real meat of it all could use a lot of analysis. Do you know if anyone's even attempting to break all this down and see what deeper things might be going on? And if so, where can I read or participate in that analysis?

Wondering how many CISSP's broke their oath, if any. You can't throw a rock through that e-mail pile and not hit one and I would like to help burn one if they did break it.

PB

[boppers]

23. How long? Since the site went up, I think, but it got boring, fast.

Lots of red meat has been rolling out. *LOTS*.

As far as places to read/participate, it's a bit decentralized. For some reason. :eyes:

As far as CISSP, I'm SAGE (http://www.sage.org/), not CISSP, so I'm not familiar with their rules, but these folks were making a mockery of their profession either way.

[boppers]

25. LOL, just found:

https://www.isc2.org/ethics/default.aspx

Yeah, a bunch of people are toast.

[Hissyspit]

31. "Act honorably, honestly, justly, responsibly, and legally."

[Hissyspit]

33. Red Meat:

http://www.dailykos.com/story/2011/03/01/951314/-Help-Anonymous-stop-Palantir-Do-it-now

[Hissyspit]

32. Love that dirty water.

:)

[MrMickeysMom]

17. Here's a fun idea...

... Have a thread suggesting what their new business venture might be... you know... to help them out with the next vision and mission... :P

[Snagglepuss2]

26. How about Penny's Pleasure Palace....

I suggest they move their operations to Nevada. They can always open up a brothel, seeing as they're all too familiar with the concept of screwing-over the customers. Aaron could always serve as the bus-boy/dishwasher...

[Snagglepuss2]

18. Democrats call for an investigation of law firm, 3 tech companies

According to the Washington Post:

Democrats call for an investigation of law firm, 3 tech companies
By Dan Eggen
Monday, February 28, 2011; 10:26 PM

A group of House Democrats is calling on Republican leaders to investigate a prominent Washington law firm and three federal technology contractors, who have been shown in hacked e-mails discussing a "disinformation campaign" against foes of the U.S. Chamber of Commerce.

In a letter to be released Tuesday, Rep. Hank Johnson (D-Ga.) and more than a dozen other lawmakers wrote that the e-mails appear "to reveal a conspiracy to use subversive techniques to target Chamber critics," including "possible illegal actions against citizens engaged in free speech."

The lawmakers say it is "deeply troubling" that "tactics developed for use against terrorists may have been unleashed against American citizens."

Read the entire story at: http://www.washingtonpost.com/wp-dyn/content/article/2011/02/28/AR2011022805810.html

Snagglepuss2

[ThomCat]

35. Why the hell aren't they calling upon our own DoJ to

investigate too! Lawmakers from our own party might be able to put some pressure where it could do some good.

:wtf:

[boppers]

20. "sophisticated social engineering attacks" my ass.

They got control of an email account.

Using that email account, they found old passwords, and asked another admin if the passwords still worked... the admin answered in the affirmative. Then they changed the password, I kid you not, to:

changeme123

Then even they asked for the account name... and the admin gave it to them.

http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars/3

Nothing "sophisticated" about it.

[Snagglepuss2]

24. Depends on your point of view....

They got control of an email account.

Using that email account, they found old passwords, and asked another admin if the passwords still worked... the admin answered in the affirmative. Then they changed the password, I kid you not, to: changeme123

Then even they asked for the account name... and the admin gave it to them.
Nothing "sophisticated" about it.

You're absolutely right--there was nothing sophisticated about it. However, that says rather less about Anonymous, and rather more about HBGary. Remember, HBGary is/was a security company, and one that advised sensitive government and military installations about computer security. The mistakes they made are all those warned about in Security 101 courses.

The really funny thing is, that the computer systems belonging to the Westboro Baptist Church (WBC) were more difficult for Anonymous to get into than those of 'security' firm HBGary Federal. According to media reports, the WBC's computers required making use of a 0-day exploit to penetrate.

[boppers]

27. I used to work on 0-day full time. Fun job, but a bit stressful.

There were (on average) 10-15 new 0-day exploits... per day. Every day.

My job was to write POC exploits, based on provided data, and the detection code to monitor it.

While it is amusing that Anonymous got in on a 0-day, I don't view it as all that different from social engineering. It's basic, simple, code work, and any site under threat (be they HBGary or WBC or the CIA) should have (or contract) folks who watch for the exploits that just came out... 20 minutes ago.

[Snagglepuss2]

29. Tunnel vision

There were (on average) 10-15 new 0-day exploits... per day. Every day.

My job was to write POC exploits, based on provided data, and the detection code to monitor it.

While it is amusing that Anonymous got in on a 0-day, I don't view it as all that different from social engineering. It's basic, simple, code work, and any site under threat (be they HBGary or WBC or the CIA) should have (or contract) folks who watch for the exploits that just came out... 20 minutes ago.

Fair enough. What you also have to realize here is that HBGary's own documentation states that penetration of one's systems is inevitable -- they even quoted an NSA study to that effect. A fair number of their employees are ex-military -- you would think that defence in depth would be as natural as breathing to them.

Consider this: if Anonymous had succeeded in getting access to the mail server and, once there, found that all the emails were PGP-encrypted, we would not likely be having this exchange right now. Some of HBGary's staff obviously knew about encryption -- a very small number of the emails were PGP-encrypted, and one or more of the parties were using GPG (Gnu Privacy Guard). I'll grant you that some of their staff/principals were not terribly technically-inclined; HBGary President Penny Leavy was still using Outlook as an email client, and she furthermore expressed her admiration for the Geek Squad(!).

To accomodate people like her, PGP, Inc. sells software allowing for server-based automatic email encryption, so does Astaro, which manufactures a gateway appliance for just that purpose. Hell they could have setup a server and used readily-available PERL scripts to carry out the encryption, if they wanted to do it on the cheap.

If HBGary had had a policy in place (and enforced it) requiring:

1) That all emails stored on the server be PGP-encrypted; and

2) Mandating the use of PGP for authentication/transmission of sensitive materials (i.e. user-IDs/passwords);

then Anonymous would have been prevented from gaining control of rootkit.org, and they could not read the stolen email.

One of these emails that I read was written by Greg Hoglund, and it described how their email could be secured. He was describing the mandatory use of VPNs, and virtual machines, but I don't recall any mention of end-to-end encryption. He was describing a setup that he said would cost about $100,000.

They appear to be suffering from a terminal case of tunnel-vision -- I guess that old saw is correct: "When all you have is a hammer, everything looks like a nail." (HBGary writes malware detection/remediation software.)

HBGary seems to be fixated on malware, almost the exclusion of everything else. Even in this email wherein he outlines his $100K security solution, he is still obsessed with malware infecting even the virtual machines used to access the company VPN. I'm certainly not denying that malware is a threat, but as experience has shown, it is not the only threat. (Even the Maginot line was by-passed, after all.)

[boppers]

37. their Maginot line was.... google apps.

You make some great points, but in the end, these folks were kiddies.

"A fair number of their employees are ex-military -- you would think that defence in depth would be as natural as breathing to them. "

How many soldiers think about setting an arming trigger on each and every round they send downrange? Not much.

Sure, the Q folks think about it, but for the most part, that level of depth isn't considered.

[jbeing]

34. Aaron Barr?

Like the traitor?

Or, exactly like the traitor?

[Love Bug]

36. You're thinking of Aaron Burr, but yeah, that's the first thing I thought seeing "Barr"