Military, NASA other agencies hit in series of attacks

Prosecutors have charged a U.K. hacker in connection with a year-long series of attacks on U.S. government and other networks that resulted in the theft of the personal information of government employees and massive amounts of other sensitive data, causing damages in the millions of dollars.

The U.S. Attorney’s Office in Newark, N.J., said Lauri Love, 28, of Stradishall, England, and three unnamed co-conspirators exploited weaknesses in Structured Query Language databases and the Adobe ColdFusion Web application development platform to carry out the attacks, which they said began at least as early as October 2012 and continued into this month. Love was arrested Friday at his home by the Cyber Crime Unit of the U.K.’s National Crime Agency.

Among the thousands of computer systems breached in the attacks were networks run by Army, U.S. Missile Defense Agency, Environmental Protection Agency and NASA, prosecutors said in an indictment filed in New Jersey. 

Prosecutors said Love and his cohorts — two in Australia and one in Sweden — aimed “to disrupt the operations and infrastructure” of the government by stealing large amounts of confidential data. 

“This … stuff is really sensitive,” Love, operating under the handle “peace,” at one point told another conspirator via Internet Relay Chat, the indictment says. “It's basically every piece of information you'd need to do full identity theft on any employee or contractor for the” agency. In Some cases, they stole contracting and budget data, prosecutors said.

The hackers used proxy and Tor servers to hide their identities, while also changing their nicknames in online chats. They used automated scanners to look for vulnerabilities among a large array of IP addresses. They would then use SQL injection attacks, exploit ColdFusion exploits and other tactics to gain access, and plant shells or backdoors on the networks so they could return, according to the indictment. 

Prosecutors released a partial list of attacks, on dates ranging from Oct. 2, 2012 to Jan. 3, 2013.

Date Organization Type of attack Data involved
Oct. 2-6, 2012 Army Corps — Engineer Research and Development Center, Vicksburg, Miss. ColdFusion Demolition and disposal of military facilities
Oct. 6, 2012 Army Corps, Vicksburg, Miss. ColdFusion Natural resource management
Oct. 6-9, 2012 U.S. Army — Network Enterprise Technology Command, Aberdeen Proving Ground, Md. SQL injection PII (more than 1,000 individuals)
Oct. 7-8, 2012 U.S. Army — Army Contracting command, Redstone Arsenal, Ala SQL injection Nonpublic competitive acquisition bid data and attachments
Oct. 9, 2012 U.S. military — Plans and Analysis Integration Office, Aberdeen Proving Ground, Md. ColdFusion Defense program budgeting data
Oct. 12, 2012 U.S. Department of Defense — Missile Defense Agency, location not specified in indictment ColdFusion PII (more than 4,000 individuals)
Dec. 23, 2012 Army Corps — Engineer Research and Development Center, Vicksburg, Miss. ColdFusion Not specified in indictment
Jan. 11, 2013 U.S. Army War College — Strategic Studies Institute, Carlisle, Pa. ColdFusion Not specified in indictment
July 10, 2013 NASA, location not specified in indictment ColdFusion PII of numerous NASA employees
Jan. 3, 2013 Environmental Protection Agency — Federal Facilities Environmental Stewardship and Compliance Assistance Center, Newark, Del. ColdFusion Non-PII personnel data

After the arrest, investigators emphasized the importance of international cooperation in going after cybercrime. “Computer intrusions present significant risks to national security and our military operations,” said Daniel Andrews, director of the Army Criminal Investigation Command’s Computer Crime Investigative Unit, which investigated the attacks with the FBI. “The borderless nature of Internet-based crime underscores the need for robust law enforcement alliances across the globe. We appreciate the bilateral support of the National Crime Agency in bringing cyber criminals to justice.”

Love is charged with one count of accessing a U.S. agency computer without authorization and one count of conspiracy. He’s also been charged in the Eastern District of Virginia with alleged conduct related to other intrusions, prosecutors said.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.