Logica, National Special Event: Morgan (part 4)
0201-K81864-12 Notification Letter from Axex
Translated version of Axex’s police report for Applicate.
Yv*nn* W*stm*n, CEO
Infodata Applicate AB
100 26 STOCKHOLM
(The reporter requests that the report is classified if possible since publicity about the event can affect the company more than the event itself. The reporter requests to receive a copy of the report sent to them.)
CEO Yv*nn* W*stm*n describes the situation at Logica as “panicky”.
Responsible person at Logica is
J*h*n R*p*, C of Operations
Logica Sverige AB
073-xxx xx xx
He is in maximum charge of Logica’s operations in Sweden.
CEO Yv*nn* W*stm*n requests that the Security Service speaks to him if possible before he takes any panicky actions.
Axex co-operates with Infodata Applicate AB in security related matters. The company has recently been attacked by hackers and has requested us to report the event.
Infodata Applicate AB, 556436-3421, wants to report hacking where somebody unknown has gained access and stolen information from their servers in the network.
Somebody has illegally downloaded information from Applicate. Logica is the company that supplies Applicate infrastructure. The attack has been made through Logica’s web application and from information received they have also accessed mainframes (which requires special knowledge).
In connection with the intrusion of Infotorg’s web applications the intruders have used Monique Wadstedt’s account. She is the lawyer that representet the American entertainment companies that were one of the parties in the Pirate Bay trial. Outgoing traffic has been going to two IP adresses at an ISP called Cogetel in Phnom Penh, Cambodia, Bahnhof and Tele2 mobile connection.
During the intrusion the attckers have downloaded amongst others, social security numbers for protected identities from 2007 (without names or other information). They have also downloaded the entire SPAR database incloding historical data from 4 years back in time.
It is estimated that 1.7 Tb information has been transferred out of Applicate’s storage servers.
The 3rd-4th March 2012 Applicate’s IT manager noticed increased activity and load which exceeded normal level in the mainframes which they use. The increase wasn’t dramatic and they were insecure of what the reasons were.
Pretty soon IT personnel found that there was abnormal activity in the network.
Closer investigation found that an account belonging to a sales person at Applicate had performed 1600 transactions under one hour, which is impossible to do manually. They also found abnormal searches made by the same account.
Controls showed that the owner had not been at their or somebody else’s computer with access to the system. The account owner had been in sales meetings at the point of time.
Additional studies showed traces of FTP traffic and exportation of text files which is very rare at Applicate. One could also detect that Telnet communication started against the mainframe resources which is not normal.
Applicate made the conclusion that they were attacked and that somebody had accessed their servers.
By investigating the search queries made by the compromised user account they found that the permissions for the account had been increased and that some strings included in the code for permissions could only originate from Logica.
There are also details that Logica Sweden is about to fire upp to 450 employees as a saving measure.
Applicate has also found that the attackers used one of Logica’s group manager’s user account in their office in Bromölla to gain illegal access to information.
More extensive investigations were carried out and they showed that the attackers had hacked into and stolen information from the administrative permission system RACF in the mainframe. This system contains information about circa 100 000 users. They have also downloaded information from a system called PI, where information regarding permissions also occurs. These systems are in a UNIX mainframe environment.
Applicate has in its security work decreased the 200 accounts with highest permissions that have been found in the investigations to 2 accounts.
In its security work Applicate has found that somebody used Monique Wadstedt’s account. Wadstedt has had permissions and accounts in Applicate’s web interface that the intrudors have remade and created a mainframe account with superuser permissions. The intrudors have then used this access and permission to illegally download large amounts of files.
(Monique Wadstedt was the lawyer which represented the American entertainment industry in the Pirate Bay trial).
Applicate representatives have been informed by IBM specialists (hired by Logica) that investigated Logica’s mainframes and systems and found that there were over 20 years old user accounts remaining in the permission systems.
Regarding the Police connections to Applicate’s information systems they state that the Police has its own encrypted connection between Applicate’s mainframe and the Police’s mainframes.
After a detailed review of the situation Applicate has found that somebody downloaded circa 10 000 social security numbers belonging to people that had protected identities 2007-01-29. These numbers were extracted out of the system to be put in and complete the company services that Applicate ofers. Normally only the police can access the personal information that is connected to these numbers but it is not unlikely that a user with superuser permissions would be able to access and connect this information with accurate data.
Applicate has found that there have been searches made on people living around Borlänge, Ludvika and Smedjebacken. Queries have also been made on people in other parts of the country.
Moreover it has been detected that the intrudors through searching for the organisation number of the National Police Agency have searched for vehicles owned by the National Police Agency.
Other search queries have also been made.
The intrudors have also downloaded the SPAR database which also includes historical data 4 years back in time.
Upon examining outgoing traffic Applicate can state that traffic has gone to at least two IP addresses owned by Cogetel in Phnom Penh in Cambodia. Applicate has also detected exports to IP addresses in Germany and various other countries in Europe. Information has been downloaded using ISP Bahnhof and Tele2 mobile broadband with a prepaid SIM-card.