Showing posts with label email. Show all posts
Showing posts with label email. Show all posts

Sunday, October 15, 2017

UK Parliament Hacked By Iran



The United Kingdom (UK) Parliament appears to have been hacked by Iran. The cyber-attack on 23 June 2017 was a brute-force attack against 9000 email accounts including the UK Prime Minister Theresa May and in total between 30 to 90 members of Parliament.

The UK Times newspaper which broke the story, said that it was Iran’s first significant act of cyber-warfare on the UK and underlines its emergence as one of the world’s biggest cyber powers and that Iran is highly capable of such attacks.

The decision to publish the information now is interesting, coming after the US President Donald Trump's intent to withdraw from the JCPOA (Joint Comprehensive Plan of Action) against Iran, which could threaten to re-instate sanctions against Iran. The UK, France and Germany do not agree with the USA on the matter. Without complete agreement, perhaps Iran will not suffer from any new sanctions against it, as it appears that Iran has not violated any of the sanctions.


Iranian regime attack or amateur hackers?

The attack, which was suspected of being originally from Russia, may have been carried out by amateur hackers. At the time of the attack in June, it was said that the attackers could only break into the email accounts of members of Parliament (MPs) which had simple, easy to hack passwords. As a security response at the time, MPs were unable to access their accounts and had to communicate using SMS texts instead. It now seems, however, that the regime may perhaps have after all been behind the attack?

Reasons for the attack

The reasons for the attack are unknown (or at least the British Intelligence services are not saying), but could be:
  • Exploratory activities: Iran may have been looking for UK data that Iran could then force the UK to make concessions with, or that could compromise the interests of the UK
  • Iran may have been looking for a trade advantage
  • More worryingly is the possibility that the IRGC (Iranian Revolutionary Guards Corps) may be seeking to undermine Iran's anti-nuclear proliferation deal in order to get it scrapped; Iran could then restart its nuclear weapons research.
The IRGC are at odds with President Hassan Rouhani, who they see as being too pro-West and the religious leader of the regime, Ayatollah Khamenei is linked with the IRGC, so there is an ongoing rift between the religious and political leadership of Iran, partly due to Rouhani slashing the IRGC's budget to restrict their economic activities.



An uncertain future

In my previous article, it is possible that Iran may seek to increase cyber-attacks against the USA if the US walked away from the JCPOA. Now that President Trump appears to be doing that, even if Germany, UK and France don't agree, we may see an increase in the cyber war from Iran against the West.

Thursday, January 21, 2016

US Releases Iranian Hacker

30 year old Iranian hacker Nima Golestaneh was extradited to the US from Turkey last year suspected of hacking attack against American military aerospace contractor Arrow Tech Associates (Vermont, USA).


In October 2012 Golestaneh broke into the servers of the company which builds ballistics prediction and testing software, and accessed its databases in attempt to steal software worth $millions.

US investigators identified that Golestaneh was in Turkey and he was then extradited to the US last year for trial on charges of wire fraud, unauthorized access to computers and money laundering.


However Golestaneh was pardoned by the United States and sent back to the Islamic Republic before being sentenced.
It seems that Golestaneh was part of an active Iranian hacking team that targets both US infrastructure and defense companies as well as the Las Vegas Sands casino email system.

Friday, July 25, 2014

New Phishing Campaign Targets LinkedIn Account Holders


The site hoax-slayer.com warning of new phishing emails targeting LinkedIn users, which aim to trick recipients into clicking on a link by claiming that their LinkedIn accounts have been blocked due to inactivity.

The phishing email states: "To ensure that your online services with LinkedIn will no longer be interrupted / You will be asked to log into your account to confirm this email address. Be sure to log in with your current primary email address."

Recipients who click on the link in the email are taken to a fraudulent LinkedIn login page designed to harvest email addresses and passwords.

LinkedIn users should always be wary of any unsolicited emails claiming to come from the company. LinkedIn is obviously a rich source of personal information which can be exploited for further social engineering attacks, which could prove costly both to the individuals and the organizations concerned