Hackers Post Police Records after Sterling Shooting, Show NATO Gen. Plotted Against Obama, and Broach NASA Twitter Account

In case you missed our coverage this week in ThreatWatch, Nextgov’s regularly updated index of cyber breaches:

Activist Leaks Law Enforcement Database after Louisiana Police Shooting

Days after the killing of a black man by Baton Rouge officers prompted global outrage, an individual posted online 50,000 poached city police records.

The cache, which was confirmed as legitimate, contained names, addresses, emails and phone numbers.

The administrators of the website apparently had failed to implement proper security measures.

The "breach"—for lack of a better term—appears to have been a case of unauthorized access using discovered login credentials rather than any kind of technical attack.

A hacker named @0x2Taylor claimed responsibility for accessing the database, but it is unclear whether @0x2Taylor obtained the data or was given it by a third party and took credit.

"The website had its permissions set wrong and shouldn't have been left open for the public to see this data," explained Jamie-Luke Woodruff, a security intelligence analyst who works at Patch Penguin, a British cybersecurity firm. "They seem to have obtained credentials to the Oracle server in which they extracted the database information. But they didn't set out to get the data that they obtained it was just random that the credentials was found."

Eric Romero, who runs information services for Baton Rouge, said he heard "rumors of a breach" but was unable to confirm it had occurred.

Baton Rouge police officers shot Alton Sterling, 37, after a confrontation in front of a convenience store in response to reports of an armed man.

Multiple cellphone videos of the shooting, captured by bystanders and released online, call into question some police claims that Sterling, who faced multiple criminal prosecutions in the past, was holding a gun when he was shot. 

When @0x2Taylor first announced the hack, he accompanied the tweet with three hashtags suggesting the motivation behind the leak: #AltonSterling, #Hacked, and#BlackLivesMatters.

"The reason i did it is because of what that officer did to alton sterling," @0x2Taylor told the Daily Dot in a private Twitter message. "i'm sick of seeing police abuse their power and all the killings."

Hacked Emails Suggest Former NATO Commander Plotted Against Obama during Ukraine Conflict

Leaked emails from the Gmail account of retired Gen. Philip Breedlove, the recent supreme commander of allied forces of NATO, reveal he privately plotted against President Barack Obama's wishes during the Russian-Ukrainian conflict. 

A new website called DCLeaks posted the hacked messages. 

Phillip Karber, an academic who corresponded regularly with Breedlove, verified the authenticity of several of the emails. He also told The Intercept that Breedlove confirmed to him that his Gmail account was hacked and that the incident had been reported to the government.

Citing his own leaked emails, Karber said: “I turned this over to the U.S. government and asked them to investigate. No one has given me any answer.”

Breedlove, while briefing Congress in 2014, disagreed with the Obama administration about the situation in Ukraine. (Obama was reluctant to provide lethal assistance to the Ukrainian government, fearing that doing so would increase the bloodshed and provide Russian President Putin the justification for deeper incursions into the country.)

In a series of 2014 messages to Colin Powell, Breedlove sought meetings with the former secretary of state for advice on pressuring the administration to take a more hawkish posture toward Russia.

Powell responded by accepting an invitation to meet and discuss the dilemma.

DCLeaks is a database run by self-described “hacktivists” who collect the communications of high-profile influencers such as political parties, politicians, political campaigns and the military. The website currently also has documents revealing some internal communications from the Hillary Clinton presidential campaign and George Soros’ Open Society Foundation.

NASA Kepler Spacecraft Tweets Image of Woman's Derriere

A photograph of a woman's face and red panty-clad bottom briefly appeared on the official Twitter account for NASA's Kepler, a mission surveying parts of the Milky Way Galaxy for hospitable planets.

The defacement was visible the morning of July 6. It is unclear how the hacker broached NASA's social media account.

"Unfortunately for NASA, the tweet also shows up in the mission website," Gizmodo reported.

Around 10 a.m. Wednesday, the unauthorized user, who changed Kepler's name on Twitter to r4die2oz, posted the butt photo with the caption "waiting for ya: <3," followed by a link to a porn site, localsex2.com, according to Motherboard. 

The account was restored around 10:45 a.m. Eastern the same day. 

"As you may have seen, we recovered the account and are back in business," NASA's social media manager John Yembrick said in an email to Motherboard. "We’re investigating the cause of this incident with Twitter. We have hundreds of official NASA Twitter accounts, and this is a very rare occurrence. We work to safeguard our accounts as much as possible. Although we monitor all of our accounts closely, we want to thank our followers for flagging the incident for us."

Signs of Ransomware Pop Up At Colorado Allergy Clinic

A Glenwood Springs, Colorado, medical office has sent out cautionary notices after a discovery a month ago of possible ransomware on its computer system.

Kari Hershey, an attorney for Allergy, Asthma & Immunology of the Rockies, P.C., said the problem became apparent when staff had trouble accessing a few documents on its system.

Because the system holds protected health information, such as test results and Social Security numbers, the clinic immediately shut down the server and contacted a forensic IT company to troubleshoot the disturbance.

The ransomware was still in its early stages when detected. There is no evidence any of the information on the system has been copied or used in any way, although it did pass through a password protected firewall. 

“They weren’t able to track exactly what the hackers did, but what they did find was a draft of the ransom letter on the system,” Hershey said. “The way it was explained to me is that it essentially looked like the hackers were still testing out the ransomware.”

She said by this point in the investigation, it likely would be known if sensitive information had been harvested. 

The Glenwood Springs Police Department says the case is currently closed and inactive because the IP address of the attacker was traced back to Russia, far beyond the department’s jurisdiction. The rest of the investigation likely will be handed over to the FBI.