The hacker behind yesterday's defacements against Queensland Government websites will release a sample of a massive data cache, which is allegedly stolen from one of Australia's largest internet service providers.
The hacker, claiming to be associated with Anonymous, told SC Magazine Australia that they would not release user details contained in the stolen data or name the telco, but said that it was 'one of Australia's largest'.
The cache was said to be a 40Gb database backup and was accessed through an unpatched Adobe ColdFusion vulnerability. The hacker said the unnamed telco later found and removed the remote shell they uploaded to the server and patched the vulnerability.
The data was stolen 'to prove a lack of security at ISPs and telcos to properly protect the information' which would be stored under the Federal Government's data retention draft policies. Yesterday, the same hackers operating under the banner of Anonymous defaced a string of Queensland Government websites, including those linked to tourism, science and economic development, in protest against the draft policies. The text of of each defacement was removed shortly after the attacks.
Traffic filtering data was stolen reportedly through a local file inclusion vulnerability on the Queensland Department of State Development website and uploaded to the ParAnoia website, operated by the Anonymous research wing.
Defacements of Australian websites are a daily occurrence and are considered basic in information security circles. The latest round is targeted as a protest against the proposed data retention policy.
The government has held talks with internet service providers for the past two years on the proposal, which would mandate providers to store up to two years' worth of a users' online historical data and provide easier access to social networks such as Twitter.