The Syracuse Police website remained inoperable over the weekend after the hacking group “Anonymous” gained access to the site and released a list of usernames and passwords.
The website was targeted last week by Anonymous, citing the case against former Syracuse University assistant basketball coach Bernie Fine. The hackers cite former chief Dennis DuVal’s admission that he knew about the accusations against Fine.
Police noticed the website had been hacked and tampered with around 11 p.m. Wednesday, Feb. 1, said Syracuse Police Sgt. Tom Connellan.
The public information website was the only hacked site. All internal information including police reports, records and mugshots are secure on the internal server, Connellan said. No permanent damage was done to the site.
Anonymous has taken credit for this and at least four other hackings in the last week, as part of its “Operation Piggy Bank,” or #OpPiggyBank on Twitter. It has also taken down the websites of a Texas police association, and has hacked or defaced the sites of the Newark, Salt Lake City and Boston police departments. Anonymous cited alleged police brutality at Occupy Boston as the reason behind Boston’s defacing.
In other hackings, Anonymous has released the home addresses of police officers and posted redacted versions of anonymous tips sent to police to solve crimes. Getting into that information was likely done through the internal server, computer specialists said.
“A group like Anonymous is responsible for doing a lot of these hacks and a lot of their attacks are very sophisticated,” said Michael Fudge Jr., the systems administrator at Syracuse University and an adjunct professor in the iSchool. “It is true that just about any website can be tampered with given enough time and patience on an attacker’s side.”
Fudge said the hackers likely were not able to get more sensitive data from the Syracuse Police’s website because of where files are stored. The public information website, which is what visitors see when they go to syracusepolice.org, and the internal server, which is where police records, reports, mugshots and other data are stored, are likely stored on two different computers or have two separate passwords.
“If you break into the website, you can obtain all of the information on the computer that runs the website,” Fudge said. “On that computer there could be usernames and passwords, those might give you access to additional systems [such as the internal server].”
Fudge said websites are often hacked not in an attempt to access information, but rather because the hackers can. They’re showing the security breaches, he said.
“Sometimes it is just because they can hack it, it’s not necessarily about the cause,” Fudge said. “The excuse as to why you do it is secondary to the fact that you can do it. It’s about entertainment and amusement and recognition.”
Two hackers have taken claim for the hack on Syracuse Police on Twitter — @ItsKahuna and @CabinCr3w. They have declined comment and have said they are focusing on other “targets” for Operation Piggy Bank. They do not plan to do anything more with Syracuse Police, they said.
The New York State Police computer crimes unit and the FBI are investigating the hacking.
