Week in review: LulzSec attacks, RSA admits compromise of SecurID tokens and new issue of (IN)SECURE Magazine
Here’s an overview of some of last week’s most interesting news and articles:
FBI affiliate organization hacked, user database leaked
Only a day after they leaked the details of over one million user accounts and various databases of Sony Pictures and some of its regional sites, LulzSec announced a successful attack against the Atlanta chapter of InfraGard, a non-profit organization that has ties with the FBI.
Business continuity: You need more than just a plan
An attacker isn’t just interested in stealing your information or funds. Organisations are experiencing attacks, whether denial of service or injected with malware, that is designed to wreak havoc and ideally shut the business down.
Fake AV distributed via user profiles on popular sites
An investigation into the methods of distibution of the FakeRean familiy of fake AVs has revealed some interesting facts, says GFI.
RSA admits SecurID tokens have been compromised
RSA has finally admitted publicly that the March breach into its systems has resulted in the compromise of their SecurID two-factor authentication tokens.
LulzSec leaks Sony Developer source code
Stolen source code is an especially bad thing for the company – if they had access to it, there is always the possibility they modified it and that they have implemented backdoors into the server for future attacks.
25 percent of US hackers are FBI informants
Anyone who has read Kingpin won’t be much surprised by the estimate recently made by Eric Corley, publisher of 2600: The Hacker Quarterly, who said that some 25 percent of US hackers are likely federal informants.
43% of enterprises have security issues with cloud service providers
Most enterprises face apprehension over adopting cloud computing, and with good reason: Nearly half (43 percent) of enterprise IT decision makers reported a security lapse or issue with their cloud provider within the last 12 months.
Bank not to blame for customer’s heavy losses from fraudulent transactions
A magistrate recommendation that is likely to become an official ruling could set a legal precedent welcome to banks all over the US, saying they are are not accountable for the fraudulent draining of commercial accounts if they have provided “reasonable” security measures to prevent it.
(IN)SECURE Magazine issue 30 released
(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics.
Can RSA repair the broken trust?
Despite Art Coviello’s open letter offering to replace tokens for customers, we are still none the wiser as to what assets within RSA were compromised during the breach they suffered in March.
How search engine poisoning works
Imperva disclosed the intricate workings of a Search Engine Poisoning (SEP) campaign. The attack was extremely successful and continued to run for at least 15 months without any apparent counter-measures employed by search engines.
Admins of popular movie streaming portal arrested, site shut down
Kino.to, one of the most popular European movie streaming portals, has been shut down following coordinated raids executed by police officers in Germany, France, Spain and the Netherlands.
Citigroup admits breach, warns customers about phishing
Citigroup has finally made public the fact that it suffered a breach into its systems in May and that the names of some 200,000 customers, their account numbers and contact information has been compromised by the attackers.
Trends in the badware landscape
Badware is a defining challenge for individuals, businesses, and governments throughout the world. Cybercriminals have developed a mature badware economy in which individual computers and legitimate, reputable websites are turned into badware distribution vectors, often without the knowledge of their owners.
Plankton Android Trojan found in 10 apps on Android Market
Ten more applications have been pulled from the Google’s official Android Market following a notification that they contained a new kind of Android malware.
Cybercriminals targeting sporting events and music festivals
BitDefender identified a series of scams targeting music festival goers, sporting event fans and holidaymakers this summer.
LulzSec warns NHS about compromised passwords
As a reaction to the “bucket list” of a girl battling Hodgkin’s lymphoma going viral on the Internet and her call to people to donate bone marrow, LulzSec has apparently joined her quest by spreading the word about her blog, the initiative and notifying the UK’s National Health Service of a security issue with one of its databases.
Malware writers rely on users not updating
When infecting PCs, online criminals are increasingly benefiting from uninstalled updates for browsers and their components. Research carried out by G Data SecurityLabs indicates that unclosed security holes in browser plug-ins are very much in fashion with cybercriminals.