Week in review: Zappos, Symantec breaches, identities of Koobface gang revealed, and Megaupload shutdown
Here’s an overview of some of last week’s most interesting news and podcasts:
Google Docs hosted phishing schemes abound
Sophos has recently spotted two distinct phishing campaigns – one targeting the customers of the Australian ANZ Bank and the other the users of a web portal of a North American school – where the phishing forms are hosted this Google service.
Zappos hacked, info of 24+ million customers may be compromised
Zappos, the shoe-and-apparel-selling division of Amazon, has been hit by cyber attackers and has had one of its servers compromised and information from it exfiltrated.
Hackers breach T-Mobile Web server, leak staff data
A Web server hosting part of T-Mobile’s official website has apparently been compromised by TeaMp0isoN, a hacker collective associated with Anonymous, and some of the information hosted on it was stolen and made public on Pastebin.com.
San Francisco City College systems infected for over a decade
Computers and servers of the City College of San Francisco have been discovered to be infected with a myriad of computer viruses and information-stealing malware, and some of the infections can be traced as far back as the last century.
PCI pitfalls for retailers
Nine common PCI DSS compliance pitfalls that many retailers fall into and tips to avoid them.
Brazen Brazilian hackers opening cybercrime schools
The relaxed attitude regarding the possibility of getting caught and tried for their illegal actions is due to the country’s extremely inadequate anti-cybercrime laws, explains Kaspersky Lab’s Fabio Assolini, who recently spotted another business venture initiated by the criminals.
Hackers steal $6.7 million in bank cyber heist
A perfectly planned and coordinated bank robbery was executed during the first three days of the new year in Johannesburg, and left the targeted South African Postbank – part of the nation’s Post Office service – with a loss of some $6.7 million.
Fake browser plug-in “shares” Facebook scam
Facebook survey scams mostly follow the same pattern: they lure users in with offers of watching a funny/amazing/adult-themed video, directly ask them to “share” and “like” it, then complete a survey in order to be able to watch it. But every once in a while, a slightly different approach is used.
Google tests QR code-based authentication
The option is thought to have been devised for allowing users to log in on public computers, which are likely to be infected with keyloggers or information-stealing malware.
Global view into application usage
New research published by Palo Alto Networks indicates explosive growth in global social networking and browser-based file sharing on corporate networks, with a 300 percent increase in active social networking compared with activity during the same period in the latter half of 2010.
Symantec admits its networks were hacked and source code stolen
After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems.
Questioning of incoming data crucial for security awareness
In this podcast recorded at RSA Conference Europe 2011, Hugh Thompson, Program Committee Chair for RSA Conferences and Chief Security Strategist at People Security talks about a new breed of attackers and why the need for security awareness is now bigger than ever.
Trojan steals e-cash vouchers from Facebook users
Recently, Trusteer came across a new configuration of the Carberp Trojan that targets Facebook users to commit financial fraud. Unlike previous Facebook attacks designed to steal user credentials from the log-in page, this version attempts to steal money by duping the user into divulging an e-cash voucher.
Twitter users targets of social spear phishing
Websense monitored Twitter in January and found that users were publicly sharing email addresses connected with their inboxes, social media identities, and bank accounts – leaving them open to advanced social spear phishing attacks.
SharePoint users develop insecure habits
Microsoft SharePoint users are aware of the risks that exposing sensitive data can cause to their organization, yet unbelievably they are using the collaboration tool as an excuse to turn a blind eye.
Koobface botnet goes down, suspects scurry to erase track
As the names of the five individuals believed to be behind the Koobface botnet were revealed on Tuesday, their reaction was almost immediate and seems to validate the researchers’ findings.
Leading CSOs outline roadmap to combat advanced threats
RSA released new insights from a group of the world’s leading CSOs, designed to help corporations and governments improve visibility into advanced threats ranging from industrial espionage and disruption of business and financial operations to sabotage of corporate infrastructure.
Megaupload shuttered, founders arrested, Anonymous retaliates with DDoS attacks
As the Internet-wide blackout in protest of the anti-piracy PIPA and SOPA legislations was slowly winding down, US authorities have announced the seizure and takedown of Megaupload, one of the most popular online file-sharing services.
Programmer steals US government software source code
A Chinese computer programmer has been arrested in New York for having allegedly copied and stolen the source code of software developed by the US Treasury Department.
Mozilla offers alternative to OpenID
Mozilla has been working for a while now on a new browser-based system for identifying and authenticating users it calls BrowserID, but its only this month that all of its sites have finally been outfitted with the technology.