Sri Lankan Teenager Hacks President's Website
- A 17-year-old teenager accused of hacking into President Maithripala Sirisena’s official website and posting a message calling for the postponement of A-level examinations.
- The boy was taken into custody on Monday under computer crimes laws and on conviction faces a fine of $2,000 and up to three years in jail.
- The attacker had removed the home page and replaced it with a demand that the president postpone the on-going GCE Advanced Level examinations or step down.
- Sri Lankan websites had been hacked in the past but this is the first time a teenager has been arrested under 2007 laws against computer crimes.
Source: The Guardian, August 30, 2016
Unmodified USB Devices Allow Data Theft From Air-Gapped Systems
- Researchers have demonstrated how an unmodified USB device can be turned into a radio frequency transmitter and leveraged to exfiltrate potentially sensitive data from air-gapped computers.
- NSA documents leaked in 2013 showed that the agency’s toolset included such capabilities.
- USB is designed to leverage the USB data bus to create electromagnetic emissions from a connected device.
- The malware can modulate binary data over the electromagnetic waves and send it to a nearby receiver.
- In their experiments, researchers used a $30 RTL-SDR software-defined radio connected to a laptop and managed to transfer data at rates of up to 80 bytes per second.
- This is a fairly high transfer rate that can allow the malware to transfer strong passwords and encryption keys within seconds.
Source: Security Week, August 30, 2016
Dropbox Hackers Stole 68 Million Passwords
- A huge cache of personal data from Dropbox that contains the usernames and passwords of nearly 70 million account holders has been discovered online.
- Dropbox confirmed that the credentials were stolen in a hack that occurred in 2012 when hackers used stolen employee login details to access a document containing the email address and passwords of users.
- The number of users affected by the hack was not known until now, and the company had previously said only email addresses were taken - not passwords.
- The company discovered the details for sale online when it was conducting routine security work.
- Dropbox, which has around 500 million registered users, is the fourth major company this year to have found user credentials stolen in a 2012 hack circulating online.
- MySpace and LinkedIn both confirmed in May that hundreds of millions their users' of passwords and email addresses stolen in 2012 hacks were for sale online.
Source: Telegraph, August 31, 2016
In Information Security, the Only Constant Is Change
- As the Greek philosopher Heraclitus famously noted, “The only constant is change.”
- The world around us changes constantly, often times at a somewhat frenetic pace.
- One unfortunate side effect of continual change can be called “shiny object syndrome” (SOS).
- As you might imagine, there are some organizations, and indeed some people, that seem to run continually from one “shiny object” to another.
- Hype, buzz, and trends change constantly, but the fundamentals of a good security program stay the same.
- The top five ways organizations can stay grounded and focused are: stick to the plan, focus on risk, prioritize holes to plug, go beyond the buzz, and measure what matters.
Source: Security Week, August 31, 2016
Sensitive User Data Exposed In OneLogin Breach
- Identity management firm OneLogin informed customers that some of the information they stored on the company’s servers may have been accessed by hackers.
- The breach is related to Secure Notes, a feature that allows users to store sensitive information such as passwords and license keys.
- While these notes are protected using multiple levels of AES-256 encryption, a bug caused the data to be visible in clear text in OneLogin’s log management system before it was encrypted and stored in the database.
- OneLogin, which has over 1,400 enterprise customers in 44 countries around the world, says there is no evidence that other systems have been compromised.
- The investigation so far revealed that the attacker had access to the log management system.
- OneLogin started notifying impacted customers, after the initial scope of the incident was established.
Source: Security Week, August 31, 2016
Banks Urged To Tighten Security As Hacks Continue
- SWIFT, the messaging network that connects the world's banks, says it has identified new hacks targeting its members, and it is warning them to beef up security in the face of "ongoing attacks."
- The warning follows cyber-attacks on banks in Bangladesh, Vietnam, the Philippines and Ecuador in which malware was used to circumvent local security systems, and in some cases, steal money.
- An attack on Bangladesh's central bank yielded $101 million, Ecuador's Banco del Austro was also hit for $12 million.
- The company says that its network and core messaging services have not been compromised by the attacks.
- SWIFT is taking extra measures to secure client banks, including supporting security audits and introducing tougher requirements for local bank computer networks.
- Cybersecurity researchers have suggested that a hacking team known as "Lazarus" is responsible for the attacks.
Source: Money.CNN, August 31, 2016