Apr 25 2010

Facebook Accounts Hacked; 1.5 Million Login IDs For Sale?

Category: Cybercrime,Security Breach — DISC @ 1:57 am

Russian Hacker ‘Kirllos’ Claims He Stole Accounts of 1 in 300 Facebook Users

By LIZ HERON

Want a great deal on a Facebook account? A Russian hacker who calls himself “kirllos” claims he can sell you 1,000 unsuspecting users’ login credentials for just $25, or $45 if the accounts have more than 10 friends each.

The hacker is believed to have stolen the IDs of 1.5 million Facebook users. If accurate, that means one out of every 300 Facebook users may have been victimized. Kirllos is selling the information on an underground hacker website, according to VeriSign’s iDefense Labs. The cybersecurity company estimates that kirllos has sold around 700,000 accounts so far, but VeriSign was unable to verify if any of the accounts are legitimate accounts belonging to real Facebook users.

Kirllos’ prices are incredibly cheap compared to other scams for sale. E-mail usernames and passwords usually fetch between $1 to $20 each, according to Symantec’s latest Internet Security Threat Report. In contrast, Kirllos is claiming he will sell accounts for as little as 25 cents each.

According to Mashable, hacking Facebook “isn’t a new hobby for this person.” The site has a screenshot of another offer kirllos allegedly made last year when he claimed to be selling 100,000 compromised accounts.

Users whose Facebook ID’s and passwords have been stolen could be vulnerable to identity theft or even “more insidious scams,” Mashable says.

Facebook is investigating the specific accounts kirllos has put up for sale, and will block access to those that have been hacked until they can be restored to their original users, according to Facebook’s Simon Axten.

“We invest heavily in helping people keep their accounts secure and have a team of security professionals who investigate specific attacks on our users and work with law enforcement to pursue those responsible,” Axten said.

Users can find more details the process Facebook uses to spot hacked accounts and go to Facebook’s security page to learn more about protecting themselves online. Here is more information on what to do if your account has been compromised and how to report a hacked account.

Tags: facebook, kirllos, russian hacker

Apr 21 2010

Raid said to have hacked Google password system

Category: Cybercrime — DISC @ 3:30 pm

Google Appliance as shown at RSA Expo 2008 in ...
Image via Wikipedia

John Markoff, New York Times

Ever since Google disclosed in January that Internet intruders had stolen information from its computers, the exact nature and extent of the theft has been a closely guarded company secret.


But a source with direct knowledge of the investigation now says that the losses included one of Google’s crown jewels, a password system that controls access by millions of users worldwide to almost all of the company’s services, including e-mail.


The program, code-named Gaia for the Greek goddess of the earth, was attacked in a lightning raid taking less than two days in December, the source said. The software is intended to enable users to sign in with their password just once to operate a range of services.


The intruders do not appear to have stolen passwords of Gmail users, and the company quickly started making changes to the security of its networks after the intrusions. But the theft leaves open the possibility that the intruders may find weaknesses that Google might not even be aware of, independent computer experts said.


The new details seem likely to increase the debate about the security and privacy of systems that now centralize the personal information of millions of individuals and businesses.


Link to ‘poisoned’ site


The theft began with a single instant message sent to a Google employee in China, according to the person with knowledge of the inquiry, who spoke on the condition he not be identified. By clicking on a link and connecting to a “poisoned” Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google’s headquarters in Mountain View.


Ultimately, the intruders were able to gain control of a software repository used by that team.


Tightening security


The details surrounding the theft of the software have been a closely guarded secret by the company. Google first publicly disclosed the theft in a Jan. 12 posting, which stated that the company was changing its policy toward China in the wake of the theft of unidentified “intellectual property” and the apparent compromise of the e-mail accounts of two human rights activists.


Company executives declined to comment Monday about the new details of the case.


Google continues to use the Gaia password system, now known as Single Sign-On, but has tightened the security of its data centers.


Several technical experts said that because Google had quickly learned of the theft of the software, it is unclear what the consequences of the theft have been. One of the most alarming possibilities is that the attackers might have intended to insert a Trojan Horse – a secret backdoor – into Gaia and install it in dozens of Google’s global data centers to establish clandestine entry points.


This article appeared on page D — 1 of the San Francisco Chronicle on Apr 20, 2010

Cyber War: The Next Threat to National Security and What to Do About It

Tags: china, Gaia, Google, Human rights, Personal computer, Software developer, Trojan horse, Website

Mar 18 2010

Casinos conned by IT hackers

Category: Cybercrime — DISC @ 1:54 pm

Wheel of fortune. Shot wide open using 50mm/f1.
Image via Wikipedia
Casinos conned by IT hackers who printed false betting slips

Humans are the weakest and the strongest link to run computer operated machine. If these two people can create havoc, what do you think the mischief mind of a business owner can do? Think about it when you are back in casino and playing at computer operated poker or black jack machine. I’m sure there are regulations regarding this bamboozling behavior but the key is who is monitoring these casinos, whoever that might be should be totally independent.

“However, the scheme came unstuck after an alert cashier noticed a winning slip for £600 for a £10 bet at odds of 35-1.”

by Telegraph.co.uk
Andrew Ashley, 30, and Nimesh Bhagat, 31, stole more than £33,000 by infiltrating software controlling remote betting machines covering live roulette wheels at four Gala Casinos in London, a court heard.

The pair simply made the machines print out winning vouchers for sums of up to £600, whatever the outcome on the wheel.

But they were caught out when a cashier realised a payout was impossible as only £10 had been wagered at odds of 35-1, Croydon Crown Court was told.

Officials began an inquiry and quickly traced a string of suspicious wins back to the two contractors, who were employed as problem analysts.

Ashley, from south-east London, and Bhagat, from south-west London, were handed 12-month prison sentences, suspended for two years, after each admitting an offence under the Theft Act 1968.

The two men were ordered to undertake 200 hours of community service and pay back around £16,000 each, a police spokesman said.

The convictions are believed to be the first where people have been caught mishandling the computer technology behind Britain’s gaming industry.

They followed an inquiry by officers from Scotland Yard‘s clubs and vice unit into a series of transactions between July 2007 and September 2007.

The scam centred on remote betting terminals at casinos that enable customers to place bets without being at the roulette table.

Those who make winning bets are given a printed ticket with details of their credit that can then be cashed.

Detectives examined computers seized from the men’s homes and looked at CCTV footage that placed the men at the terminals when the offences occurred.

Detective Inspector Ann-Marie Waller said vigilant staff stopped the fraud before hundreds of thousands of pounds were lost.

She said: ”These men not only used their intimate knowledge of two complex systems to break the law and make these fraudulent claims, they also breached the trust of their employers and any semblance of professional integrity.”

Tags: fraud, Gala Coral Group, Gambling, London, Poker, Roulette, Scotland Yard, The Daily Telegraph

Mar 08 2010

Nuke hack attack puts military on high alert

Category: Cybercrime — DISC @ 2:56 pm

Chinese, North Koreans suspects in security breach
By Mike Maloof

WASHINGTON, D.C. – A message that North Korea had conducted a nuclear attack on the Japanese island of Okinawa turned out to be false, but the fact it was delivered via U.S. military communications has prompted a high alert, according to U.S. officials who asked to remain anonymous.

U.S. military channels were hacked either by the Chinese or North Koreans, the source said. Access to such communications – even unclassified military systems – suggests a serious breach of technology security.

A Pentagon spokesman declined comment.

A purportedly “U/FOUO” or “Unclassified but For Official Use Only” message claimed to have been put out Saturday by the Office of National Intelligence and prepared by the Defense Intelligence Agency. It said:

“Today, March 06, 2010 at 11.46 AM local time (UTC/GMT -5 hours),US seismographic stations recorded seismic activity in the area of Okinawa Island (Japan). According to (sic) National Geospatial-Intelligence Agency, Democratic People’s Republic of Korea has carried out an average range missile attack with use of nuclear warhead (sic). The explosion caused severe destructions (sic) in the northern part of the (sic) Okinawa island. Casualties among the personnel of the US military base are being estimated at the moment.”

An analyst noted the grammatical errors suggested the text was written by someone who has not yet mastered the English language use of articles.

The report included a long list of U.S. agencies that should be on alert, from the Central Intelligence Agency, the Department of State and the Department of Homeland Security to the Air Force, Army, Coast Guard, Marine Corps and Navy.

U.S. officials have expressed growing concern over cyber attacks, especially from China. The attacks have targeted not only Google and other Western companies but also the Pentagon.

Chip Gregson, assistant secretary of defense for Asian and Pacific affairs, said that in addition to their nuclear and space programs, the Chinese have undertaken an aggressive cyber assault that presents “an asymmetrical threat to our ways of doing business.”

The latest hacking effort follows urgent warnings that also have gone out through the North Atlantic Treaty Organization to protect all classified databases due to the recent surge of Chinese cyber attacks.

Last Friday, a U.S. report said that the number of cyber attacks on U.S. government agencies and Congress rose exponentially in the past year to an estimated 1.6 billon a month.

Only a few months ago, there were reports that a powerful cyber attack overwhelmed computers at U.S. government agencies and South Korean agencies for several days. The report said the attacks also targeted the White House, Pentagon and the New York Stock Exchange.

Tags: china hack, Chinese cyber attacks, Congress, cyber attacks, Defense Intelligence Agency, north korea hack, NYSE, Okinawa, Pentagon

Mar 05 2010

RSA 2010 and Cybercrime Strategy

Category: Cybercrime,Information Security — DISC @ 2:31 pm

Howard Schmidt
U.S. Cybersecurity Coordinator

In a keynote address at RSA, national cybersecurity coordinator Howard Schmidt announced that the White House was releasing an unclassified version of its plan for securing government and private industry networks which is called Comprehensive National Cybersecurity Initiative, and now available for download from the White House Website (PDF).

Among Schmidt’s priorities are the “resilience” of federal government networks and ensuring those networks are properly secured, and ensuring that private-sector partners also have sufficiently secured systems and networks. “The government is not going to secure the private sector,” Schmidt said. “But we are making sure our private sector partners have more security as part of what we’re doing.”
View Video

Panel Discussion: Big Brother
Panel includes Richard Clark, Michael Chertoff and Marc Rotenberg

Panelists agreed that the U.S. faces rapidly escalating problems with cyber warfare and cyber espionage, data theft and malware attacks on corporations and federal infrastructure that will persist as long as glaring vulnerabilities in government networks remain.

Clarke said that U.S. networks are continually under attack, citing last year’s logic bomb hack on the U.S. electrical grid. Clarke said that the attack indicated the likelihood of future assaults on U.S. infrastructure. “That’s not cyber espionage, that’s preparation for warfare,” he said.

“We’re talking about the cloud as if it’s the most important issue,” Clark continued. “We are being attacked. We’re being attacked by the governments and criminal gangs from China and Russia.”

However, viewpoints diverged on how to address the problem. Rotenberg argued that while U.S. networks are plagued with security holes, imposing sweeping security restrictions, monitoring systems and security policies on users’ online behavior would inevitably create a myriad of privacy issues that could violate Constitutional law.

“Privacy is what ends up being collateral damage,” Rotenberg said. “Every one of those (security) scenarios becomes a justification for some kind of intrusion for the user that has done nothing wrong.”

Clarke suggested that the government have oversight on an outside agency or private organization that would conduct deep packet inspection on tier 1 ISP networks in search of malware.

Rotenberg warned that NSA deep packet inspection could give the agency carte blanche to search for other information and could potentially lead to unlawful surveillance.

“I think we have to be careful if we go down that road,” Rotenberg said. “The folks at NSA are not just interested in looking for malware.”
View Video

Janet Napolitano
U.S. DHS Secretary

US secretary of homeland security Janet Napolitano says a secure cyber environment is as much about people, culture and habit as it is about machines.

“Even the most elegant technological solution will ultimately fail unless it has the support of talented professionals and a public that understands how to stay safe online,” she told the RSA Conference 2010 in San Francisco.

“We need to have an ongoing multifaceted effort with the public at large,” she said, but added that government needs to be mindful of the fact that it is addressing a wide variety of audiences, from teenagers to grandparents.

On the technology side, IT security professionals have an important role to play, she said, in helping to ensure that the information systems are safe and secure by improving the level of performance of the supporting technologies”
View Video

Tags: howard schmidt, Janet Napolitano, Marc Rotenberg, Michael Chertoff, Richard Clark, RSA 2010, San Francisco

Nov 16 2009

Online gangs cash in on swine flu

Category: Cybercrime — DISC @ 2:33 pm

4 28 09 Bearman Cartoon Porky Pig Swine Flu
Image by Bearman2007 via Flickr

The problem is not just buying a fake medicine on the internet, it has a potential of hurting people two ways – it is not the real Tamiflu and we don’t know what’s being falsely market as Tamiflu. DISC

By Kate Kelland Kate
LONDON (Reuters) – Criminal gangs are making millions of dollars out of the H1N1 flu pandemic by selling fake flu drugs over the internet, a web security firm said on Monday.

Sophos, a British security software firm said it had intercepted hundreds of millions of fake pharmaceutical spam adverts and websites this year, many of them trying to sell counterfeit antiviral drugs like Tamiflu to worried customers.

Tamiflu, an antiviral marketed by Switzerland’s Roche Holding and known generically as oseltamivir, is the frontline drug recommended by the World Health Organization to treat and slow the progression of flu symptoms. GlaxoSmithKline makes another antiviral for flu, known as Relenza.

Sophos said many of the gangs behind the sites were based in Russia and the top five countries buying fake Tamiflu and other medicines on the internet were the United States, Germany, Britain, Canada and France.

Sophos spokesman Graham Cluley said a “worrying trend” toward stockpiling Tamiflu had already been seen in Britain — Europe’s worst-hit country in the H1N1 pandemic so far.

“As more and more cases of swine flu….come to light, it is essential that we all resist the panic-induced temptation to purchase Tamiflu online,” he said.

“The criminal gangs working behind the scenes at fake internet pharmacies are putting their customers’ health, personal information and credit card details at risk.”

The Geneva-based WHO, which declared H1N1 swine flu a pandemic in June, updated its guidance to doctors last week to say that antiviral drugs should be given even before tests conclude that an at-risk patient has the pandemic virus.

Sophos said criminal gangs were operating medicines websites branded as the “Canadian Pharmacy” to try to appear genuine.

It said its research showed that on one network operated out of Russia, called Glavmed, it was possible to earn an average of $16,000 a day promoting pharmaceutical websites.

“But the criminals can be members of more than one affiliate network, and some have boasted of earning more than $100,000 per day,” it said in a statement.

The pandemic H1N1 flu virus has now spread to 206 countries since it was first discovered in March. There have been more than 6,250 deaths to date, mostly in the Americas region, according to the latest WHO toll.

Related articles by Zemanta

Reblog this post [with Zemanta]

Tags: Antiviral drug, GlaxoSmithKline, h1n1, H1N1 swine flu, Health, Influenza, Influenza A virus subtype H1N1, pandemic, Relenza, Sophos, Tamiflu, WHO, World Health Organization

Nov 13 2009

Cyber criminals deface 50 to 60 Indian websites a day

Category: Cybercrime — DISC @ 2:52 pm

microsoft_fr_hacked
Image by Clopin via Flickr

Webnewwire.com report submitted on November 11, 2009

Has your girlfriend blocked you and you cant see her on-line? Wondering how to keep your email account protected? Or want to hide files from your annoying siblings? MTV’s got Ankit Fadia – the coolest Ethical Hacker in the world to give you everything from tips, tricks to cheat codes that will help make your life on the world wide web a whole lot simpler. Learn cool stuff that you can with your computers, Internet, mobile and other technology in your life!

This is India’s first tech show which does not review tech gadgets, websites or software instead it gives viewers a low down (or download!) on cool stuff that they can do with technology that will make their every day life cooler, simpler and stylish!

I am hosting “MTV What the Hack!” show with MTV VJ Jose, informed Ankit Fadia who was in city on a private visit. Watch it on MTV India every Saturday @ 8:20 PM. Repeat Telecasts every day, he appealed to the people

The show is a guy show with lots of typical MTV style humour. VJ Jose and Ankit Fadia shoot the episodes without a script and just naturally jam in front of camera and talk about technology. The show has got a very good response so far as it is being different from other shows. Most of the tech shows in India are review based shows where gadgets, software and websites are reviewed. This is the India’s first reach show that actually teaches viewers something. The show is on as part of MTV’s move to beyond music and beyond television. Since October 17 this year dropped ‘Music Television’ baseline which has been there in India for the past 13 years. Music contributes about 40 per cent of its programming and soon will go down to 25 per cent. This is happening as part of repositioning exercise MTV kicked off two years back. MTV is born of music, inspired by music, driven by music –but not limited by music. IT is now about new ideas, new formats, new ways of reaching people in new places they choose to live in.

Addressing the press conference Ankit Fadia spoke on various issues concerning Cyber Security in India. Speaking about Cyber security issues India is facing today he said Pakistani cyber criminals are able to deface 50 to 60 Indian websites a day, but, in retaliation only 10 to 15 Pakistani websites are defaced. And this has been going on since 2001. Nodoubt, India is IT capital of the world, but, as far as security is concerned India is far lagging behind, informed Ankit.

Speaking further he added that Terrorists are using most advanced technologies for communication. Which include mainly VOIP(Voice Over Internet Protocol) Chats, hiding messages inside photographs, draft emails, encrypted pen drives etc are some of the techniques to communicate with each other, he informed.

Cyber laws in India are quite good, b ut the problem is that the police who enforce those laws are ill equipped and are not trained properly. And he challenged media to visit the nearest police station and lodge a cyber crime complaint. And you will shocked that 9 out of 10 times, the officials attending you won’t follow what you are saying, said Ankit.

The biggest problem that the police worldwide face while solving cyber crime is the fact that the Internet has no boundaries, however, while investigating a cyber crime case a number of geographical, political, social and diplomatic boundaries come into the picture.

The next big security threat could be from Social Networking, Ankit declared. Everybody in India is on the social networking bandwagon. Even Karan Johar, Priyanka Chopra, Aishwarya Rai, Shashi Tharoor, Barack Obama and many other celebrities are updating Twitter daily. The latest viruses, worms, spyware and malware spread through social networking websites like Twitter, Facebook, Orkut and Myspace.

You will receive a private message from one of your friend (who is already infected) containing a link to a Youtube video. Halfway through the video, it will prompt you to download some Video Plugin or Code. Since the message came from your friend, most people tend to trust it and get infected!, said Ankit.

There are many financial scams and frauds happening on social networking websites. Get rich quick schemes, Earn Money Online Scams and various money laundering attacks now come to you through a Twitter update or a Facebook wall post!. Since Social Networking websites are all about your friends, many people are susceptible to the attack, Ankit said and added that Antivirus companies need to gear up to have a social networking aspect to them. People need to be made aware of the threats of social networking!

Another next big security threat could be People Hacking, he informed. People Hacking is all about sweet talking people to get things done. Especially things that they would normally don’t do or should not do!. People Hacking happens around us all the time. In the office, with your friends, at the check in counters at the airport or on the phone with the call centre. To carry out People Hacking you need to know what to say to whom and more importantly how to say it. Inducing fear, guilt, sympathy or just overpowering the victim with your words can lead to People Hacking, informed Ankit Fadia.

When asked about advise like Dos and Don’ts for average internet user he listed out the following.

– Use an Antivirus. More importantly, update it every week.

– Use an Anti Spyware. Update it every week.

– Use a Firewall. They are not as technical as they sound. A very good firewall that I recommend is Zone Alarm. Just do a Google search to download it.

– Use a strong password for all your accounts—a combination of alphabets, numbers and special characters. Use both lowercase and uppercase.

– Use Windows Update every fortnight to patch Windows.

– Use a Key Scrambler—a software the scrambles your keys in such a way that key loggers & other spying tools cant record what you type on your computer.

– Use a password on your Wi Fi network.

Related articles by Zemanta

Reblog this post [with Zemanta]

Tags: Aishwarya Rai, Ankit Fadia, Barack Obama, cyber security, facebook, Google, MySpace, pakistan, Priyanka Chopra, Security, social engineering, Social Networking, Twitter, World Wide Web, YouTube

Nov 10 2009

Facebook, MySpace users hit by cyber attacks

Category: Cybercrime — DISC @ 1:27 am

facebook
Image by sitmonkeysupreme via Flickr

NZ HERALD reported that Facebook users – already being targeted in a malware campaign – are now under threat from a phishing scam.

Security specialists Symantec report that the company’s systems have picked up fake messages that appear to be sent by the social networking service.

Users will receive an email that looks like an official Facebook invite or a password reset confirmation.

If a duped user clicks on the ‘update’ button they will be redirected a fake Facebook site. They will then be asked to enter a password to complete the updating process.

As soon as the unwitting Facebook user does this, their password is in the hands of cybercriminals.

Dodgy subject lines for the phishing emails are: ‘Facebook account update,’ New login system’ or ‘Facebook update tool’.

The malware campaign that is still targeting Facebook is also propagated via email. This time, the message looks like a Facebook notification that the recipient’s password has been reset.

It includes a zip file that, if opened, launches an .exe file, which Symantec’s Security Response centre says is a net nasty called Trojan.Bredolab.

Once a users’ machine is infected by this malware, it secretly dials back to a Russian domain and, Symantec says, “is most likely becoming part of a Bredolab botnet.”

But it isn’t just Facebook that is being lined up by cybercriminals, News Corp’s MySpace is also under attack.

Potentially dangerous email subject lines to look out for are: ‘Myspace Password Reset Confirmation,’ ‘Myspace office on fire’ and ‘Myspace was ruined’.

Symantec believes their will be another attack on MySpace in the next day or two. “We also think that social networking sites with huge user bases are currently being targeted to infect maximum machines or gather passwords for more malicious activities in future,” the security team said in a statement.

It advised users to be extra-careful of suspicious attachments, especially those including password reset requests. Legitimate websites will not send an attachment for resetting a password, it said.

– NZ HERALD STAFF

Related articles by Zemanta

Reblog this post [with Zemanta]

Tags: botnet, facebook, Malware, MySpace, News Corporation, phishing, Social network, Social network service, trojan, Website

Oct 23 2009

‘China using elite hacker community to build cyber warfare capability’

Category: Cybercrime — DISC @ 4:44 pm

The Hacker Files
Image via Wikipedia

Hacking: The Art of Exploitation

London, Oct 23 (ANI): The Communist regime in China with the help of a elite hacker community is building its cyber warfare capabilities and appears to be using a long-term computer attack campaign to collect US intelligence.

An independent study released by a congressional advisory panel found cases that suggested that China’s elite hacker community has ties to Beijing, although there is no substantial proof.

The commission report details a cyber attack against a US company several years ago that appeared to either originate in or came through China and was similar to other incidents also believed to be connected to that country, The Telegraph reports.

The data from company’s network was being sent to multiple computers in the US and overseas, according to an analysis done by the company over several days.

The report contends that the attackers targeted specific data, suggesting a very coordinated and sophisticated operation by people who had the expertise to use the high-tech information.

An Internet Protocol (IP) address located in China was used at times during the episode, the paper reports.

The Chinese Government is said to view such cyber prowess as critical for victory in future conflicts, similar to the priority on offensive cyber abilities stressed by some US officials.

Potential Chinese targets in the US would likely include Pentagon networks and databases to disrupt command and control communications, and possibly corrupt encrypted data, the report says. (ANI)

Reblog this post [with Zemanta]

Tags: chinese hacker, cyberwarfare, elite hacker, hacker, hacker files, uber hacker

Oct 19 2009

Hacks hit embassy, government e-mail accounts worldwide

Category: Cybercrime — DISC @ 1:46 pm

1,000,000,000px
Image via Wikipedia
Hacks hit embassy, government e-mail accounts worldwide
By Daniel Goldberg and Linus Larsson
Computer Sweden
August 30, 2007

Usernames and passwords for more than 100 e-mail accounts at embassies
and governments worldwide have been posted online. Using the
information, anyone can access the accounts that have been compromised.

Computer Sweden has verified the posted information and spoken to the
person who posted them. The posted information includes names of the
embassies and governments, addresses to e-mail servers, usernames and
passwords. Among the organizations on the list are the foreign ministry
of Iran, the Kazakh and Indian embassies in the U.S. and the Russian
embassy in Sweden.

Freelance security consultant Dan Egerstad posted the information. He
spoke openly about the leak when Computer Sweden contacted him.

“I did an experiment and came across the information by accident,” he
said.

Egerstad says he never used the information to log in to any of the
compromised accounts in order not to break any laws.

Computer Sweden confirmed that the login details for at least one of the
accounts is correct. Egerstad forwarded an e-mail sent on Aug. 20 by an
employee at the Swedish royal court to the Russian embassy. The person
who sent the e-mail, in which she declines an invitation to the Russian
embassy, has confirmed that she sent the e-mail.

“Yes, that is right. We did decline the invitation. As far as I can
remember I did send the e-mail,” she said.

Computer Sweden has not been able to confirm the authenticity of any of
the other information that has been posted.

“When something like this happens you usually contact people and ask
them to fix it. But in this case it felt too big for that, calling to
other countries,” Egerstad said.

Of the compromised accounts, 10 belong to the Kazakh embassy in Russia.

Around 40 belong to Uzbeki embassies and consulates around the world.

Login details for e-mail accounts at the U.K. visa office in Nepal were
also posted. Login details for the foreign ministry of Iran, the Kazakh
and Indian embassies in the U.S. and the Russian embassy in Sweden were
also posted.

“I hope this makes them take action. Hopefully, faster than ever before,
and I hope they become a bit more aware of security issues,” Dan
Egerstad says.

Computer Sweden has contacted both the Russian and Indian embassies in
Stockholm for comment. The Russian embassy confirmed the leaks and says
that logins have now been changed. The Indian embassy declined to
confirm the information and give comment.

Computer Sweden has not published where the login details can be found.
The information in this story has been verified by Computer Sweden
without using any of the published login details.

Computer Sweden is an InfoWorld affiliate.

Reblog this post [with Zemanta]

Tags: government hack, government security breach, hack attack, Iran, Nepal, Rusia, Security Breach, Stockholm, Sweden

Oct 01 2009

Sophisticated phishing attack and countermeasures

Category: Cybercrime,Email Security,Identity Theft — DISC @ 12:36 am

phishing

Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft

Phishing is a practice of luring unsuspecting Internet users to a fake Web site by using authentic-looking email with the real organization’s logo, in an attempt to steal passwords, financial or personal information. In daily life people advise to retrace your steps when you lose something. The question is how you retrace your steps on cyberspace where some uber hackers know how to erase their footsteps to avoid detection. It is difficult to find phishers in cyberspace, and jurisdictional issues make it even harder to prosecute them. Then there is an issue of trust that phishers dupe people to believe that their web site is not fraudulent to collect personal/financial information.

Below is an example of sophisticated phishing attack
Link to phishing email

It looks very legit, with all the correct data, logos, graphics and signatures.

One giveaway: the TSA rule change has nothing to do with rental cars. It only affects your airline ticket vs your photo ID (drivers license, passport, whatever.)

To verify that this is bad stuff, right click on the links. You get “http://click.avis.com/r/GDYHH9/16HY8/6V5I29/M93XX4/YCCJP/A5/h”, which looks OK on first glance, since it says “avis.com”. But myAvis should not send me to “click.avis.com”. I also noticed that all the other links send you to the same location.

The clincher (here comes the geeky stuff:)

To open a terminal window, press the “Windows key” and the letter “R”.

You will see the “Run Dialog Box”. Type “cmd”, and press “OK

Open a terminal window and run nslookup:

C:\> nslookup
> www.avis.com <<< check IP address of the real AVIS web site Server: 4.2.2.3 Address: 4.2.2.3#53 Non-authoritative answer: www.avis.com canonical name = www.avis.com.edgekey.net. www.avis.com.edgekey.net canonical name = e2088.c.akamaiedge.net. Name: e2088.c.akamaiedge.net Address: 96.6.248.168 <<< get IP address of the real AVIS web site > click.avis.com <<< now check IP address of the bogus AVIS web site Server: 4.2.2.3 Address: 4.2.2.3#53 Non-authoritative answer: click.avis.com canonical name = avis.ed10.net. Name: avis.ed10.net <<< not the same domain as the real AVIS domain Address: 208.94.20.19 <<< note IP address is in a totally different sub net > 208.94.20.19 <<< now do a reverse lookup of the fake AVIS web site Server: 4.2.2.3 Address: 4.2.2.3#53 ** server can't find 19.20.94.208.in-addr.arpa.: NXDOMAIN <<< it should give you the web site name > avis.ed10.net <<< bogus AVIS web site name Server: 4.2.2.3 Address: 4.2.2.3#53 Non-authoritative answer: Name: avis.ed10.net Address: 208.94.20.19 > 208.94.20.19

Moral of the story: be very careful with links in emails and web pages. To check the authenticity of the link, right click on the link, copy that to a text file and take a good look.
Don’t click on the phisher’s email. Type URL into web browser yourself

——————————————————————————————————————————–
In the table below are the 12 threats to your online identity which can be manipulated in phishing scams, and possible countermeasures to protect your personal and financial information. Some threats are inadequate or no security controls in place. The last row of the table is a monitoring control to identify the warning signs of identity theft.
——————————————————————————————————————————–
[TABLE=7]



Download a free guide for the following cloud computing solutions

Hosted email solution
Hosted email archiving
Hosted web monitoring
Hosted online backup

Tags: email archiving, Email Security, Identity Theft, online backup, phishing, phishing countermeasures, phishing threats, web security

Jul 08 2009

Cyber attacks on US Government websites

Category: Cybercrime — DISC @ 4:51 pm

cyberattack
Image by Boyce Duprey via Flickr
Associated Press reported by Hyung-jin Kim, Wed Jul 8 “South Korean intelligence officials believe North Korea or pro-Pyongyang forces committed cyber attacks that paralyzed major South Korean and U.S. government Web sites, aides to two lawmakers said Wednesday.”

See the details at the link below:
Cyber attacks on South Korean and U.S. government Web sites

Information Warfare: How to Survive Cyber Attacks

Cyber Threat

Cyber Security


Tags: cyber attack, cyber attacks, cyber crime, cyber criminals, cyber security, cyber terrorism, cyber threats, Cyber-warfare, cybergeddon

Jun 22 2009

Access to computers on sale

Category: Cybercrime — DISC @ 3:09 pm

Cybercrime

According to SF chronicle article by Deborah Gage (June 17, 2009, c1) a troublesome online network for buying and selling access to infected computers has been discovered by security researchers. The name of the group is GoldenCashWorld which sell access to online infected computers such as web server, mail server, database server etc. Infected computers are utilized to send spam, SQL injections, XSS attacks, buffer overflow attacks and spread viruses and worms.

According to the article this underground network already have access to more than 100,000 websites and 40% of these compromised computers reside in the United States. This is a growing threat to individuals and business assets in United States which should be taken seriously by National Cyber security Divisions.
GoldenCashWorld is a global underground ring which requires an international law to crack this nut.

Online Secure Remote Backup solution
Online crime ring detected
Guide to Computer Forensics and Investigations

Cyber Crime Growing Global Threat
httpv://www.youtube.com/watch?v=ZHmFiueQm5A


Reblog this post [with Zemanta]

Tags: buffer overflow, cyber crime, GoldenCashWorld, NCD, online infected computer, San Francisco Chronicle, Spam, SQL injection, xss

« Previous Page