The United States Navy is investigating whether the recent collision of the USS John S. McCain with a Liberian tanker off Singapore may have been caused by a cyber-attack.
Read the Full Article here: >Computer Security News
Canadian university scammed out of $11.8 million
MacEwan University in Edmonton, Alberta, is the latest confirmed victim of scammers.
“On Wednesday, August 23, MacEwan University discovered it had been the victim of a phishing attack. A series of fraudulent emails convinced university staff to change electronic banking information for one of the university’s major vendors. The fraud resulted in the transfer of [Canadian] $11.8 million to a bank account that staff believed belonged to the vendor,” the Canadian university shared.
After the fraud was discovered, the university conducted an audit of business processes through its internal audit group and with the help of outside experts.
“Preliminary assessment has determined that controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed,” they noted.
Since them, additional controls were put in place to prevent further incidents.
Once the fraud was discovered after the real vendor complained of non-payment, the accounts to which the funds were sent were traced to Canada and Hong Kong, and local law enforcement agencies were contacted.
Corporate security units of banks involved with the e-transfers were also notified, and they managed to freeze the funds. The university is working with legal counsel in Montreal, London and Hong Kong to pursue civil action to recover the money.
No further details about the phishing attack were revealed, but it’s obvious this is a variant of the business email compromise (BEC) scam: the so-called “payment instruction switch” or “the supplier swindle.”
“There is never a good time for something like this to happen,” said university spokesman David Beharry, “but as our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident. Personal and financial information, and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way.”
Read the Full Article here: >Help Net Security – News
Want To Try Hacking Computers Legally? Here’s How
Have you ever fancied yourself as a computer hacker or penetration tester? Have you ever read about hacking and wondered just how easy or hard it would actually be to achieve?
Of course, hacking someone else’s computer without their permission is illegal pretty much everywhere. And setting up a network of computers yourself, purely to hack them, is time-consuming. But thankfully there’s another way.
Hack The Box is a network of computers which has been set up for you to hack. It’s all legal, and the idea is to allow people to test their technical skills and techniques. It’s also free to use, and good fun. But be aware that it’s aimed at people with a good deal of technical knowledge (or those who think they have it!). Read More
Read the Full Article here: >Gizmos Freeware Reviews
Oops! WikiLeaks Website Defaced By OurMine
OurMine is in headlines once again—this time for defacing
website.
The notorious hacking group, OurMine, is known for breaching into high-profile figures and companies’ social media accounts, including Facebook CEO
, Twitter CEO
, Google CEO
,
,
and Sony’s
(PSN).
According to screenshots circulating on
, the official website of WikiLeaks has reportedly been defaced by the OurMine hacking group, who left a message on the site, as shown above.
WikiLeaks is a whistleblowing website that since March, has been revealing top CIA hacking secrets under
, including the agency’s ability to break into
and
, security camera
,
and many more.
There is no indication of WikiLeaks servers and website been compromised, instead it seems their website has been redirected to a hacker-controlled server using DNS poisoning attack.
In DNS poisoning attack, also known as DNS spoofing, an attacker gets control of the DNS server and changes a value of name-servers in order to divert Internet traffic to a malicious IP address.
Shortly after the defacement, the site administrators regained access to their DNS server and at the time of writing, the WikiLeaks website is back online from its official legitimate servers.
OurMine is a Saudi Arabian group of hackers which claims to be a “white hat” security firm.
The group markets itself by taking over social media accounts of high-profile targets and then encourages them to contact the hacking group to buy its IT security service in an effort to protect themselves from future cyber attacks.
Read the Full Article here: >The Hacker News [ THN ]
Someone Published a List of Telnet Credentials For Thousands of IoT Devices
An anonymous reader writes: A list of thousands of fully working Telnet credentials has been sitting online on Pastebin since June 11, credentials that can be used by botnet herders to increase the size of their DDoS cannons. The list includes an IP address, device username, and a password, and is mainly made up of default device credentials in the form of "admin:admin", "root:root", and other formats. There are 33,138 entries on the list, which recently became viral on Twitter after several high-profile security experts retweeted a link to it. During the past week, a security researcher has been working to find affected devices and notify owners or their ISPs. Following his work, only 2,174 devices still allow an attacker to log on via its Telnet port, and 1,775 of the published credentials still work. "There are devices on the list of which I never heard of," the researcher said, "and that makes the identification process much slower."
Read more of this story at Slashdot.
Read the Full Article here: >Slashdot: News for nerds, stuff that matters
SAP point-of-sale systems were totally hackable with $25 kit
Point-of-Sale systems from SAP had a vulnerability that allowed them to be hacked using a $25 Raspberry Pi or similar device, according to research unveiled at the Hack in the Box conference in Singapore last week.
Critical vulnerabilities in SAP’s POS – since resolved – created a means for hackers not only to steal customers’ card data but to gain unfettered control over the server, enabling them to change prices of goods with the help of a simple device, according to ERPScan.
Read the Full Article here: >Hack In The Box
Hacking a Phone Through a Replacement Touchscreen
Researchers demonstrated a really clever hack: they hid malware in a replacement smart phone screen. The idea is that you would naively bring your smart phone in for repair, and the repair shop would install this malicious screen without your knowledge. The malware is hidden in touchscreen controller software, which is trusted by the phone.
The concern arises from research that shows how replacement screens — one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0 — can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it.
Academic paper. BoingBoing post.
Read the Full Article here: >Schneier on Security: Cybercrime Paper
Thousands of ATMs Go Down in Indonesia After Satellite Problems
Thousands of ATMs and electronic card payment machines in Indonesia went offline over the weekend, and it might take two more weeks before full service is restored, after an outage from a satellite belonging to state-controlled telecom giant PT Telekomunikasi Indonesia (Telkom). From a report: Around 15,000 ground sites across Indonesia were affected by the problem on the ‘Telkom-1’ satellite, whose service is used by government agencies, banks, broadcasters and other corporations, Telkom’s president director Alex Sinaga told reporters on Monday. A shift in the direction of the satelliteâ(TM)s antenna, which was first detected last Friday, had disrupted connectivity. Bank Central Asia (BCA), Indonesia’s largest bank by market value, had around 5,700 of its ATMs affected by the outage, or 30 percent of the total operated by the bank, BCA chief executive Jahja Setiaatmadja told reporters. The Internet connection in some remote BCA branches were also affected, he said.
Read more of this story at Slashdot.
Read the Full Article here: >Slashdot: News for nerds, stuff that matters
FIR (Fast Incident Response) – Cyber Security Incident Management Platform
FIR (Fast Incident Response) is a cyber security incident management platform designed for agility and speed. It allows for easy creation, tracking, and reporting of cybersecurity incidents.
In the fields of computer security and information technology, computer security incident management involves the monitoring and detection of security events on a computer or computer network, and the execution of proper responses to those events. Computer security incident management is a specialized form of incident management, the primary purpose of which is the development of a well understood and predictable response to damaging events and computer intrusions.
Source: Wikipedia
FIR is for anyone needing to track cyber security incidents (CSIRTs, CERTs, SOCs, etc.). It’s was tailored to suit our needs and our team’s habits, but we put a great deal of effort into making it as generic as possible before releasing it so that other teams around the world may also use it and customize it as they see fit.
You can also check out Fully Integrated Defense Operation (FIDO) – Automated Incident Response and FastIR Collector – Windows Incident Response Tool.
FIR Cyber Security Incident Management Features
Here are the available fields:
- Subject: short description of your incident. The one that will appear on event tables.
- Business Lines: entities concerned by this incident. You choose what you make of business lines: internal department, customers, etc.
- Category: category of the incident (ex: phishing, malware). Categories are also customizable in the admin panel.
- Status: can take three values: Open, Closed and Blocked. These are all labels defined in the admin panel
- Detection: how the incident was detected. Default values: CERT, External, Poleand Group. These values can be changed in the admin panel in the labels section
- Severity: from 1 to 4.
- Date / Time: date and time of the incident
- Is an incident: differentiates between an event and an incident
- Description: free-form text describing the event
When you are dealing with cybersecurity incident management, the following additional fields are available. These fields are only used for display and statistics:
- Actor: who is the leader on this incident management? Default values are CERT and Entity
- Plan: what is the named remediation plan used?
- Confidentiality: from C0 to C3
You can download FIR for cyber security incident management here:
Or read more here.
Read the Full Article here: >Darknet – The Darkside
Simple Exploit Allows Attackers to Modify Email Content — Even After It’s Sent!
Security researchers are warning of a new, easy-to-exploit email trick that could allow an attacker to turn a seemingly benign email into a malicious one after it has already been delivered to your email inbox.
Dubbed Ropemaker (stands for Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky), the trick was uncovered by the researchers at email and cloud security firm Mimecast.
A successful exploitation of the Ropemaker attack could allow an attacker to remotely modify the content of an email sent by the attacker itself, for example swapping a URL with the malicious one.
This can be done even after the email has already been delivered to the recipient and made it through all the necessary spam and security filters, without requiring direct access to the recipient’s computer or email application, exposing hundreds of millions of desktop email client users to malicious attacks.
Ropemaker abuses Cascading Style Sheets (CSS) and Hypertext Markup Language (HTML) that are fundamental parts of the way information is presented on the Internet.
“The origin of Ropemaker lies at the intersection of email and Web technologies, more specifically Cascading Style Sheets (CSS) used with HTML,” Mimecast’s Senior Product Marketing Manager Matthew Gardiner writes in a blog post.
“While the use of these web technologies has made email more visually attractive and dynamic relative to its purely text-based predecessor, this has also introduced an exploitable attack vector for email.”
Since CSS is stored remotely, researchers say an attacker can change the content of an email through remotely initiated changes made to the desired ‘style’ of the email that is then retrieved remotely and presented to the user, without the recipient, even tech savvy users, knowing about it.
According to the researchers, the Ropemaker attack could be leveraged depending upon the creativity of the threat actors.
For instance, attackers could replace a URL that originally directed the user to a legitimate website by a malicious one that sends the user to a compromised site designed to infect users with malware or steal sensitive info, such as their credentials and banking details.
While some systems are designed to detect the URL switch preventing users from opening up the malicious link, other users could be left at a security risk.
Another attack scenario, called “Matrix Exploit” by the Mimecast, is more sophisticated than the “Switch Exploit”, and therefore much harder to detect and defend against.
In a Matrix Exploit attack, attackers would write a matrix of text in an email and then use the remote CSS to selectively control what is displayed, allowing the attacker to display whatever they want—including adding malicious URLs into the body of the email.
This attack is harder to defend against because the initial email received by the user does not display any URL, most software systems will not flag the message as malicious.
“Since the URL is rendered post-delivery, an email gateway solution such as Mimecast cannot find, rewrite, or inspect the destination site on-click, because at the time of delivery there would be no URL to detect,” the report reads. “To do so would require the interpretation of CSS files, which is beyond the scope of current email security systems.”
Although the security firm has not detected the Ropemaker attack in the wild, it believes that this doesn’t mean for sure the attack is “not being used somewhere outside the view of Mimecast.”
According to the security firm, Ropemaker could be used by hackers to bypass most common security systems and trick even the tech savvy users into interacting with a malicious URL.
To protect themselves from such attacks, users are recommended to rely on web-based email clients like Gmail, iCloud and Outlook, which aren’t affected by Ropemaker-style CSS exploits, according to Mimecast.
However, email clients like the desktop and mobile version of Apple Mail, Microsoft Outlook, and Mozilla Thunderbird are all vulnerable to the Ropemaker attack.
Read the Full Article here: >The Hacker News [ THN ]