Hacking News

Personal Information of 123,000 US Government Employees Stolen

Posted by J-admin

Posted on -

Personal Information of 123,000 US Government Employees Stolen

Personal information of over 123,000 federal employees have been exposed after a cyber attack in last July. The cyberattack occurred against a Thrift Savings Plan (TSP) contractor, Serco Inc. The FBI notified both Serco and the TSP last month about the attack. According to the Guardian has called Serco "probably the biggest company you have never heard of." It's on the FTSE 100 (Big!), has 100,000 employees and operates everything from railways in the UK and Australia to driver licensing in Ontario, Canada to retirement accounts for US government employees, members of the armed forces and US Postal Service workers. Perhaps taking advantage of the holiday weekend in the United States, Sercoannounced this morning that hackers had compromised systems at its Thrift Savings Plan (TSP) operation.

After extensive forensic investigation it was determined that 43,000 members' names, addresses and Social Security Numbers had been accessed by the intruders, and the Social Security Numbers of another 80,000 may have been involved.

"Serco regrets this incident and the inconvenience it may cause to some Thrift Savings Plan participants and payees whose personal data was involved," said Serco Chairman and CEO Ed Casey in the statement. "We have fortified our information security measures and cyber defenses."

Further information has been published that shows the original intrusion into Serco's system occurred in July 2011. Information that was accessed has been available to criminals for nearly a year before Serco was notified by the FBI.

[......]

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

Posted by J-admin

Posted on -

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

POSTED BY VOGH REPORTER ON 6/09/2012 07:00:00 PM

Dating Site eHarmony Hacked, 1.6 Million Password Stolen

After LinkedIn now cyber criminals targeted one of the famous dating site eHarmony and stolen more than1.6 millions of passwords from the database. The authority has admitted that its password database has been compromised, with around 1.5 million hashed passwords being found in the wild. The leaked database that appeared in public contained unsalted MD5 hashed passwords and was reported to not contain any identifying user-names or email addresses. According to the sources all the password hashes has been randomly submitted to some underground hacker's forum where a user asked for help in cracking the hashes. This help was collectively given by the forum members who were then reportedly given the LinkedIn hashed passwords to work on. After the primary investigation eHarmony confirmed that a small fraction of user database has been affected. And affected members password has already been reset. eHarmony did not give any details of how the passwords were leaked and says they will continuing to investigate what happened.

[......]

LinkedIn Hired FBI To Investigate on Password Theft Issue

Posted by J-admin

Posted on -

LinkedIn Hired FBI To Investigate onPassword Theft Issue

Few days ago one of world's popular social networking site LinkedIn faced cyber attack where it has been confirmed that more than 6.5 millions of hashed passwords get exposed and among them hackers able to decrypt those hashes into plain text. After this scenario now LinkedIn Corporation confirmed that they are working with the FBI to investigate that cyber attack. In their official blog LinkedIn announced that they are working with law enforcement to find more information about the recent hacking. The company does not know of any accounts that were taken over as a result of the security violations, according to LinkedIn spokesman Hani Durzy. A spokeswoman with the FBI declined to comment. LinkedIn is still in the early stages of the investigation. Durzy said it was not yet determined whether the email addresses that corresponded to the hacked passwords were also stolen. LinkedIn is requiring all users whose passwords were compromised to change their passwords, and in its post Thursday, it announced that it also would lock out additional users who may have been affected until they changed their passwords as well. "Since we became aware of this issue, we have been taking active steps to protect our members," the company said in its post. "Our first priority was to lock down and protect the accounts associated with the decoded passwords that we believed were at the greatest risk." LinkedIn has yet to say how the hacker accessed its users' passwords and what other information may have been accessed. It also did not address complaints of phishing scams targeting its users after the hacking attack. But the FBI authority did not respond to requests for comment on this particular topic.

[......]

Save The Children

Posted by J-admin

Posted on -

[......]

Critical Security Holes In Oracle Database

Posted by J-admin

Posted on -

A serious vulnerability found by security researchers on oracle databases. An attacker can perform SQL injection attacks and other advanced attacks, thus they can gain full privilege & traction said security researchers. Is Oracle just paying lip service to database security? Some researchers within the database community think so, complaining that as the software juggernaut has grown with acquisitions, such as the blockbuster Sun deal, it hasn't maintained enough resources to securely develop database products and resolve vulnerabilities disclosed by researchers in a timely fashion.

"I would say easy fixes get done pretty quickly, within three to six months, but things that are harder and need some changes in architecture or have an impact on customers where customers have to make some changes to their products, to their software that uses the databases, those things don't get done in the CPU," said Alex Rothacker, manager of Application Security's research arm, TeamSHATTER. "We have a vulnerability disclosed where basically we can brute force any user's password ... we reported this two years ago and they haven't fixed it yet."

It's a complaint lodged by many researchers, who say that even as Oracle publicly states it wants to work with the research community to fix database issues, it isn't putting its shoulder into the effort. The numbers show that the proportion of quarterly critical patch updates for Oracle database products has diminished considerably over the last two years.

While some might come to the conclusion that there are fewer updates because Oracle's products are getting more secure, researchers say this trend has occurred simultaneously as the window between disclosure of vulnerabilities and patch releases for them has grown wider.

"They respond immediately and say 'Thank you very much for the information' and so on, but it sometimes takes more than a year to actually release a patch," said Slavik Markovich, VP and CTO of database security for McAfee. "I get the feeling that they don't invest enough or have enough people working on this so it takes a long time to patch." In the meantime, too, new database products--some of them security related, even--are released with the same type of vulnerabilities that researchers have been alerting Oracle to for years.

[......]

Porn & Gore Exploit Hit Facebook (Question Arises That Anonymous is Behind this Attack)

Posted by J-admin

Posted on -

Facebook users facing Facebook Porn and Gore Exploit. The content, which includes explicit hardcore porn images, photoshopped photos of celebrities such as Justin Bieber in sexual situations, pictures of extreme violence and even a photograph of an abused dog, have been distributed via the site - seemingly without the knowledge of users.

Facebook users’ outrage is mounting toward the social network for an exploit that is currently turning unsuspecting users’ newsfeeds into unstoppable torrents of hardcore pornography and gory, violent pictures. It started a few days ago, and right now is becoming an out of control exploit that has users angry and disgusted, while seemingly mocking Facebook’s notorious conservative content controls.

The onslaught has many asking the question if this is a delayed attack originally set for November 5th by the online hacker group 'Anonymous'.

[......]

City Bank CEO's Personal Information Exposed By CabinCr3w (Hacktivists)

Posted by J-admin

Posted on -

Hacktivists have published a dossier of personal information on the head of Citigroup in retaliation for the cuffing of protesters at an Occupy Wall Street demo.
Members of a group called CabinCr3w, a hacking gang affiliated with Anonymous, revealed phone numbers, an address, email address and financial information on Vikram Pandit, Citigroup's chief executive officer. The expose follows the arrest of a group of anti-capitalist protesters who allegedly sparked a ruckus inside a Citibank branch while withdrawing funds and closing their accounts. Previously more than 200K customer accounts was stolen from Citibank. About 24 people were detained and charged with criminal trespass on Saturday afternoon.
In a statement, Citibank said only one of the protesters was actually trying to close an account, a request that it said was accommodated. The rest of the group were causing a nuisance and were repeatedly asked to leave before the New York City plod were called.
CabinCr3w previously published the personal information on the chief executives of JP Morgan Chase and Goldman Sachs. It also published the details of an NYPD officer accused of pepper-spraying Occupy Wall Street protesters.

[......]