Infosecurity News
Torrent DDoSer annoys everyone: is he vigilante or spoilt child?
Torrent site what.cd reported on Friday, 9 November (via Twitter) that, “The site, tracker and IRC will be down while we sort out this DDOS...” As of writing (Monday, 12 November), the site is still down, with the finger being pointed at Zeiko.
Microsoft to fix 19 vulnerabilities in six patch bulletins on Tuesday
Four of the six patch bulletins are rated ‘critical’, one is ‘important’ and one is ‘moderate’. Three of the updates will require a system restart, while the remaining three may require a restart. Admins should therefore be prepared for a disruptive time next week.
70% of cloud data centers keep customers in the dark about storage locations
As more companies turn to the cloud to provide redundancy and back-up services for mission-critical business functions, connectivity and applications, new research has revealed that a full 70% of cloud backup providers do not inform customers of where the data is being physically kept.
Security experts increasingly question ‘digital Pearl Harbor’ claims
Ever since Defense Secretary Leon Panetta’s claim that the US was facing a digital Pearl Harbor, a growing number of security experts have begun to question the reality of such threats.
RIM’s BB10 gets a security boost with FIPS 140-2
One day after Research in Motion’s share price tumbled after damning comments from an analyst, the company announced that it has received FIPS 140-2 security certification allowing the BB10 to be deployed by government agencies.
Citadel crimeware kit offers professional-grade theft tools – for a price
Call it malicious software on a hill: a new version of Citadel, the crimeware kit, has emerged to inspire hackers everywhere. That is, if they can infiltrate the Russian underground far enough to locate it and pay the $3,000 entry fee.
GCHQ launches new UK Cyber Incident Response scheme
CESG (Communications-Electronics Security Group) and CPNI (Centre for Protection of National Infrastructure), being arms of GCHQ (Government Communications Headquarters) have today launched a new UK Cyber Incident Response Scheme.
Major breach at Coca-Cola tied to Chinese hacker collective
Details are emerging of a major hack of Coca-Cola by Chinese criminals in 2009, where internal emails and documents were stolen, and malware compromised access to all Microsoft Windows servers, work stations and laptops on the network .
ISF will open up its library to (ISC)² for certification development
Faced with an age of unprecedented growth and scope of cyberthreats, the Information Security Forum (ISF) has reached an agreement with the (ISC)² to provide its extensive research library for use in development of (ISC)² examinations and official education materials, significantly broadening the reach of the information and, hopefully, threat awareness.
Lawsuit for South Carolina tax agency breach expands to security firm
In the wake of a massive security breach at the South Carolina tax collection agency, a former South Carolina state senator has expanded a class-action lawsuit over the exposure of millions of state tax returns to include those responsible for providing security: Trustwave and the Division of State Information Technology (DSIT).
Lumension buys CoreTrace – adds Bouncer whitelisting to its portfolio
Lumension announced yesterday that it has completed the acquisition of CoreTrace IP, suggesting that it was prompted by growing concerns over APTs and increasing interest in whitelist defenses.
New Gh0st-related malware discovered
New malware, backdoor.ADDNEW, has been identified. It is based on the Russian DaRK DDoSer malware and has a surprising link with the Gh0st RAT trojan.
NullCrew hacks MoD – leaks thousands of plaintext credentials
NullCrew remembered the 5th of November by breaking into mod.co.uk and stealing and dumping more than 3400 email addresses and passwords. While the date of the breach cannot be verified, it does look as if it happened on the Guy Fawkes anniversary.
UK public sector tops £2m in data handling fines
Public sector organizations in the UK are leaking money thanks to a full £2 million in fines that councils, the NHS, police forces and others have seen in response to poor data handling.
Apple releases update for iOS addressing iPhone, iPad critical flaws
Apple has released a new iOS, version 6.0.2, that addresses a handful of vulnerabilities in the system affecting iPhone 3GS and later, the iPod touch fourth generation and later, and the iPad 2 and later devices.
Team GhostShell declares war on Russia – leaks 2.5 million records
Announcing its Project Hellfire back in August, hacking group Team GhostShell warned, “Two more projects are still scheduled for this fall and winter. It's only the beginning.” Now it introduces Project BlackStar with an initial leak of 2.5 million records stolen from Russian organizations.
ASIS revamps POA reference for security professionals
Security professional organization ASIS International has released a new edition of its Protection of Assets (POA) reference series, to dovetail with its 35h certification program anniversary and a stepped-up focus on global collaboration.
Georgia: Russia responsible for Georbot cyber-spy attack
In a testament to the ever-changing nature of state-sponsored cyber-espionage, the governmental Computer Emergency Response Team (CERT) of the Republic of Georgia has published a breakdown of the so-called “Georbot Botnet,” a campaign carried out against the Georgian government using malware that infected machines primarily via hacked news sites.
Megaupload takedown demonstrates the danger of storing data anywhere in the cloud
The Electronic Frontier Foundation (EFF) has warned about US government claims that a Megaupload user lost his property rights by using cloud storage has implications for all data stored by any user or company with any cloud provider, including Amazon’s S3, Google Apps or Apple iCloud.
As the cloud expands, CSA offers guidance for Security as a Service
The Cloud Security Alliance (CSA) has released the Security Information and Event Management (SIEM) guidance report as part of its Security as a Service (SecaaS) Implementation Guidance.
