Blog close up

To wrap up, the following are list of the topics posted on this blog over the last 11 weeks 

Week 1: Introduction
Week 2: Privacy Fears Cause More to Cover Online Tracks
Week 3: Exploiting the iPhone
Week 4: Revealed: how US and UK spy agencies defeat internet privacy and security
Week 5: A lock screen vulnerability in the new ios 7 leaves users' e-mail, photos, twitter, and  other apps open to being used without permission
Week 6: FBI Warns Public That Cyber Criminals Continue to Use Spear-Phishing Attacks to Compromise Computer Networks
Week 7: WhatsApp Web site hijacked, shows pro-Palestinian message
Week 8: Hackers Target Java 6 with Security Exploits
Week 9: Aaron's computer rental chain settles FTC spying charges
Week 10: Adobe hack attack affected 38 million accounts

Week 11: Ec-council president blames cisos for industry skills gap

Week 12: Hackers steal more than a million dollars worth of Bitcoin

It was an excellent experience creating a blog and posting different articles related to current information security issues. I learned a lot from what is happening in today’s information security and I hope everyone will learn from the information posted on this blog. This block will be a good resource to all individuals who uses internet, it is critical to understand how important it is to secure our electronic devices against hackers.

Various Information Security websites were used in gathering information   to post on my blog, however, extra Credits go to http://news.cnet.com , and it is a very good website for information Security news.

 

 

 

Hackers steal more than a million dollars worth of Bitcoin

It was reported on SC Magazine that Bitcoin eWallet Inputs.io service was hacked and left unable to pay an undisclosed number of user balances of about $1.1 million.

According to a post on the Inputs.io website, “The attacker compromised the hosting account through compromising email accounts (some very old, and without phone numbers attached, so it was easy to reset).”

The wallet claims that the attackers are the same ones who managed to hack “GigaDice, another Bitcoin service. The web wallet notes that the hackers managed to gain access to the database, but stresses that passwords are secure as they are hashed on the client. “Bitcoin backend code were transferred to 10;15Hd@mastersearching.com:mercedes49@69.85.88.31

Source:

http://www.scmagazine.com/hackers-steal-more-than-a-million-dollars-worth-of-bitcoin/article/320244/

http://www.techienews.co.uk/972801/secure-bitcoin-wallet-inputs-io-hacked-unable-pay-user-balances/

ADOBE HACK ATTACK AFFECTED 38 MILLION ACCOUNTS

Here is the recent security breach that hit Adobe exposed customer IDs, passwords, and credit and debit card information.

On October 3, Adobe revealed that it had been the victim of an attack that exposed its customers’ IDs and encrypted passwords. Adobe issued the statement:

“Our investigation currently indicates that the attackers accessed Adobe customer IDs and encrypted passwords on our systems. We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders. At this time, we do not believe the attackers removed decrypted credit or debit card numbers from our systems”.

The company said that hackers gained access to encrypted credit card records and login information for around 3 million users. But the number of affected accounts has turned out to be much higher.

Heather Edell Adobe spokesman told CNET that the investigation confirmed that the attackers obtained access to Adobe IDs and encrypted passwords for approximately 38 million active users,” he reported that the Adobe have reset the passwords for all Adobe IDs with valid, encrypted passwords that they believe were involved in the incident -- regardless of whether those users are active or not."

Following the initial report of the attack, Adobe reset the passwords on compromised customer accounts and sent e-mails to those whose accounts were breached and whose credit card or debit card information was exposed.

Source: http://news.cnet.com/8301-1009_3-57609753-83/adobe-hack-attack-affected-38-million-accounts/

Aaron's computer rental chain settles FTC spying charges

Today, security is a main concern to all of us due to a high development of technology.

It was reported that Atlanta-based Aaron's rent-to-own computer chain has been surreptitiously snapping Webcam photos of its customers’ and recording them via spyware. Thus, Aaron's facilitated a violation of many consumers' privacy.

The company has been accused of knowingly installing software onto its computers that secretly monitored its customers. Recently, the Federal Trade Commission caught onto the Aaron's alleged tactics and filed a complaint against the company, and the chain agreed to settle with the FTC.

According to the FTC's complaint, Aaron's software tracked customers' locations, took photos with the computers' Webcams "including those of adults engaged in intimate activities," and activated key loggers that were able to capture login credentials for everything from e-mail to FaceBook to banking sites.

Under the terms of the settlement, Aaron's is prohibited from using monitoring technology that captures keystrokes, takes photos, or records sound. The company must also get customer consent before it uses location-tracking software on its rental computers.

Source: http://news.cnet.com/8301-1009_3-57608838-83/aarons-computer-rental-chain-settles-ftc-spying-charges/

Hackers Target Java 6 with Security Exploits

F-Secure anti-malware analyst Timo Hirvonen warned Java 6 users and recommended to upgrade to Java 7 as soon as possible to avoid being compromised by active attacks.

F-Secure anti-malware analyst Timo Hirvonen reported finding an in-the-wild exploit actively targeting an unpatched vulnerability in Java 6 following the recent publication of related proof-of-concept (POC) attack code.

The Neutrino crimeware kit was first spotted in March 2013, when it was identified as the source of a series of attacks that were exploiting Java vulnerabilities to install ransomware on victims' PCs, freezing them until users paid a fine that was supposedly being levied by the FBI and other law enforcement agencies

According to statistics released in March 2013, at least 47% of all Java users in the United States were still running Java version 6.

Vulnerability information provider Secunia reported that; the bug could be exploited by malicious local users to disclose certain sensitive information, manipulate certain data, and gain escalated privileges and by malicious people to conduct spoofing attacks, disclose certain sensitive information, manipulate certain data, cause a denial of service, bypass certain security restrictions, and compromise a vulnerable system.

While Java 6 is under the gun, the latest version of Java 7 also sports at least one serious unpatched vulnerability.  However, no technical details about that vulnerability have been publicly released.

Oracle plans to patch the bug. The fix will come in the form of "a back-ported (from JDK 8) implementation of the affected component in JDK 7 update 40. Also Oracle announced  to delay the release of Java 8 (aka JDK or JRE 8) while it redeployed developers to strengthen Java 7 security.

Source: http://www.informationweek.com/security/vulnerabilities/hackers-target-java-6-with-security-expl/240160443

WhatsApp Web site hijacked, shows pro-Palestinian message

Hey WhatsApp users, did you get to see this page on Tuesday, October 8^th?

Apparently, the Web site of WhatsApp was hijacked on Tuesday. The site showed a pro-Palestinian message at 2:40 a.m. A group called KDMS Team claimed credit for the attack. However, the company reported in their statement that no user data was lost or compromised. The company reported to be committed to users’ security and is working with their domain hosting vendor Network Solutions on further investigation of the incident.

 Be careful with the messages you exchange on the site. If you ever send sensitive information such as bank information, personal details, your information could be in danger of being hacked and used by the wrong hands.

For more information go to http://news.cnet.com/8301-1009_3-57606455-83/whatsapp-web-site-hijacked-shows-pro-palestinian-message/

FBI Warns Public That Cyber Criminals Continue to Use Spear-Phishing Attacks to Compromise Computer Networks

Hey guys, did you know that the FBI discovered an increase of criminals who use spear-phishing attacks to target multiple industry sectors?

It was found that attacks make use of access to create fake identities, steal intellectual property, and compromise financial credentials to steal money from victims’ accounts.

In spear-phishing attacks, cyber criminals target victims because of their involvement in an industry or organization they wish to compromise. Often, the e-mails contain accurate information about victims obtained via a previous intrusion or from data posted on social networking sites, blogs, or other websites. This information adds a veneer of legitimacy to the message, increasing the chances the victims will open the e-mail and respond as directed.

Recent attacks have convinced victims that software or credentials they use to access specific websites needs to be updated. The e-mail contains a link for completing the update. If victims click the link, they are taken to a fraudulent website through which malicious software (malware) harvests details such as the victim’s usernames and passwords, bank account details, credit card numbers, and other personal information. The criminals can also gain access to private networks and cause disruptions or steal intellectual property and trade secrets.

To avoid becoming a victim, keep in mind that online businesses, including banks and merchants, typically will not ask for personal information, such as usernames and passwords, via e-mail. When in doubt, either call the company directly or open your computer’s Internet browser and type the known website’s address. Do not use the telephone number contained in the e-mail, which is likely to be fraudulent as well.

In general, avoid following links sent in e-mails, especially when the sender is someone you do not know or sometime it could be someone you know or appears to be from a business advising that your account information needs updated.

Keep your computer’s anti-virus software and firewalls updated. Many of the latest browsers have a built-in phishing filter that should be enabled for additional protection.

If you believe you may have fallen victim to a spear-phishing attack, file a complaint with the FBI’s Internet Crime Complaint Center,  http://www.ic3.gov/.

 

Source: http://www.fbi.gov/sandiego/press-releases/2013/fbi-warns-public-that-cyber-criminals-continue-to-use-spear-phishing-attacks-to-compromise-computer-networks

A LOCK SCREEN VULNERABILITY IN THE NEW IOS 7 LEAVES USERS' E-MAIL, PHOTOS, TWITTER, AND OTHER APPS OPEN TO BEING USED WITHOUT PERMISSION

Hey guys, did you know that the passcode lock screen on iOS 7 suffers from a virus that allows anyone with direct access to the iPhone or iPad to bypass the lock screen and open apps?

It was discovered by Jose Rodriguez that if you hold the phone's sleep button, but instead of swiping to power down the phone, tap cancel and double-tap the home button to access the multitasking screen. From there, you can jump to the camera and share stored photos, which gives you access to the user's communication accounts such as e-mail, Flickr, Facebook, Twitter, and others.

And it has been tested successfully on iOS 7 when running on the iPhone 4S, 5, 5C, and 5S, and the most recent iPad model.

Rodriguez has an ability of finding iOS lock screen hacks. He found vulnerabilities in the iOS  6.2.3 lock screen and a lock screen in a beta version of iSO 7.

 Apple fixed both, but this is a new one that he found recently. Rodriguez released the hacks in a responsible manner, and he promised to figure out ways to break the new version of iOS.

Source: http://news.cnet.com/8301-1009_3-57603787-83/apple-promises-to-fix-ios-7-lock-screen-hack/  

 

REVEALED: HOW US AND UK SPY AGENCIES DEFEAT INTERNET PRIVACY AND SECURITY

 

Did you know that the spy agencies have inserted secret vulnerabilities into encryption software??

US and British intelligence agencies have successfully cracked much of the online encryption relied upon by hundreds of millions of people to protect the privacy of their personal data, online transactions and emails.

 The National Security Agency and its UK counterpart GCHQ have broadly compromised the guarantees that internet companies have given consumers to reassure them that their communications, online banking and medical records would be indecipherable to criminals or governments.

The agencies, the documents reveal, have adopted a battery of methods in their systematic and ongoing assault on what they see as one of the biggest threats to their ability to access huge swathes of internet traffic – "the use of ubiquitous encryption across the internet".

Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with "brute force", and – the most closely guarded secret of all – collaboration with technology companies and internet service providers themselves.

Through these covert partnerships, the agencies have inserted secret vulnerabilities – known as backdoors or trapdoors – into commercial encryption software.

 A GCHQ team has been working to develop ways into encrypted traffic on the "big four" service providers, named as Hotmail, Google, Yahoo and Facebook.

The agency proposed a system to identify encrypted traffic from its internet cable-tapping programs and decrypt what it could in near-real time.

Even if he NSA and GCHQ celebrated their success at 'defeating network security and privacy,  security experts  argues that attacking the internet itself and the privacy of all users is wrong.  

Please feel free to share your ideas on this debate.  

Source: http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security

 

 

 

Exploiting the iPhone

In the world of information security the new iPhone was recently released with vulnerability. Cell phones carry so much of our personal data; therefore, it is critical to secure individual’s information before releasing any device.

Evaluators decided to investigate how tough it would be for a remote adversary to compromise the private information stored on the iPhone. Within a short period of time, they had successfully discovered vulnerability; they created a tool chain for working with the iPhone's architecture and developed a proof-of-concept exploit capable of delivering files from the user's iPhone to a remote attacker. Once this was discovered, the evaluators notified Apple of the vulnerability and suggested a patch, but Apple resolved the issue on their own.

How the exploit works

The vulnerability is sent via a malicious web page opened in the Safari browser on the iPhone. There are several delivery vectors that an attacker might utilize to get a victim to open such a web page; For example, the iPhone learns access points by name (SSID); if a user ever gets near an attacker-controlled access point with the same name (and encryption type) as an access point previously trusted by the user, the iPhone will automatically use the malicious access point. This allows the attacker to add the exploit to any web page browsed by the user replacing the requested page with a page containing the exploit.

 If a web forum's software is not configured to prevent users from including sensitive data in their posts or web page, an attacker could cause the exploit to run in any phone browser that viewed the thread. For example,   Attacker could manipulate a user into opening a website that they control by sending the link via e-mail or SMS.

When the iPhone's version of Safari opens the malicious web page, illogical code rooted in the exploit is run with administrative privileges. In our proof of concept, this code reads the log of SMS messages, the address book, the call history, and the voicemail data. It then transmits all this information to the attacker. It could also send the user's mail passwords, text messages that sign the user up for pay services, or record audio that could be relayed to the attacker.

Even though Information Technology is ever increasing to ensure protection of our personal data there are still so many weak points and flaws that could bring harm to its users and potential lawsuits. I believe that evaluators are needed to expose flaws and vulnerability to ensure information security to users

Source: http://securityevaluators.com/content/case-studies/iphone/.

Privacy Fears Cause More to Cover Online Tracks

Currently, there is a developing fear about online surveillance and data theft. Americans are increasingly taking steps to remove or mask their digital footprints on the Internet.

Facts

It was reported by Pew Research Center that; 86 percent of US Internet users have taken some steps to avoid online surveillance by other people or organizations.

The survey found out that: 21% of online adults have had an email or social media account hijacked and 11% have had information like Social Security numbers or financial data stolen. 12 % of those using the Internet have been stalked or harassed online, and 6% have been the victim of an online scam and lost money.  6% reported to have had their reputation damaged because of something that happened online, and 4% were in physical danger because of something that happened online. 50 % of Internet users reported to be worried about the amount of their personal information that is online.  64% of online adults clear "cookies" which store information, or their browser history and 41% have disabled cookies.

Some delete material they have posted in the past, create usernames that are hard to tie to them, use public computers to browse, or give inaccurate information about themselves.

Approximately 14% of the user’s survey said they at times encrypt email and 14 % say they use services like virtual networks that allow them to browse without being tied to a specific Internet protocol address. 

Source: http://www.securityweek.com/privacy-fears-cause-more-cover-online-tracks-study  

 

Current Information Security Issues

Hi Everyone.

My name is Sajida Kamazima , currently working on my master’s degree in Management Information Systems, sybersecurity concentration at Bellevue University. I look forward to discussing current information security issues