Friday, July 13, 2012
Another day, another round of password breaches...
Today it's accounts at the website of surf clothing company Billabong, and the online forums of technology firm NVIDIA that are affected. More info here from Threapost.com.
Thursday, July 12, 2012
Yahoo passwords breach
News broke today of a breach of almost 450,000 passwords from a service belonging to yahoo.com.
Initial analysis of the leaked passwords appears to show they were stored in plain text, and that they were stolen using a SQL injection attack.
Yahoo said that the passwords were from an old, out of date file, and that only 5% were valid acounts.Whether they were current or out of date, and how many were valid yahoo accounts doesn't matter. Storing user passwords in an unencrypted form puts the owners of those accounts at risk. Period. Although best practice says that you use different passwords for each service you use, we all know that some people use the same password for every single website in their life.
All yahoo.com users should change their password on yahoo itself and on all other sites where they use the same password.
Initial analysis of the leaked passwords appears to show they were stored in plain text, and that they were stolen using a SQL injection attack.
Yahoo said that the passwords were from an old, out of date file, and that only 5% were valid acounts.Whether they were current or out of date, and how many were valid yahoo accounts doesn't matter. Storing user passwords in an unencrypted form puts the owners of those accounts at risk. Period. Although best practice says that you use different passwords for each service you use, we all know that some people use the same password for every single website in their life.
All yahoo.com users should change their password on yahoo itself and on all other sites where they use the same password.
Wednesday, June 13, 2012
Malicious e-mails: new and improved!
"The payment you sent"
"Please confirm your LinkedIn password"
"Your bill is now available"
"Your paypal.com transaction"
Recently I've received a number of e-mails about services I use and subscribe to; some of the subject lines are shown above. The e-mails look very genuine, and they are normally telling me about a problem with my account and urging me to click the "Login" button as soon as possible to resolve the issue. If my personal experience is anything to go by, recently these scam e-mails are looking more and more like the real thing. They are designed to look as "official" as possible and they are solely designed to prompt you to log in to your account at PayPal, or your bank, or your mobile phone company, or LinkedIn - I've received examples purporting to be from all of these companies in the last week or so.
Of course, when you click the "log in to my account" link from the scam e-mail, you're not actually going to the real site but a site created by the attacker which looks identical (apart from the address in the url bar, which will NOT be the address of the site you think you are logging into but something which looks almost the same).
After you've logged in to the fake website, the attackers will take a copy of your log-in details. They can then either use the username and password they now know to log you in to the real site and redirect you to it (so you'll never know what just happened) or they can show you a page which says the site is "down for maintenance, please try later" - again, you might not suspect that your details have just been stolen. After that, the attackers can do whatever they like to your account. For example, they can transfer money to their own account, and you'll probably have a hard time proving that it wasn't you.
If you have any suspicions about an email you receive, never click on the link inside the e-mail. Instead, go to the account it relates to by typing the address into the browser yourself. That way you know you're going where you think you're going.
What do you think? Have you noticed the "quality" of these types of email improving recently? Let me know in the comments.
"Please confirm your LinkedIn password"
"Your bill is now available"
"Your paypal.com transaction"
Recently I've received a number of e-mails about services I use and subscribe to; some of the subject lines are shown above. The e-mails look very genuine, and they are normally telling me about a problem with my account and urging me to click the "Login" button as soon as possible to resolve the issue. If my personal experience is anything to go by, recently these scam e-mails are looking more and more like the real thing. They are designed to look as "official" as possible and they are solely designed to prompt you to log in to your account at PayPal, or your bank, or your mobile phone company, or LinkedIn - I've received examples purporting to be from all of these companies in the last week or so.
Of course, when you click the "log in to my account" link from the scam e-mail, you're not actually going to the real site but a site created by the attacker which looks identical (apart from the address in the url bar, which will NOT be the address of the site you think you are logging into but something which looks almost the same).
After you've logged in to the fake website, the attackers will take a copy of your log-in details. They can then either use the username and password they now know to log you in to the real site and redirect you to it (so you'll never know what just happened) or they can show you a page which says the site is "down for maintenance, please try later" - again, you might not suspect that your details have just been stolen. After that, the attackers can do whatever they like to your account. For example, they can transfer money to their own account, and you'll probably have a hard time proving that it wasn't you.
If you have any suspicions about an email you receive, never click on the link inside the e-mail. Instead, go to the account it relates to by typing the address into the browser yourself. That way you know you're going where you think you're going.
What do you think? Have you noticed the "quality" of these types of email improving recently? Let me know in the comments.
Monday, May 21, 2012
Security mindset
Interesting article about the mindset of security practitioners - thanks to Bruce Schneier for highlighting this one.
Tuesday, May 15, 2012
Surveillance cameras
A report from Wired's excellent Threat Level blog on research into the security of cameras used for CCTV, surveillance, security purposes. It seems many of them are by default enabled to allow access from the internet, and also by default use weak, well known passwords. That's a bad combination.
Password questions
A report from CNET about the compromise of thousands (the exact number of accounts compromised seems to be disputed, but seems to be over 20,000) of twitter account credentials.
If your account is affected you should've already been notified and should follow the instructions. If you're not directly affected, now might be a good time to revisit your password for twitter and other online services and ask yourself some questions:
1. Am I using the same password for multiple services?
2. Could someone who knows me (or who can find me online) easily guess the password I'm using?
3. Is the password strong (letters, numbers and ideally special characters)?
If your account is affected you should've already been notified and should follow the instructions. If you're not directly affected, now might be a good time to revisit your password for twitter and other online services and ask yourself some questions:
1. Am I using the same password for multiple services?
2. Could someone who knows me (or who can find me online) easily guess the password I'm using?
3. Is the password strong (letters, numbers and ideally special characters)?
Tuesday, May 1, 2012
Backdoor in industrial control system
With all of the recent focus on SCADA vulnerabilities and critical infrastructure protection, how does something like this happen?? RuggedCom appears to have been totally dismissive of the fundamental vulnerability reported to them.
RuggedCom was bought by Siemens in March 2012.
RuggedCom was bought by Siemens in March 2012.
Subscribe to:
Posts (Atom)