A take on the security news, week 37
Monday:
The US site healthcare.org hacked and injected with malware
Security experts warned the Congress in November that the site was not secure, "If it hadn't been hacked already, it would be soon".
No personal information or sensitive data is compromised in this breach.
http://nakedsecurity.sophos.com/2014/09/08/healthcare-gov-breached-injected-with-malware/
93% of Financial Services Organizations Experienced Cyberthreats in the Past Year
The Kaspersky Lab and B2B International survey found that 82% of businesses would consider leaving a financial institution that suffered a data breach and that 74% of companies choose a financial organization according to their security reputation.
Anatomy of 2,000 Compromised Web Servers used in DDoS Attack
This post gives an breakdown of a specific layer-7 DDoS attack. Outdated webserver software and phpmyadmin installation are identified as the entry point this time.
http://blog.sucuri.net/2014/09/anatomy-of-2000-compromised-web-servers-used-in-ddos-attack.html
Home Depot Hit By Same Malware as Target
This article claims that it might be the same people being responsible for both the Target and Home Depot attacks.
http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/
Tuesday:
Home Depot confirms databreach
The US retail store now officially confirmes that they had a breach in their payment systems possibly leading to stolen creditcard data.
Home Depot also confirm that they will be deploying Chip and Pin to all US stores this year.
http://nakedsecurity.sophos.com/2014/09/09/home-depot-says-er-yes-we-did-have-a-breach-actually/
http://phx.corporate-ir.net/phoenix.zhtml?c=63646&p=RssLanding&cat=news&id=1964976
Wednesday:
Patch tuesday fixes a remote code execution in IE
Todays patches include closing an RCE in IE, and a priviliege escalation bug in Task Manager. Bugfixes from Adobe are delayed to next week tue do regression bugs.
http://nakedsecurity.sophos.com/2014/09/10/patch-tuesday-wrap-up-september-2014-why-even-a-single-bit-data-leak-is-worth-fixing/
Anonymous hacker claims to have information about who the Bitcoin inventor is
Screenshot of what is supposed to be the Inbox belonging to "Satoshi Nakamoto" is posted on the net. For a ransom "Jeffrey" will reveal the identity of the Bitcoin inventor.
http://nakedsecurity.sophos.com/2014/09/10/bitcoin-inventors-identity-allegedly-under-threat-after-claimed-satoshi-nakamoto-email-hijack/
Thursday:
MS hold in contempt for its refusal to hand over cloud email stored in EU
Government argue that data stored in the cloud is part of the business records of the provider, thus giving them weaker protection than personal records.
If MS loose this one, could we ever trust a US based cloud provider which dont provide end-to-end encryption?
http://nakedsecurity.sophos.com/2014/09/10/apple-pay-just-how-safe-is-it-going-to-be/
Friday:
85% of apps not up to scratch on privacy, study finds
http://nakedsecurity.sophos.com/2014/09/12/85-of-apps-not-up-to-scratch-on-privacy-study-finds/
Facebook tests Snapchat-like vanishing act for posts
http://nakedsecurity.sophos.com/2014/09/12/facebook-tests-snapchat-like-vanishing-act-for-posts/