Could be new. Could be a 'left over'
from the original attacks. Looks more like a third-party weakness,
but it's going to be hard to be sure with such minimal reporting.
Sony
attacked again – 93,000 usernames and passwords compromised
October 12, 2011 by admin
Associated Press reports:
Sony said
Wednesday intruders staged a massive attempt to access user accounts
on its PlayStation Network and other online entertainment services in
the second major attack on its flagship gaming site this year.
The Tokyo-based
company temporarily locked about 93,000 accounts
whose IDs and passwords were
successfully ascertained by the blitz.
[Unencrypted? Bob] Sony sent email notifications and
password reset procedures to affected customers on the PlayStation
Network, Sony Entertainment Network and Sony Online Entertainment
services.
Read more on CTV.ca.
It’s bad enough that their earlier
breach embarrassed them on data security. But after claims of
improved security, this incident has the potential to embarrass them
again, even though this time, it appears that there might have been a
brute force attack using usernames and passwords obtained from some
other database(s).
Having also been criticized for its
slow response in disclosing and warning people, Sony was quicker this
time. The attacks appear to have occurred between October 7 and 10,
and the firm posted a notice on its site October 11, although it had
not yet sent out e-mails to those affected at the time of its blog
post. Users generally responded appreciatively to the quick
disclosure, as evident in the comments in response to the blog post.
In related coverage, John Leyden
reports:
Sony has warned
users against a massive bruteforce attack against PlayStation and
Sony network accounts.
The attack –
which used password and user ID combinations from an unidentified
third-party source – succeeded in compromising 60,000 PlayStation
Network and 33,000 Sony Online Entertainment network accounts. These
accounts have been locked and passwords reset.
Credit card
information is not stored on the dashboard of Sony accounts but it
might have been possible that unauthorised charges were made against
the wallets held on compromised accounts. Sony has promised to
refund any such losses, as explained in a statement by Philip
Reitinger, senior vice president and chief information security
officer at Sony Group, on the PlayStation blog here.
Read more on The
Register.
It could be very useful to have the
“key” to systems protected by RSA's SecurID tool. It is much
less valuable to be so clumsy in your hack that your target is
immediately aware of your success and changes the algorithm.
RSA
Blames Breach on Two Hacker Clans Working for Unnamed Government
Two separate hacker groups whose
activities are already known to authorities were behind the serious
breach of RSA Security earlier this year and were likely working at
the behest of a government, according to new statements from the
company’s president.
RSA President Tom Heiser, speaking at
the RSA conference in London this week, said that the two
unidentified hacker groups had not previously been known to work
together and that they possessed inside information about the
company’s computer naming conventions that helped their activity
blend in with legitimate users on the network, according to IDG news
service.
Heiser said that due to the
sophistication of the breach, “we can only conclude it was a
nation-state-sponsored attack.”
… The company was forced
to replace SecurID customer tokens after the breach.
Somehow I doubt this. The military
normally does not ignore procedure and there would definitely be a
reporting procedure.
Get
Hacked, Don’t Tell: Drone Base Didn’t Report Virus
Officials at Creech Air Force Base in
Nevada knew for two weeks about a virus
infecting the drone “cockpits” there. But they kept the
information about the infection to themselves — leaving the unit
that’s supposed to serve as the Air Force’s cybersecurity
specialists in the dark. The network defenders at the 24th Air Force
learned of the virus by reading about it in Danger Room.
… Nevertheless, the virus has
sparked a bit of a firestorm in military circles. Not only were
officials in charge kept out of the loop about an infection in
America’s weapon and surveillance system of choice, but the
surprise surrounding that infection highlights a flaw in the way the
U.S. military secures its information infrastructure:
Very interesting, but I'll have to
study the study to see how useful it might be...
Tracking
the Trackers: Where Everybody Knows Your Username
October 12, 2011 by Dissent
Jonathan Mayer writes:
Click the local
Home Depot ad and your email address gets handed to a dozen companies
monitoring you. Your web browsing, past, present, and future, is now
associated with your identity. Swap photos with friends on
Photobucket and clue a couple dozen more into your username. Keep
tabs on your favorite teams with Bleacher Report and you pass your
full name to a dozen again. This isn’t a 1984-esque scaremongering
hypothetical. This is what’s happening today.
Stanford conducted an important web
leakage study to assess its pervasiveness, summarized in the blog
post. Of note, Jonathan notes the implications:
From a legal
perspective, identifying information leakage is a debacle. Many
first-party websites make what would appear to be incorrect, or at
minimum misleading, representations about not sharing PII.
Read more about the
study’s methodology and results on CIS.
Jim Puzzanghera and Jessica Guynn of
the Los
Angeles Times, Grant Gross of IDG
provide some of the extensive media coverage of the study with
reactions from others.
Never, ever challenge hackers.
IT
Olympics: Cyberattacks to test cybersecurity of London Olympic Games
The London 2012 Olympic Games open in
nine months, but geeks and security freaks are
preparing to go for the gold now in simulated cyberattacks
against the technology systems running the Olympics. During the 2008
Beijing Olympics, there were reportedly 12 million cyberattacks per
day, so it's a mighty big claim for officials to say
the London 2012 Olympics will be "safe
from cyberattacks" and from cybercriminals
disrupting the games. Gerry Pennell, the CIO over cybersecurity for
the London Olympics, confidently told
the Wall Street Journal that "even if police shut down the
mobile network in response to a major attack, the games would still
be able to carry on." [Perhaps they haven't
seen the “Build your own mobile network” tools the Berkman Center
recommends? Bob]
What am I missing here? “Texting
while driving is dangerous and possibly illegal so let's build it
into our cars!”
Cadillac
revamps the instrument panel with CUE
Cadillac has introduced a new central
instrument panel that features touch-screen technology popularized by
smartphones and tablets. The fully capacitive faceplate has an
8-inch touch screen that utilizes multitouch gestures to interact
with it.
Key finding: Executive management does
not know what is going on...
Data Mining: DHS Needs to Improve
Executive Oversight of Systems Supporting Counterterrorism,
GAO-11-742, Sep
7, 2011
No comments:
Post a Comment