Unfortunately, the Postbank’s fraud detection system hasn’t performed as it should, and the crime was discovered only after everyone returned to [...]]]>

We’ve been preaching for years that organizations needs to take a more proactive approach to their security. Services, such as our liveForensics, add additional layers of security to protect against such breaches.

Unfortunately, the Postbank’s fraud detection system hasn’t performed as it should, and the crime was discovered only after everyone returned to work after the holiday break. Apparently, it should not come as a surprise – according to a banking security expert, “the Postbank network and security systems are shocking and in desperate need of an overhaul.”

The post office and the police have confirmed that the breach happened and that the National Intelligence Agency (NIA) is involved in the investigation. The bank has issued a statement saying that none of its customers’ bank accounts were affected by the heist.

The investigation will hopefully reveal whether the backdoor into the compromised computer was installed by the employee unwittingly or whether the employee was recruited by the gang to allow them access.

via Hackers steal $6.7 million in bank cyber heist.

The results of a survey presenting statistics on the theft, abuse and eventual recovery of Gmail, Yahoo, Hotmail and Facebook accounts, shows that:

Less than one-third [...]]]>

A recent study shows that mobile users are getting hacked at high rates. And as many as 62% aren’t even aware that they are even at risk.

The results of a survey presenting statistics on the theft, abuse and eventual recovery of Gmail, Yahoo, Hotmail and Facebook accounts, shows that:

Less than one-third of users noticed their accounts had been compromised, with over 50% relying on friends to point out their stolen accounts.

15% of users thought their credentials were stolen after they used a public Internet terminal or WiFi network.

One in eight hijacked accounts were used for a phony distress email scam that asks friends to wire funds to a foreign country, and over half of the accounts were used to send spam.

via The state of hacked accounts.

via Patient Data Posted Online in Major Breach of [...]]]>

A medical privacy breach led to the public posting on a commercial Web site of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif., including names and diagnosis codes, the hospital has confirmed. The information stayed online for nearly a year.

via Patient Data Posted Online in Major Breach of Privacy

What is most notable about the most recent high profile security breach is that it was caused by a 3rd party vendor. While companies may be doing much to secure their data within their own organizations, there is very little being done to protect this data when in use or in possession of an outside vendor. viaForensics has developed tools to deal with this problem. Read our case study describing how liveForensics kept a financial organization’s data secure while working with a 3rd party vendor.

Once it detected the intrusion, DigiNotar has acted in accordance with all relevant rules and procedures. At that time, an external [...]]]>

On July 19th 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com.

Once it detected the intrusion, DigiNotar has acted in accordance with all relevant rules and procedures.
At that time, an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time.  After being notified by Dutch government organization Govcert, DigiNotar took immediate action and revoked the fraudulent certificate.

via DigiNotar reports security incident

The successful hack attacks on RSA and Sony have served as wake-up calls to the world’s CEOs. Both attacks, aptly dubbed “reputational events,” have resulted in hundreds of millions — potentially billions — of dollars [...]]]>

Roger A. Grimes warns: you’re only as strong as your weakest link. Have your partners and vendors undergone a security audit? Have you?

The successful hack attacks on RSA and Sony have served as wake-up calls to the world’s CEOs. Both attacks, aptly dubbed “reputational events,” have resulted in hundreds of millions — potentially billions — of dollars in lost revenue. Restoring a company’s good reputation after these types of incidents is not easy; sometimes it’s impossible.

Almost every company could be owned just as RSA and Sony were, even firms that embrace the security best practices I’ve advocated for the past 20 years, including better end-user education,faster and more inclusive patching, stronger authentication, improved monitoring, and quicker response to incidents. Of course, my regular readers have been taken all these important measures for a long time — but how about your partners? If they haven’t, they might well be putting your organization at risk.

via You’re only as secure as your business partners

I have to say, things are a bit bleak when you put it that way. There will always be vulnerabilities and there will always be criminals, so it’s hard to figure the way out. Especially as end users there is [...]]]>

Charlie Miller of Accuvant Labs responds to a question on the Defenders Dilemma:

I have to say, things are a bit bleak when you put it that way. There will always be vulnerabilities and there will always be criminals, so it’s hard to figure the way out. Especially as end users there is almost nothing you can do; you have to rely on the security of the software you run and have little control over how secure it is. As a society, we cannot eliminate computer attacks. However, what we can do (and this is the approach the industry is sort of taking) is make it so hard and expensive to pull off attacks that it becomes economically infeasible for most attackers. And even for those with the expertise to still pull off the attack, it minimizes the number of attacks they can perform. The way we make it more difficult is to reduce the number of vulnerabilities and ensure users’ software is up to date and “secure by default”. Also, make the OS resilient to attack with things like stack canaries, ASLR, DEP, and sandbox applications so that multiple exploits are needed. We also need to better control the software loaded on our devices (i.e. Apple’s App Store model). So, instead of having to write a single exploit, it takes three or four in order to perform an attack. This means most attackers won’t be able to pull it off, and those who can will have to spend much more time working it out.

via Charlie Miller On Hacked Batteries, Cloud Security, And The iPad

Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure [...]]]>

The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union.

Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority.

However Digital Agenda Commissioner Neelie Kroes announced on Thursday that she was opening a public consultation to see if more regulation was needed.

via EU considers stricter data breach notification rules

“America is getting hacked,” security consultant Dan Kaminsky said at a Center for Democracy and Technology briefing. “On a deep architectural level, we [...]]]>

Legislation cracking down on rogue websites could inadvertently help hackers who have struck major corporate and government targets in recent weeks, a group of computer science experts said on Thursday.

“America is getting hacked,” security consultant Dan Kaminsky said at a Center for Democracy and Technology briefing. “On a deep architectural level, we have to fix this or our economy cannot work.”

Senate Judiciary Chairman Patrick Leahy, D-Vt., introduced the PROTECT IP Act to crack down on websites that sell copyrighted and counterfeited materials, and it passed out of committee in May.

But Kaminsky and other Internet architecture experts object to a section that requires Internet service providers to use a controversial method known as domain name system filtering to direct traffic away from websites selling copyrighted or counterfeit materials.

… Kaminski, Steve Crocker of the security consultancy Shinkuro, David Dagon of the Georgia Institute of Technology, Danny McPherson of security firm Verisign, and Paul Vixie of the Internet Systems Consortium wrote a white paper in May predicting that businesses relying on secure connections will quickly feel the repercussions of the proposal when hacking increases.

via Internet Bill Could Help Hackers, Experts Warn