Facebook site infiltrated!

The Facebook security teams has confirmed that the social networking site was targeted in a "sophisticated attack" last month.

The digital intrusion apparently occurred when a small number of Facebook personnel visited a compromised mobile developer website.

"The site hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. As soon as we discovered the presence of the malware, we remediated all infected machines," a Facebook rep explained.

"After analyzing the compromised website where the attack originated, we found it was using a 'zero-day' (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability."

Interestingly, Facebook says it wasn't not alone in the above-mentioned attack, as other sites were infiltrated as well.

However, the rep was also quick to point out that the social networking site had found "no evidence" of compromised user data.

"As part of our ongoing investigation, we are working continuously and closely with our own internal engineering teams, with security teams at other companies, and with law enforcement authorities to learn everything we can about the attack, and how to prevent similar incidents in the future," the rep added.


Source: www.tgdaily.com/

Symantec: Hackers Hit Chemical Companies

Cyber attacks traced to China targeted at least 48 chemical and military-related companies in an effort to steal technical secrets, a U.S. computer security company said Tuesday, adding to complaints about pervasive Internet crime linked to this country.

The targets included 29 chemical companies and 19 others that make advanced materials used by the military, California-based Symantec Corp. said in a report. It said the group included multiple Fortune 100 companies but did not identify them or say where they were located.

"The purpose of the attacks appears to be industrial espionage, collecting intellectual property for competitive advantage," said the report.

Security experts say China is a center for Internet crime. Attacks against governments, companies and human rights groups have been traced to this country, though finding the precise source is nearly impossible. China's military is a leader in cyberwarfare research but the government has rejected allegations of cyberspying and says it also is a target.

The latest attacks occurred between late July and September and used e-mails sent to companies to plant software dubbed "PoisonIvy" in their computers, Symantec said. It said the same hackers also were involved in attacks earlier this year on human rights groups and auto companies.

Symantec said it traced the attacks to a computer system owned by a Chinese man in his 20s in the central province of Hebei. It said that when contacted, the man provided a contact who would perform "hacking for hire."

Symantec said it could not determine whether the Chinese man was a lone attacker, whether he had a direct or indirect role or whether he hacked the targets for someone else. It called him Covert Grove based on a translation of his Chinese name.

The U.S. and Chinese governments have accused each other of being involved in industrial espionage.

Security consultants say the high skill level of earlier attacks traced to China suggests its military or other government agencies might be stealing technology and trade secrets to help state companies.

The chairman of the U.S. House of Representatives Intelligence Committee, Rep. Mike Rogers, said last month that Chinese efforts to steal U.S. technology over the Internet had reached an "intolerable level." He called on the U.S. and other governments to pressure Beijing to stop.

Another security firm, McAfee Inc., said in August it had found a five-year-long hacking campaign that it called Operation Shady Rat against more than 70 governments, international institutions, corporations and think tanks.

In February, McAfee said hackers operating from China stole information from oil companies in the United States, Taiwan, Greece and Kazakhstan about operations, financing and bidding for oil fields.

Thousands of Chinese computer enthusiasts belong to hacker clubs and experts say some are supported by the military to develop a pool of possible recruits. Experts say military-trained civilians also might work as contractors for companies that want to steal technology or business secrets from rivals.

China has the world's biggest population of Internet users, with more than 450 million people online, and the government promotes Web use for business and education. But experts say security for many computers in China is so poor that they are vulnerable to being taken over and used to hide the source of attacks from elsewhere.

Last year, Google Inc. closed its China-based search engine after complaining of cyber attacks from China against its e-mail service.

That case highlighted the difficulty of tracking hackers. Experts said that even if the Google attacks were traced to a computer in China, it would have to be examined in person to be sure it wasn't hijacked by an attacker abroad.

By JOE McDONALD AP Business Writer

Sega says 1.3 million affected by data breach

The hack that took down Sega's online gaming service late last week has affected 1.3 million customers.

That was one of the details confirmed by the publisher on Sunday.

A cyber attack on the publisher's Sega Pass service - a subscription-based feature that allows gamers to play unlimited Sega games online - forced the service to be shut down.

"We have identified that a subset of  SEGA Pass members emails addresses, dates of birth and encrypted passwords were obtained. To stress, none of the passwords obtained were stored in plain text. Please note that no personal payment information was stored by SEGA as we use external payment providers, meaning your payment details were not at risk from this intrusion," Sega wrote in an e-mail to its customers.

On Sunday, Sega confirmed 1.3 million people were affected but did not have an estimate for when Sega Pass would be back online. The company said it is working on increasing its security.

The Sega Pass website has been replaced with a terse message that reads, "SEGA Pass is going through some improvements so is currently unavailable for new members to join or existing members to modify their details including resetting passwords. We hope to be back up and running very soon. Thank you for your paitence." (sic)

This of course comes just off the heels of Sony's massive data breach which forced the Playstation Network offline for over a month, resulting in what is estimated to be billions of dollars in damages.

Unlike Sony's service, Sega Pass is not an e-commerce platform for other publishers, so the damage is limited only to Sega itself. But with such a large number of users affected, it isn't a small attack by any means.

Source: www.tgdaily.com

   

Sony hit again with two hacks

Japanese ISP subsidiary is broken into, while phishers use Sony server in Thailand

An intruder has apparently broken into So-net, an internet service provider subsidiary of Sony, and stolen about $1,200 worth of virtual tokens.

So-net disclosed the compromise in an alert (written in Japanese) on its homepage on Thursday.

Meanwhile, security firm F-Secure today disclosed that it has also discovered a phishing site that's hosted on a Sony server in Thailand.

"Basically this means that Sony has been hacked, again," Mikko Hypponen, F-Secure's chief research officer, noted in the blog post. "Although in this case the server is probably not very important," he added.

News of the latest breaches come barely a month after Sony disclosed intrusions at its PlayStation Network and Sony Entertainment Online sites that compromised data on close to 100 million account holders.

A So-net spokesman told the Wall Street Journal, which broke the story, that the breach of the ISP is unlikely connected to the previous compromises.

The Sony-owned So-net ISP lets consumers accumulate reward points that can be redeemed for Sony merchandize and services. The intruders illegally redeemed points belonging to about 130 consumers. Another 73 accounts were compromised, but their points were not redeemed, the Journal noted.

In addition, about 90 email accounts are also believed to have been compromised in the breach

According to the Journal, an intruder using one IP address, tried to access So-net's point service close to 10,000 times before finally gaining access. So-net itself appears to believe that the intruder had usernames of account holders and used an automated program to generate possible passwords, the Journal said.

It's not immediately clear why the company apparently doesn't have a mechanism for flagging multiple failed attempts to access its systems.

The intrusions are believed to have taken place on May 16 and May 17. So-net discovered the breach on May 18, after receiving consumer complaints. So-net stopped the point redemption service following the discovery of the breach.

he latest breaches are relatively minor in scale compared to the massive breach at PSN and Sony Entertainment Online. Even so, it only adds to the company's embarrassment.

The earlier intrusions forced Sony to take its PSN service offline for several weeks while it struggled to identify the scope of the problems and how to fix them.

The company started re-launching the service this week but isn struggling to keep it running smoothly.

For instance, earlier this week Sony was forced to once again take a portion of its PlayStation network offline because of a programming error that could provide hackers a way to break into its networks.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.