- Thursday, 23 July 2015
- Hits: 1583
600TB MongoDB Database 'accidentally' exposed on the Internet
System administrators have reportedly exposed almost 600 Terabytes (TB) of MongoDBdatabase due to running outdated and unpatched versions of the NoSQL MongoDB database. The open source MongoDB is the most popular NoSQL database used by companies of all sizes, from eBay and Sourceforge to The New York Times and LinkedIn. According to Shodan's representative John Matherly, nearly 30,000 MongoDB instances are publicly accessible over the Internet without the need of any form of authentication. Read more...
Hackers Remotely Kill a Jeep on the Highway—With Me in It!
Carjacking has gone wireless. It’s the latest in a series of revelations from two hackers, Miller and Valasek who plan to publish a portion of their exploit on the Internet, that have spooked the automotive industry.
"Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch" says Andy Greenberg of WIRED.com Read more...
|Major Hacks of the Week|
Online Cheating Site AshleyMadison Hacked
Large caches of datastolen from online cheating site AshleyMadison.com have been posted online by an individual or group that claims to have completely compromised the company’s userdatabases, financial records and other proprietary information. The still-unfolding leak could be quite damaging to some 37 million users of the hookup service, whose slogan is “Life is short. Have an affair.” Read more...
Mazda website hacked, 'no evidence yet' of compromised customer data
A Turkish-based hacker group going by the name of "Ayyildiz Tim" has hacked local car dealer Eurokars Group's Mazda website, but the car dealer has defended the security of its customer data collected via the website. When contacted, a Mazda spokesman confirmed that the site was attacked, but said the car dealer was still investigating the incident. A police report has been made. Read more...
|Major Vulnerabilities Disclosed|
Password Brute Force Attacks Threaten Millions of App Users
In September of 2014, private photos of a number of celebrities, including Kate Upton and Jennifer Lawrence, were leaked onto the image-based bulletin board 4chan. It was soon discovered that this leak occurred as a result of a bruteforce attack against Apple’s iCloud, which until then had not limited the number of login attempts for each user account.
Hackers exploited this oversight via the use of a password-breaking tool known as iBrute, which enabled them to gain unauthorized access to several celebrities’ accounts and steal their private photos from available data backups. This type of attacks also affects online accounts stored on users’ mobile devices, as a recent study conducted by AppBugs reveals. Read more...
Flash zero-day monster Angler dominates exploit kit crime market
Sophos Lab researcher Fraser Howard says the Anglerexploit kit is dominating the highly-competitive underground malware market, growing from exploding a quarter to 83 percent of market share within nine months .Like its rivals, the code is designed to be an all-in-one ram-rod hacking package that web scum can use to get their malware, ransomware, and other net nasties past user machine defences. The hacking toolkit incorporates emerging, patched and private zero day vulnerabilities and is cleaning up is dominating the market in the wake of the downfall of the BlackHole exploit kit which fell to pieces after the aptly-named founder Paunch was arrested in 2013. Read more...
|Legal, Regulatory and Corporate|
Lifelock Once Again Failed at Its One Job: Protecting Data
Customers who hired the infamous ID theft-protection firm Lifelock to monitor their identities after their data was stolen in a breach were in for a surprise. It turns out Lifelock failed to properly secure their data. This is ironic, of course, because Lifelock promotes its services to companies that experience data breaches and urges them to offer a complimentary Lifelock subscription to people whose data has been compromised in a breach. Read more...
Nigerian prince swaps the sweet talk for keyloggers and exploits
Nigerian 419 scammers have taken to the crime-as-a-service model using cash to plug their technical capability shortfalls to build malware campaigns that could be making millions, according to FireEye researchers. Erye Hernandez, Daniel Regalado and Nart Villeneuv said that scammers, notorious for their attempts to fleece the gullible, were now targeting users with exploit tools and keyloggers and breaking into legitimate business email transactions to swindle buyers and sellers. Read more...
|Security and Beyond|
Twitter stock pumped by bogus story about $31 billion buyout offer!
Critical Infrastructure IT Execs Believe Cyber-Attacks Could Soon Cause Death
Public-private threat intelligence sharing partnerships are increasingly common, and it turns out that most IT executives within critical infrastructure organizations see a need for them—especially as threats continue to snowball, to the point of potentially leading to casualties.
A full 86% in a recent survey from the Aspen Institute and Intel Security said that such partnerships are key to keeping pace with escalating cybersecurity threats. Read more...
|Security Awareness Tip|
Understanding Denial-of-Service Attacks
How do you know if an attack is happening?
Not all disruptions to service are the result of a denial-of-service attack. There may be technical problems with a particular network, or system administrators may be performing maintenance. However, the following symptoms could indicate a DoS or DDoS attack:
- unusually slow network performance (opening files or accessing websites)
- unavailability of a particular website
- inability to access any website
- dramatic increase in the amount of spam you receive in your account
What do you do if you think you are experiencing an attack?
Even if you do correctly identify a DoS or DDoS attack, it is unlikely that you will be able to determine the actual target or source of the attack. Contact the appropriate technical professionals for assistance.
|Silensec Editorial Team|
Editor: Dr. Almerindo Graziano
Dr. Graziano is the Silensec CEO. He holds an MSc in Electronic Engineering and a PhD in Mobile Computer Security, both from the University of Naples, Italy. Dr. Graziano has consulted in information security for private and government organisations across Europe, Africa and Middle East over the last 15 years. He is also a BSI-certified ISO27001 Lead Auditor trainer and auditor
Vice Editor: George Nicolaou (BSc, MSc)
George Nicolaou (BSc, MSc) leads the Silensec Malware Analysis Lab (MAL). He received his BSc in Computer Science and MSc in Advanced Computing Security from the University of Bath in UK, where he pursued research in malware and vulnerability analysis. For many years George has also been the Head of Research and Development department of the Astalavista Security Community. George is also a frequent speaker at security conferences around the world on advanced malware analysis, reverse engineering and exploit development techniques.
Associate Editor: Joseph Alulu (B.A)
Joseph Alulu leads the Silensec Marketing Department. He holds a Bachelors of Arts Degree from the University of Nairobi in Kenya. He publishes the weekly Silensec Newsletter, keeping you up to date on the latest information security news as well as creating information security awareness.
Please feel free to share this with interested parties via email, and social media. For a free subscription, please subscribe to our Feed. For any questions please click on the following contact us link