http://arstechnica.com/security/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/ By Dan Goodin Ars Technica July 12, 2015 Spyware service provider Hacking Team orchestrated the hijacking of IP addresses it didn’t own to help Italian police regain control over several computers that were being monitored in an investigation, e-sent among company employees showed. Over a six day period in August 2013, Italian Web host Aruba S.p.A. fraudulently announced its ownership of 256 IP addresses into the global routing system known as border gateway protocol, the messages document. Aruba’s move came under the direction of Hacking Team and the Special Operations Group of the Italian National Military Police, which was using Hacking Team’s Remote Control System malware to monitor the computers of unidentified targets. The hijacking came after the IP addresses became unreachable under its rightful owner Santrex, the “bullet-proof” Web hosting provider that catered to criminals and went out of business in October 2013, according to KrebsOnSecurity. It’s not clear from the e-mails, but they appear to suggest Hacking Team and the Italian police were also relying on Santrex. The emails were included in some 400 gigabytes of proprietary data taken during last weekend’s breach of Hacking Team and then made public on the Internet. With the sudden loss of the block of IP addresses, Italy’s Special Operations Group was unable to communicate with several computers that were infected with the Hacking Team malware. The e-mails show Hacking Team support workers discussing how the law enforcement agency could regain control. Eventually, Italian police worked with Aruba to get the block—which was known as 46.166.163.0/24 in Internet routing parlance—announced in the BGP system as belonging to Aruba. It’s the first known case of an ISP fraudulently announcing another provider’s address space, said Doug Madory, director of Internet analysis at Dyn Research, which performs research on Internet performance. […]
http://www.csoonline.com/article/2907122/data-protection/russian-hackers-used-state-dept-systems-to-phish-white-house-staffers.html By Steve Ragan CSO Apr 7, 2015 U.S. officials, who have been briefed on the investigation so far, have told CNN that Russian hackers used their access after compromising the U.S. State Department to target sensitive information on the unclassified White House network. Last October, a White House official told Reuters that suspicious activity had been detected on the Executive Office of the President (EOP) network. The incident was blamed for an outage on the EOP network a week prior to the story breaking, somewhat aligning with statements given to the Washington Post by officials who noted that the problems on the unclassified network were caused by hackers out of Russia. CNN’s story however, adds new details to the previous coverage. While the blame is still centered on actors out of Russia, the unclassified network that was breached held sensitive information the hackers are said to have had access to, including real-time non-public details of the president’s schedule. […]
http://www.healthcareitnews.com/news/ehr-audit-catches-snooping-employee By Erin McCann Managing Editor Healthcare IT News January 26, 2015 Electronic health records not only enable faster access to real-time patient data; they also make it a heck of a lot easier to catch snooping employees who inappropriately view patients’ confidential information, as one California hospital has observed this past week. Officials at the 785-bed California Pacific Medical Center in San Francisco – part of Sutter Health system – notified a total of 844 patients Jan. 23 after discovering a pharmacist employee had been inappropriately snooping on patients’ medical data for an entire year. The incident was discovered after the hospital conducted an EHR audit back in October 2014, when it was first discovered only 14 individuals had had their PHI compromised. Following an “expanded investigation,” hospital officials discovered the HIPAA breach was significantly larger than they had originally found, with 844 additional patients being identified as having there information inappropriately accessed. The staff member, whose employment has since been terminated, snooped on patient records from October 2013 to October 2014, including patient demographics, clinical diagnoses, prescription data and clinical notes. […]
http://freebeacon.com/national-security/noaa-employee-charged-with-computer-breach-met-senior-chinese-official-in-beijing/ By Bill Gertz The Free Beacon January 6, 2015 A federal weather service employee charged with stealing sensitive infrastructure data from an Army Corps of Engineers database met a Chinese government official in Beijing, according to court documents that reveal the case to be part of an FBI probe of Chinese economic espionage. Xiafen “Sherry” Chen, an employee of the National Oceanic and Atmospheric Administration (NOAA) office in Ohio, was arrested in October and charged in a federal grand jury indictment with illegally accessing the Army’s National Inventory of Dams (NID). The NID is a sensitive database containing information on all U.S. dams. U.S. intelligence officials have said the database was compromised by Chinese hackers in 2013 as part of covert efforts by Beijing to gather sensitive information on critical U.S. infrastructure for possible use in a future conflict. According to an FBI document in the case made public Dec. 30, Ms. Chen and Jiao Yong, an official of the Ministry of Water Resources in Beijing, exchanged a series of emails in May 2012 indicating that the two met in Beijing that year and that she was searching for, and would provide, dam-related information for him. […]
http://mashable.com/2015/01/06/google-security-princess-white-house-hack By Lorenzo Franceschi-Bicchierai Mashable.com Jan 6, 2015 After hackers breached its internal network in late October, the White House got the help of a Google security engineer, Parisa Tabriz, the company’s self-proclaimed “security princess.” Tabriz was tapped by the newly founded U.S. Digital Service, a tech task force for the government which launched in August, as a consultant for a “Top Secret / Classified project” to improve the network of the White House and the Executive Office of the President, according to an earlier version of her own resume, which has since been edited. Tabriz’s work for the White House on computer security has not been publicly reported before. Her resume entry was spotted on Monday by American Civil Liberties Union Principal Technologist Christopher Soghoian, who in the past exposed the FBI hacking techniques scouring the LinkedIn profiles of government contractors. […]
http://www.govinfosecurity.com/cybersecurity-seen-as-dod-priority-under-carter-a-7634 By Eric Chabrow Gov Info Security December 3, 2014 Ashton Carter is a Ph.D. physicist and an expert in nuclear weaponry and procurement, but the likely defense secretary nominee understands that cyberdefense must be a priority in running the Pentagon. “Cybersecurity won’t get lost,” says Jane Holl Lute, who as deputy secretary of the Department of Homeland Security worked closely with Carter when he was Defense Department deputy secretary. “He understands the importance of the issues, the need for collaborative action. He understands the role defense has, and homeland security, that lies at the heart of effective cybersecurity.” Carter served as deputy defense secretary from October 2011 to December 2013. Before becoming deputy secretary, Carter served as DoD undersecretary for acquisition, technology and logistics from April 2009 to October 2011. Those who have worked with and know Carter say he will utilize his vast knowledge of the workings of the Pentagon if he’s confirmed as defense secretary, succeeding Chuck Hagel, who is stepping down. […]
http://www.theverge.com/2014/11/6/7171347/the-us-government-is-hacking-healthcare-gov-to-make-sure-its-secure By Rich McCormick Deaily Mail November 6, 2014 The launch of Healthcare.gov, the US government’s health insurance website, was beset with technical problems so severe that only six people were able to enroll on its first day in October 2013. Ahead of a second enrollment period, beginning on November 15th, government officials are launching cyberattacks against the revamped site to make sure the same crippling bugs and security holes don’t appear again. Andy Slavitt, hired to oversee the Centers for Medicare and Medicaid Services’ Healthcare.gov program, says that groups of white-hat hackers in his team are conducting weekly attacks on the network that simulate real hacking attempts, in order to probe for weak points and bolster its defenses. Flaws in the previous incarnation of Healthcare.gov were exposed earlier this year when a security researcher reportedly obtained 70,000 medical records through a Google search. […]
http://www.bankinfosecurity.com/banks-concerns-about-cyberthreats-grow-a-7486 By Tracy Kitten Bank Info Security October 28, 2014 Banking leaders say they’re substantially more concerned today than they were just six months ago about cyber-attacks and geopolitical threats aimed at the global financial system. That’s according to a report covering results of a survey conducted during the third quarter and published last week by the Depository Trust & Clearing Corp. The DTCC provides clearing and settlement services for banking institutions. Participants in the survey included financial stakeholders from throughout the world. Since March, when the DTCC last conducted its Systemic Risk Barometer survey, more global banking leaders say they see ongoing cyber-risks as posing increasing concern. They rate cyberthreats as the No. 1 systemic risk facing the global economy today. Banking institutions and other financial services firms surveyed by the DTCC say that in the past 12 months, they have increased their investments in systems and technologies designed to monitor and mitigate systemic risks, such as cyber-attacks and economic recessions that could collapse the global financial system. […]
This management book focuses on the crucial knowledge you'll need to become a great manager and leader. It will teach you the important management and leadership skills so others will call you "great"!
