Tag Archives: verizon

Security

[ISN] It’s Not Beijing’s Hackers You Should Be Worried About, It’s Moscow’s

http://complex.foreignpolicy.com/posts/2014/04/22/it_s_not_beijing_s_hackers_you_should_be_worried_about_it_s_moscow_s By Shane Harris Foreign Policy April 22, 2014 When U.S. officials warn of the threat foreign cyber spies pose to American companies and government agencies, they usually focus on China, which has long been home to the world’s most relentless and aggressive hackers. But new information shows that Russian and Eastern European hackers, who have historically focused their energies on crime and fraud, now account for a large and growing percentage of all cyber espionage, most of which is directed at the United States. Individuals and groups in eastern Europe, and particularly in Russia and Russian-speaking countries, are responsible for a fifth of all cyber spying incidents in the world, according to a global study of data breaches conducted by Verizon, published on Tuesday. The spies are targeting a range of companies as varied as the global economy itself, and are stealing manufacturing designs, proprietary technology, and confidential business plans. The cyber spies steal information on behalf of their governments in order to manufacture cheaper versions of technologies or weapons systems, or to give their home country’s corporations a leg up on their foreign competitors. The report is based on information provided by computer security companies as well as the U.S. Secret Service and the Department of Homeland Security. Last year, it attributed nearly all incidences of cyber espionage


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , , , , ,
Security

[ISN] Your Privacy Is Not Our Responsibility, Says Verizon Exec

http://www.tomsguide.com/us/marcus-sachs-verizon-interview,news-17618.html By Jill Scharr Tom’s Guide SEPTEMBER 30, 2013 “If you’re worried about it, do something about it. Take security on yourselves, and don’t trust anybody else to do it.” At a recent security conference in New York City, that was the advice Marcus Sachs, Verizon’s vice president of national security policy, had for people upset about Verizon’s connections to the U.S. National Security Agency (NSA). Verizon is one of the large U.S. telecommunications providers closely linked to the National Security Agency’s widespread surveillance and data collection programs, according to documents leaked by former NSA contractor Edward Snowden. News that Verizon supplies the NSA with customer phone records on an “ongoing, daily basis” broke in June 6, 2013. It was the first story to examine the top-secret NSA documents Snowden had recently handed to documentary filmmaker Laura Poitras and journalist Glenn Greenwald. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , ,
Security

[ISN] Why the state of application security is not so healthy

http://www.csoonline.com/article/740164/why-the-state-of-application-security-is-not-so-healthy By George V. Hulme CSO Online September 23, 2013 Application security is an alarming and persistent problem: Nearly one-third of all breaches can be attributed to attacks against web applications, and both web application and database attacks account for most records breached every year. That’s according to the Verizon 2013 Data Breach Investigations Report, which looked at 47,000 reported security incidents and 621 confirmed data breaches during the year prior to the report. Web applications – because they are so easy to exploit and provide access into enterprise data – have long been top targets of attackers. That’s why it’s so surprising, or at least disappointing, that so many organizations pay application security such little attention. For instance, our 2012 Global Information Security Survey, which was conducted by CSO and CIO magazines and PricewaterhouseCoopers and asked 12,052 business and technology executives about their organizations’ security efforts. The survey found that only 35 percent of those questioned actually include application security in their internal security policies. Fortunately, not every company is so lax. Consider Menlo Park, CA-based medical image sharing startup Image32. Founded in 2011, Image32 aims to help ease patient and doctor pain when it comes to sharing medical images such as X-Rays, CT Scans, and MRIs. “If all of your care takes place within the same hospital building, sharing these images among doctors is typically no trouble at all,” says Image32 founder and CEO Bob Pellican. “However, because of security concerns, once a patient goes to another medical building, they will most likely need to copy all of their images to a CD or DVD and carry them around from specialist to specialist,” he says. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , , , , , , ,
Security

[ISN] Hack Turns Verizon Femtocell Into Spy Tool

http://www.pcmag.com/article2/0,2817,2421782,00.asp By Chloe Albanesius PCMag.com July 15, 2013 A pair of researchers this week revealed a vulnerability within Verizon Wireless femtocells that allowed hackers to spy on the carrier’s customers. Tom Ritter and Doug DePerry from iSEC Partners told Reuters that the glitch within the femtocells, which boost wireless signals in areas with poor reception, allowed for spying on text messages, photos, and phone calls. A software update rolled out by Verizon fixed the issue uncovered by iSEC, but the duo said that talented hackers could find ways to further breach the femtocells, according to Reuters, including those offered by other carriers. In a statement, Verizon Wireless said it routinely monitors its devices for security issues, but is sometimes approached by third parties that have uncovered other security issues. iSEC “identified an issue that was fixed in March of this year on all Network Extender devices,” the company said. “The fix prevents the Network Extender from being compromised in the same manner. There were no reports of any customer impact.” […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , ,
Security

[ISN] Possible breach of DHS employee data has an unusual twist

http://gcn.com/articles/2013/06/03/dhs-data-breach-employee-info.aspx By William Jackson GCN.com Jun 03, 2013 The Homeland Security Department has notified some employees that personally identifiable information used for security clearances and stored in a third-party database could have been exposed to unauthorized users. The notifications came after DHS was alerted to a vulnerability in the vendor software by a “law enforcement partner.” According to a public notice the vulnerability could have been in place for as long as four years but has been addressed after being identified. The department said there is no evidence that the information, which included Social Security numbers and dates of birth, had been improperly accessed, although it is investigating what, if any, personally identifiable data might have been accessed since 2009. The fact that law enforcement was involved raises the possibility that a breach occurred. DHS officials have declined to comment on the incident beyond the public notice. It is not surprising that DHS was notified by a third party of the vulnerability. Most vulnerabilities are discovered by legitimate “white hat” researchers, who usually report them to the software vendor before they are publicly disclosed. In this case, it was law enforcement rather than researchers that appear to have discovered the problem. Whether it was part of an active investigation into a security breach is not known. Many security breaches go unnoticed by victims. According to the Verizon 2013 Data Breach Investigation Report, 69 percent of breaches analyzed in the report were discovered by external parties, and 66 percent of breaches took months or longer to discover. […] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.org


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , , ,
Security

[ISN] China Cyberspies Outwit U.S. Stealing Military Secrets

http://www.bloomberg.com/news/2013-05-01/china-cyberspies-outwit-u-s-stealing-military-secrets.html By Michael Riley & Ben Elgin Bloomberg.com May 1, 2013 Among defense contractors, QinetiQ North America (QQ/) is known for spy-world connections and an eye- popping product line. Its contributions to national security include secret satellites, drones, and software used by U.S. special forces in Afghanistan and the Middle East. Former CIA Director George Tenet was a director of the company from 2006 to 2008 and former Pentagon spy chief Stephen Cambone heads a major division. Its U.K. parent was created as a spinoff of a government weapons laboratory that inspired Q’s lab in Ian Fleming’s James Bond thrillers, a connection QinetiQ (pronounced kin-EH-tic) still touts. QinetiQ’s espionage expertise didn’t keep Chinese cyber- spies from outwitting the company. In a three-year operation, hackers linked to China’s military infiltrated QinetiQ’s computers and compromised most if not all of the company’s research. At one point, they logged into the company’s network by taking advantage of a security flaw identified months earlier and never fixed. “We found traces of the intruders in many of their divisions and across most of their product lines,” said Christopher Day, until February a senior vice president for Verizon Communications Inc. (VZ)’s Terremark security division, which was hired twice by QinetiQ to investigate the break-ins. “There was virtually no place we looked where we didn’t find them.” […] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.org


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , , , , ,
Security

[ISN] Chinese Cyberespionage: Brazen, Prolific, And Persistent

http://www.darkreading.com/attacks-breaches/chinese-cyberespionage-brazen-prolific-a/240153934 By Kelly Jackson Higgins Dark Reading April 30, 2013 China, China, China: New data and intelligence is shedding more light on just how bold and pervasive Chinese cyberespionage activity is today. Tracing malware and breaches to their attackers is not straightforward — anyone can hide behind layers of IP addresses — but China has been confirmed as a major player in cyberespionage in multiple reports this month, as both Verizon and FireEye independently have released data that points the finger at the country for the bulk of cyberspying activity. And even after Mandiant’s exhaustive report on a long-suspected Chinese military link to cyberespionage against U.S. firms that was published in February, the APT1/Comment Crew gang behind that operation appears to be back in action despite the publicity the report drew. The APT1/Comment Crew appears to have done little to change its tactics and methods of attack even after it was unmasked with key intelligence from Mandiant. “I was personally part of the camp that thought these guys would change significantly” after the Mandiant report was published, says Rich Barger, chief intelligence officer with Cyber Squared, which last week unveiled new evidence of the group targeting the defense and aerospace community using many of the same techniques and command-and-control (C&C) capabilities as before. […] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.org


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , ,
Security

[ISN] No ‘One Size Fits All’ In Data Breaches, New Verizon Report Finds

http://www.darkreading.com/attacks-breaches/no-one-size-fits-all-in-data-breaches-ne/240153379 By Kelly Jackson Higgins Dark Reading April 22, 2013 If there’s one big theme of the just-released Verizon Data Breach Investigations Report (DBIR), it’s demographics: all sizes of organizations are getting hacked, and different industries are getting hit for different reasons and with different attack methods. “We shouldn’t have a one-size fits all approach,” Jay Jacobs, senior analyst for the Verizon RISK Team, says is one of the biggest takeaways from this year’s report, which was the biggest one yet in terms of data and sources. “There’s a big difference between [attacks hitting] a retailer and financial institutions versus manufacturers or consultants.” The report, which draws from 621 confirmed data breaches and 47,000 reported security incidents and 44 million compromised records worldwide in 2012 from Verizon as well as the US Computer Emergency Response Team and other national CERTs, the U.S. Secret Service, and law enforcement agencies in Europe, shows that 75 percent of all breaches last year were the result of financially motivated cyberattacks, and 20 percent, cyberespionage for stealing intellectual property or other information for competitive purposes. Hacktivism remained steady, but with more distributed denial-of-service (DDoS) attacks than “doxing” or other forms or data theft. Outsiders again reigned as the top attackers, making up 92 percent of the attackers that hit organizations last year. Next were state-sponsored attackers—the majority from China—with 19 percent of the attacks, and 14 percent were executed by insiders. Financial firms were hit the most, with 37 percent of last year’s breaches, followed by retailers and restaurants, 24 percent; manufacturing, transportation, utilities, 20 percent; and information services and professional services, 20 percent. […] ______________________________________________ Visit the InfoSec News Security Bookstore Best Selling Security Books and More! http://www.shopinfosecnews.org


Facebooktwittergoogle_plusredditpinterestlinkedinmail
Tags: , , , , , , , , , , , , , ,