Burger King has had its Twitter account hacked today. It promptly tweeted out that the company had been purchased by McDonalds. The Profile picture and cover photo were changed out to make this more believable. Twitter accounts are hacked all the time, but they usually aren't the high profile brand profiles.
Twitter sells itself as a brand-friendly social network. With a high-profile hack such as this, some of the brands could start to rethink their reliance on the site. With the potential implications aside, let's take a look at some of the hilarious tweets pushed out while it was hacked.
The account was suspended by Twitter around 1:35p.m. EST. The hack appears to have been orchestrated by someone in the Anonymous collective, though why they would go after Burger King isn't immediately clear. Whatever the reason may be, we're glad they were making funny tweets instead of vulgar ones.
Proving that everyone is susceptible to weak passwords, the hoax zombie alert that went out across multiple stations' emergency alert system is being blamed upon the stations not changing the default password to the system. This allowed the still-unnamed prankster to hack into the system and send out the fake alert.
Most people weren't too concerned with the fake alert. In fact, it seems that the stations are more concerned with the fact that the system was able to be compromised. According to Cynthia Thompson, station manager for Michigan's ABC 10 affiliate, "the nature of the message Monday night was not necessarily dangerous, but the fact that the system was vulnerable to outside intrusion IS a danger."
If the prankster had wanted to cause more panic, a fake terrorist attack message or natural disaster message would have likely proved more effective. This is where the real concern comes into play as someone wanting to cause real issues could display a message such as that. Reportedly two products from one of the main EAS vendors is susceptible to compromise even after the default password has been changed.
Officials from the United States Federal Reserve have confirmed that hackers stole information from its servers. The information, which was released by Anonymous, was gleaned from a security vulnerability in a website vendor product. The hole has since been patched and never gave access to any critical data.
The information apparently came from a contact database that was kept in case of a natural disaster. A breach of the Federal Reserve servers will certainly shine a spotlight on the agency and cause the public's trust in the Federal Reserve to decline. Furthermore, this should cause the public to question security measures of other top agencies.
The Federal Reserve has actually been compromised before this occasion. Back in 2010, Malaysian hacker Lin Mun Poo hacked into the US Reserve and stole data with the intent to use it to steal money.
Anonymous target bank executives in their latest attack, unleash personal information of over 4000 executives
Anonymous have struck again, this time into the hearts of US banking executives - over 4000 of them. These 4000+ bankers have had their personal information leaked in Anonymous' latest campaign dubbed Operation Last Resort.
Anonymous' campaign is designed to provoke computer crime law reform after the suicide of Internet activist and Reddit co-founder Aaron Swartz. Anonymous have reportedly hacked into the Alabama Criminal Justice Information Center's website over the weekend, where they used the site to host the spreadsheet of the executives' information. This spreadsheet includes the information of bankers' names, phone numbers, computer log-in credentials and IP addresses.
The Twitter account of Anonymous talked about getting the information from Federal Reserve computers, and when contacted for a comment by the Huffington Post, a spokesperson refused to comment on Anonymous' claims, nor would they confirm if a statement was on its way.
In another example of the future being cyber terror and cyber warfare, the US Department of Energy has announced that it was hacked mid-January. The hack reportedly affected several hundred employees, though the agency says that "no classified data was compromised."
This story comes on the heels of The New York Times announcing that they had been the target of Chinese hackers after running a story about the new president of China. The hack appears to have only provided the hackers with personal data of employees, though there is cause for concern as the Department of Energy oversees the US's nuclear research.
The hackers have not been identified, though it appears that they may not be connected with any countries that have previously been accused of hacking.
Just over 24 hours ago we reported that Twitter was experiencing a global outage, but more information has been released by Twitter where they've announced that they were actually victims of some attacks this week.
Twitter took to their company blog where they said during the week they had detected "unusual access patterns" that led them to see that unauthorized attempts to access users' data was made. Twitter actually discovered one attack as it was happening, where they were able to quickly shut it down shortly after.
The social networking site said that the attackers may have had access to information for close to 250,000 different users. Twitter added "usernames, email addresses, session tokens and encrypted/salted versions of passwords" would have been available.
Twitter have since reset the passwords and revoked session token for all affected accounts, with affected users to expect an email notifying them of the reset. Because of the hack, Twitter have taken the time to "echo" the recent advisory by the Department of Homeland Security, who have told users to disable Java on their systems for the best security.
We hope you're brushed up on your hacking skills, as Mega founder (we can't really keep saying MegaUpload founder now, can we?) is offering up a bounty for the first person to break into Mega.
Dotcom is offering a very tidy 10,000 euros (or roughly $13,580) for the first person to break into Mega, where he has offered up the prize for enterprising hackers after the site was criticized for the way it handles security. Mega launched just under two weeks ago now and has since taken 50 million files from users.
Dotcom's bounty offer is a good way to get hackers to break through their security so that they know what to patch up, but we should expect this from a 'beta' of a cloud storage site.
The Pentagon has approved an increase in cyber security staff that would see an increase in the number of staff from around 900 to roughly 4,900. The 4,900 staff members would be composed of both military and civilian personnel and is possibly in response to events such as Anonymous' attack on the US DOJ or the finding of malware on power plants' computers.
Future wars are likely to be conducted in cyber space rather than on the ground with traditional troops and weapons, so it will be important for the US to have a large enough security force that is well trained to protect itself from these future threats. Defense Secretary Leon Panetta acknowledges that the US hasn't invested enough in cyber security:
"We've got good people that are involved in it, but, very frankly, if we're going to stay on the cutting edge of what's happening with regards to the chances that are occurring, we have to invest more in that area," Panetta said in a speech last November.
Google wants hackers to compromise Chrome OS at Pwnium 3 competition, $3.14159M in prizes offered up
Google is one of the leaders when it comes to offering bug bounties. At Pwnium 3, Google has brought lots of money to the table to ensure that Chrome OS is the most secure it can possibly be. By offering up $3.14159 million in prizes, Google hopes to entice the world's best hackers to compromise Chrome OS before someone with bad intentions can.
Prizes will be in two different levels:
- $110,000: browser or system level compromise in guest mode or as a logged-in user, delivered via a web page.
- $150,000: compromise with device persistence - guest to guest with interim reboot, delivered via a web page.
If a hacker is unable to do that, Google isn't hanging them out to dry. Partial awards will be offered for incomplete or unreliable exploits. Attacks must work against a Samsung Series 5 550 Chromebook running the latest Chrome OS if the hacker wishes to collect the prize.
Pwnium 3 will be held at CanSecWest in Vancouver, BC, on March 7. The competition will run at the same time as Pwn2Own, which is taking place at the same place from March 6-8.
Aaron Swartz took his life a couple of weeks ago and we have now seen hacktivist collective Anonymous making a strategic move by hacking a US government website related to the justice system.
They posted on the site informing everyone they would begin leaking a cache of government documents if the justice system is not reformed. Anonymous hacked the website for the United States Sentencing Commission late Friday, where they posted a message about what they're calling "Operation Last Resort", which included a bunch of downloadable, but encrypted files that they say contain sensitive information.
Anonymous' statement reads:
Two weeks ago today, a line was crossed. Two weeks ago today, Aaron Swartz was killed. Killed because he faced an impossible choice. Killed because he was forced into playing a game he could not win -- a twisted and distorted perversion of justice -- a game where the only winning move was not to play.
The United States is again the best at something, though this probably isn't something we want to be the best at. According to data from McAfee, the United States is home to the largest number of botnet servers in the world. Botnet servers are the servers that send commands and receive data back from computers that have been compromised by attackers.
The list may not be completely accurate as often times owners of these botnet C&C servers try to mask their location by using proxies and other methods. However, McAfee's data shows that 631 C&C servers are located in the United States, which is more than two and a half times greater than the British Virgin Islands.
The British Virgin Islands is second on the list with 237 servers. Netherlands, Russia, Germany, and Korea follow with 154, 125, 95, and 81 servers, respectively. The map above shows the number of botnet servers around the world, according to McAfee's data. In the US, it appears the servers are mainly located in Los Angeles, California and Washington DC.
US government declares June 1st and 2nd "National day of Civic Hacking", invites hackers to help improve the country
June 1st and 2nd have officially been named National Day of Civic Hacking. NDCH is a national event in which citizens of all schools of hacking are invited to collaborate with developer and entrepreneurs from all corners of the nation to create, build, and invent new solutions using pubically released code, data and technology to better their community.
The National Day of Civic Hacking will give American's a chance to get back to their roots, roll up our sleeves, and create solutions to problems in their communities. The event will utilize the expertise, knowledge and DIY spirit of those outside of federal, state and local governments.
The source listed below includes a list of participating cities, and even if you are not near one of those, there most likely will be many web based events where you can participate. My local metropolis of Augusta, GA will be one of the host cities and I am sure my local Maker Space, The Clubhouse, will be hosting something as well. So check with your local Hacker Spaces, Maker Spaces, and Tech Clubs to see if they too will be hosting an event.
Last year, two US power plants were infected by malware that was brought into the system by USB drives. This is according to the US Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) as this is their job to protect and respond to security issues such as this. These latest events just add fuel to the growing fire over whether or not key infrastructure is secure.
ICS-CERT has said that the two power plants were targeted by "sophisticated" attacks. ICS-CERT added that these are common and are expected to continue increasing with time.
One technician uploaded the virus to one power plant while attempting to update software on the system. The other plant was infected by a USB used to back up control systems configurations. He reported issues with the drive and IT staff found the malware present on the drive.
The systems were taken offline for around three weeks while the problems were sorted out. This goes to show just how much of a problem malware could be to key infrastructure systems in the future.
Java seems to be one of the most exploited pieces of software running on a computer. Unfortunately, most computers are running Java for websites and other interactive features online. Just earlier this week, Oracle had to rush out a patch for Java that secured up a critical bug that allowed hackers to run code on a victim's machine.
An administrator for an exclusive cybercrime forum posted up Monday an offering for a new zero-day exploit that has yet to be patched by Oracle. It also has yet to be rolled into one of the exploit kits, some of which rent for upwards of $10,000 a month. The starting price for the exploit? $5,000.
For those developers who supported the Google Glass project early on by ponying up $1,500 to buy a developer set, Google will be hosting two hackathons, one in San Francisco and one in New York City, where early backers will be able to go hands on with early prototypes of the wearable computing devices.
Google's hackathon in San Francisco will take place January 28 and 29 and the hackathon in New York City will take place shortly after on February 1 and 2. The events are called Glass Foundry, a fitting name for the hackathons, and both events appear to follow the same agenda.
The first day will introduce the device and let developers use it on-site. After that, the hackathons will dive into the Mirror API and development with Google engineers at attendees' sides to answer any questions. Space is limited, so if you put out the $1,500 to get an early pair, you should get in contact with Google before all the slots are taken.
The Red October cyberespionage attacks were thought to have used Excel and Word exploits solely, but new data by a different set of researchers suggest that a Java exploit was also used to spread the infection. Israeli IT security firm Seculert was analyzing the Command and Control servers for the attack and found a special folder containing a malicious Java applet.
The applet used an exploit that was patched back in October 2011, which suggests that the attackers preferred older, known vulnerabilities and not zero-day ones. The applet was compiled in February 2012, which furthers this theory. This discovery is being credited to the fact that the attackers switched from a PHP server-side scripting language to CGI on the C&C servers.
They left up older PHP-based attack pages, which allowed the source code to be viewed. Full analysis is now impossible as the attackers have shut the C&C servers down, likely to cover their tracks.
Kaspersky of all companies have found something utterly shocking, an advanced cyber espionage network that makes last year's infamous Flame malware look like a joke. Dubbed Operation Red October, each attack is handcrafted for its victim in order to make sure it 100% works.
Red October has been hitting systems across the world since at least May 2007 and carefully chooses its victims spanning over two dozen countries who hold positions in government, military, aerospace, research, trade and commerce, nuclear, oil and other important, vital industries. Investigators aren't sure who is behind the attacks, but it is being reported that Chinese hackers may have created the exploit, while the various malware modules deployed seem to have been created by those who speak Russian.
Kaspersky can't put their finger on the source, as it is currently being run through at least two layers of proxy servers across Russia, Germany and Austria. Whoever is involved has some skill, as they've been silently sitting, unknown to the user, in major government and industry computers.
Internet Explorer was discovered to have a vulnerability that would allow hackers to gain control of a Windows PC late last month. In order for the exploit to work, users had to be running an older version of the program, versions 6 to 8, specifically, and have visited a malicious website.
Microsoft attempted to remedy the problem with various workarounds and a "one-click fix," all of which are temporary workarounds. Normally, bugs and exploits would have been addressed during Microsoft's normally scheduled Patch Tuesday, though when it didn't come, IT professionals began to wonder when it would.
We now have the answer: today. The patch should be available through Windows Update and marked as 'Critical', meaning it will be automatically installed, as long as the user has Automatic Updates enabled. If you use an older version of Internet Explorer, pre-version 9, you should make sure you install the update, especially if you don't have Automatic Updates enabled.
There's a new exploit on the block which has pushed security experts to recommend that users disable or uninstall Java altogether after they've found a zero-day Java exploit which lets hackers gain control of your PC.
The exploit targets a vulnerability left open in Java 7 Update 10, which was released in October 2012. The exploit works by getting Java users to visit a website that has malicious code, which takes advantage of a security gap to take control of users' computers.
Just after this story broke, Oracle pushed out Java SE 7 Update 11 which supposedly addressed the exploit. Oracle "strongly recommends" that Java SE 7 users upgrade immediately.
The tragic supposed suicide of digital activist, and co-founder of Reddit, Aaron Swartz happened just days ago and now Anonymous have stepped into the ring to play [hacking] ball. They leave a tribute message to Swartz, which says:
We tender apologies to the administrators at MIT for this temporary use of their websites. We do not consign blame or responsibility upon MIT for what has happened, but call for all those feel heavy-hearted in their proximity to this awful loss to acknowledge instead the responsibility they have - that we all have - to build and safeguard a future that would make Aaron proud.
The link to see it is here, and at the time of writing wasn't loading. I'm sure MIT will have the site updated shortly.
During the 2012 holidays, PayPal's website was the most phished, with it receiving nine times more phishing sites than the next closest site. According to data by Trend Micro, PayPal had 18,947 phishing sites created during December 2012. Wells Fargo, the second place site, only had 2049, a far cry from PayPal.
Trend Micro says shopping online, while more convenient, puts you at a much greater risk of having your personal information stolen. Often, these phishing sites install malware onto the unlucky user's system. This year's malware for the PayPal sites was TROJ_QHOST.EQ, while Citibank sites infected users with WORM_CRIDEX.CTS.