TweakTown NewsRefine News by Category:
Luxury retailer Neiman Marcus recently confirmed a data breach in which an unknown number of in-store shoppers potentially affected from data theft. Prior to Christmas 2013, Neiman Marcus received a report from its credit card processor informing the company of unauthorized payment activity.
Neiman Marcus also didn't disclose what type of personal information is at risk, and didn't' confirm if retailers such as Bergdorf Goodman, and other Neiman Marcus-owned brands that may have suffered a breach.
"The security of our customers' information is always a priority and we sincerely regret any inconvenience," Neiman Marcus officials said in a Twitter statement. "We are taking steps, where possible, to notify customers whose cards we know were used fraudulently after purchasing at our stores."
The Neiman Marcus breach is the second major retailer hit by a significant data breach, after Target confirmed a breach left 70 million customers at risk. Shoppers are increasingly familiar with online shopping threats, but criminals also look to exploit retail stores in an organized effort to steal personal information.
Snapchat is one of the most popular image sharing services in the mobile ecosystem, and today more than 4.6 million users are learning that their contact information has been hacked by unknown persons. A website called SnapchatDB.info has popped up that list out usernames and phone numbers of each account that was compromised.
Originally thought of as a hoax, SnapchatDB.info has been confirmed as real and its creators say that they stole the information and created the website to raise awareness around the security issues surrounding Snapchat. SnapchatDB.info did censor the last two digits of each phone number to reduce spam, and unwanted messages to users, but with only 10 numbers per spot, it would only take a few minutes to figure out which is correct.
A group of hackers who are known as DERP, used DDoS attacks on a few large games and gaming sites, taking a few of them down. EA's home page was victim, Battle.net, League of Legends and Club Penguin were all affected.
It looks like a single gamer by the name of Phantoml0rd is the target of these multiple attacks, with DERP attacking all of the games he streams through Twitch, which include World of Warcraft and League of Legends.
A new DDoS Botnet has the ability to infect both Microsoft Windows along with Linux-based systems, according to the Poland Computer Emergency Response Team (CERT). Unlike many cyber-based attacks, this botnet is only interested in launching DDoS attacks to knock certain servers and websites offline.
The Linux-based botnet reportedly handles dropping servers, while the Windows-based botnet easily hijacked consumer PCs. "Most servers that are injected with these various scripts are then used for a variety of tasks, including DDoS, vulnerability scanning, and exploiting," according to security expert Andre Dimino, in a blog post. "The mining of virtual currency is now often seen running in the background during the attacker's 'downtime.'"
Seeing DDoS attacks to turn zombie PCs into an effective botnet isn't Earth-shattering news, but this cross-platform attack is relatively unique. As bitcoin mining and launching attacks to impact certain companies is easily done when using unsuspecting machines.
Researchers from Johns Hopkins University confirmed it's possible to turn on a laptop's web camera without turning on a light that informs users the camera is on. Just a few years ago, it didn't seem possible to hack a webcam like this, but it's something consumers need to be somewhat vigilant about.
The team focused on Apple MacBook and iMac models available before 2008, but said the exploit can be used on a variety of different models. Although Apple initially opened up communication with Johns Hopkins University to discuss the problem, there reportedly haven't been any further updates.
Using a Remote Administration Tool (RAT), for example, works around the computer's security and remotely controls the computer webcam.
For users worried about being remotely spied on, security researchers recommend simply placing a piece of tape over your web camera when it isn't in use. It may seem like a rather archaic method, but is successful in case the camera has been compromised.
Target today confirmed that 40 million customers might be at risk of credit and debit card fraud, due to cyber criminals reportedly gaining access to the Target system. Customers that made purchases from Nov. 27 to Dec. 15 with a debit or credit card are at risk, with stolen data including customer names, credit and debit card numbers, three-digit security codes, and card expiration dates.
With a data breach nationwide, it seems unlikely that a credit card skimmer device was used - and seems more likely that criminals accessed the company's servers - or installed malware on point-of-sale machines. The company is now working with a third-party forensics team to identify how the breach occurred, and to ensure it doesn't happen again in the future.
Customers should contact their banks and the Federal Trade Commission (FTC) if any fraudulent activity is detected. The U.S. Secret Service and Federal Bureau of Investigation (FBI) are currently helping with the ongoing investigation. Online Target shoppers do not need to worry about the data breach.
Bogdan Alecu, a system administrator at Dutch IT services company, Levi9, has discovered an issue that leaves Google Nexus devices open to DDoS attacks that would reboot the smartphone, or fail to connect to mobile Internet services.
Alecu discovered the issue in all Android 4.x firmware versions of Google's Nexus, Nexus 4 and Nexus 5 smartphones. If a Nexus smartphone was to receive the message, it would display itself on top of every other active window, and is surrounded by a semi-transparent black overlay that has a dimming effect on the screen. If this message isn't saved, or dismissed, a second message is received, which is placed on top of the first message, and the dimming effect continues.
These messages will hit the Nexus phones without a notification, so if they're being sent when you're asleep, or the phone is in your pocket, you'll be none the wiser. Most of the time, Alecu says the phone will reboot, and if a PIN is required to unlock the SIM card, the phone won't connect back to the network for hours. During this time, the phone is useless, as it is unable to receive messages, phone calls, or any other notifications.
Alecu is taking his findings to the DefCamp security conference in Bucharest, Romania today.
If you happened to visit WhatsApp's website early this morning, you might have noticed things looked a little bit different. Some time in the wee hours of Thursday morning, a pro-palestinian message replaced the websites homepage with political rhetoric and the message "You Got Pwned."
The hacker group known as KDMS Team took responsibility for the hack, and boasted that "no security measures could stop them from attacking again." The hack was not a direct intrusion of the company's web server, but rather an exploit conducted on the website's DNS records to spoof the DNS and hijack the website's URL. As of this writing, WhatsApp's website has been restored to normal and no further attacked on the messaging service have been reported.
Adobe has been hit with a cyber attack, with the hackers taking information from up to 2.9 million Adobe customers. The hackers were able to access Adobe IDs and encrypted passwords, but customer names, encrypted debit and credit card numbers, expiration dates and order information was stolen.
As you can imagine, this is quite bad. Adobe says that the intruders most likely didn't access any decrypted information, which means your credit card details should be safe. The 2.9 million affected customers will see their passwords reset, with Adobe offering one year of free credit card monitoring to make sure that malicious purchases aren't made.
A separate, but possibly related attack also saw the source code to a number of Adobe's products taken, including Acrobat and ColdFusion. Adobe says there is no "specific increased risk to customers" due to its source code being stolen.
There has been a complaint filed in a San Jose federal court, with a group of people alleging that LinkedIn hacked into their e-mail accounts and took their contact lists so that LinkedIn could send spam-like e-mails.
The suit claims that "Linkedln is able to download these addresses without requesting the password for the external email accounts or obtaining users' consent." The complaint argues that this is hacking, since "the users' email accounts and downloading of all email addresses associated with that users' account is done without clearly notifying the user or obtaining his or her consent."
Once the e-mail account is hacked, endorsement e-mails follow. The document goes on to explain: "These endorsement emails contain the name and likeness of those existing users from whom Linkedln surreptitiously obtained the list of email addresses." We don't know how LinkedIn is hacking into these accounts, but the suit has claimed that LinkedIn "pretends" to be its users in order to download contact lists "if a LinkedIn user leaves an external email account open."