TweakTown NewsRefine News by Category:
South Korean Internet users interested in downloading copies of "The Interview" should be worried, as people are having their devices infected while trying to download the movie. Specifically, a Google Android mobile app, available for smartphones and tablets, has been circulating promising access to a pirated copy of the movie - but is instead stealing banking details, according to researchers from McAfee Labs, Center for Advanced Security Research Darmstadt, and Technische Universitate Darmstadt.
"It contains an Android Trojan detected by McAfee products as Android/Badaccents," according to cybersecurity expert Graham Cluley. "Android/Badaccents claims to download a copy of 'The Interview' but instead installs a two-stage banking Trojan onto victims' devices."
The malware targets Korean banks and Citi Bank, with stolen credentials then sent to a Chinese server. The app was reportedly hosted using the Amazon Web Service (AWS), but Amazon has denied the claim. Researchers say the malicious app has been downloaded more than 20,000 times.
Even with a growing number of cybersecurity experts thinking an insider attack is more likely in the demise of Sony Pictures earlier this year, the FBI continues to blame North Korea. US government officials said there are no alternate leads in who was behind attacking Sony, despite arriving at the conclusion North Korea was behind the attack.
The FBI issued the following statement: "The FBI has concluded the government of North Korea is responsible for the theft and destruction of data on the network of Sony Pictures Entertainment. Attribution to North Korea is based on intelligence from the FBI, the US intelligence community, DHS, foreign partners and the private sector. There is no credible information to indicate that any other individual is responsible for this cyber incident."
However, cybersecurity experts were amazed how quickly the FBI was able to point fingers towards North Korea, as noted by a Norse cybersecurity official: "When the FBI made the announcement so soon after the initial hack was unveiled, everyone in the [cyber] intelligence community kind of raised their eyebrows at it, because it's really hard to pin this on anyone within days of the attack."1
Companies must learn from the mistakes made by Sony Pictures leading up to a data breach carried out by the Guardians of Peace - and that should translate to increased network security and better training for employees. In addition to the stolen movies and leaked employee personal information, embarrassing emails sent and received among executives at the company caused an additional layer of an expanding public relations nightmare.
"Now you have to operate under the mindset that my email is not confidential," said Frank Mong, GM of enterprise security solutions with Hewlett-Packard, in a recent interview published by the San Jose Mercury News. "We should all live with a little more paranoia when we do these things - ask, 'Is this really legitimate?' Should I really be clicking that?"
While the SPE breach is an ideal learning opportunity, many companies will refuse to make adjustments and could be next in line to suffer an incident. Companies need to create guidelines that force employees to use more complicated passwords, and hire third-party cybersecurity firms to educate employees on identifying phishing and spear-phishing attacks.
The Guardians of Peace, the cybercriminal group behind crippling Sony Pictures, reportedly sent threats to a U.S.-based news organization. The FBI bulletin refers to the company as "USPER2," so it remains unknown which company was targeted.
The posted threat was published on Pastebin, taunting the FBI and the unnamed media organization "for the 'quality' of their investigations," according to the GOP statement. Unfortunately, many ad servers don't support newer encryption technologies, so media outlets are vulnerable to potential hijacking - and it's something that clever cybercriminals are clearly aware of.
"As part of our ongoing public-private partnerships, the FBI and DHS routinely share information with the private sector and law enforcement community," according to an unnamed military source, speaking to journalists. "The FBI and DHS are not aware of any specific credible information indicating a threat to entertainment or news organizations, however, out of an abundance of caution, we will continue to disseminate relevant information observed during the course of our investigations."
Third-party WordPress plugins, extremely popular among millions of WordPress users, leave the door open for cybercriminals to exploit threats. Unfortunately, many people install new plugins and simply leave them be - without installing updates or ensuring security protocols are met - and that makes it even easier to compromise websites, databases, and users.
"WordPress is extremely powerful, and while the popularity creates a lot of opportunities for development, it also attracts hackers,"said Tony Baker, Internet Assure director, in a press statement. "There are thousands of extremely popular plugins that create vulnerabilities within these sites, and quite frankly, most WordPress self-hosted websites are set up without any thought to security."
As security becomes significantly more important for WordPress websites, vulnerabilities and code exploits will remain major security concerns. It's recommended for inexperienced website owners to rely on GoDaddy, BlueHost, Site5, and established hosting services to help host the site, as they have internal security protocols in place to keep track of security threats.
A member of the Lizard Squad hacker group, saying his name was "Ryan Cleary," told the Washington Post that his group played a role in handing over usernames and credentials used by Sony Pictures.
"Well, we didn't play a large part in that. We handed over some Sony employee logins to them. For the initial hack. We came by them ourselves. It was a couple."
Unfortunately, the interviewer didn't press the Lizard Squad member any more regarding the breach, which the FBI and cybersecurity experts can't seem to agree upon who is truly behind the attack.
The Lizard Squad hacker group had a member arrested by the South East Regional Organized Crime Unit (SEROCU), with additional reports indicating the member is 22-year-old Vinnie Omari. His house was raided on Monday and police searched for "email addresses, usernames, passwords, documents containing names associated with PayPal fraud."
Police also want to tie him to recent Lizard Squad attacks, including distributed denial of service (DDoS) attacks suffered by Microsoft's Xbox Live and Sony's PlayStation Network. His laptops, Xbox One game console, smartphone, and USB memory drives were confiscated.
"The South East Regional Organised Crime Unit has arrested a 22-year-old man from Twickenham on suspicion of fraud by false representation and Computer Miseuse Act offences," according a press release. "The arrest yesterday is in connection with an ongoing investigation in to cyber fraud offenses which took place between 2013 and August 2014 during which victims reported funds being stolen from their PayPal accounts."
It took a number of data breaches and cybersecurity incidents throughout 2014, many of them suspected of being funded and supported by foreign government states, for American Internet users to realize the great threat of cyberattacks. Looking ahead to 2015, however, cybersecurity experts believe so-called cyberwars will accelerate as additional nations begin to flex their digital muscle.
"Experts have been calling it a 'cyber Cold War' for some time, and that's only ramping up quickly," said Chris Peterson, co-founder and CTO of the LogRhtym security intelligence company, in a statement published by NBC News. "Nation-states both weak and strong see cyberattacks as a weapon to counter the global influence of the U.S."
Cyberespionage attacks will surge in 2015, especially becoming smaller nation states and terror groups, according to McAfee. Smaller countries with less-established military power hope to use cyberattacks to help try to level the playing field, while stealing data and interrupting operations of political rivals.
South Korean security officials have removed a "low-risk" worm that was installed on devices linked to the country's nuclear plant control systems. Nothing harmful was discovered on reactor controls, according to officials, despite the recent data breach.
"We will prepare fundamental improvement measures by enhancing nuclear power's safe operation and hiking information security systems to the highest level following this cyber attack case," the Korea Hydro and Nuclear Power company said in a statement.
Korean officials want cooperation from the Chinese government during its investigation of the cyberattacks - with China or North Korea on the short list of foreign states that could be involved. A hacker threatened to close three reactors via Twitter, though only non-critical data was stolen as part of the breach.
The FBI is now investigating the Lizard Squad for its participation in bringing down Microsoft Xbox Live and Sony PlayStation Network via distributed denial of service (DDoS) attacks over Christmas. Published media statements say "Ryanc," a Finnish teenager identified as Julius Kivimaki, as one reported member of the Lizard Squad group - but identifying other members has proven difficult.
"The FBI is investigating the matter," according to a bureau spokesperson when speaking to GamesBeat. "Given the pending nature of the case, we cannot comment further."
Not surprisingly, the Lizard Squad doesn't appear ready to change its cyber activities anytime soon:
* yawn * http://t.co/Dj79R0UJGs- R.I.U. Lizard Squad (@LizardMafia) December 30, 2014