An online ad network used by the web site of the Reuters news service was the victim of a malicious attack by the Syrian Electronic Army on Sunday. The Syrian Electronic Army claimed responsibility for a malicious ad attack that affected Reuters.com The attack, against the firm Taboola, resulted in visitors to Reuters.com being redirected to a web site operated by the Syrian Electronic Army, a pro- Syrian government group that has taken credit for attacks against The New York Times, The Washington Post, Reuters and other western news outlets in the last year. According to a post on Taboola’s blog, Attackers claiming affiliation with The Syrian Electronic Army (SEA) used a phishing attack to gain access to a Taboola-operated program on Reuters.com early Sunday. The attacker then redirected visitors to articles on Reuters.com to a SEA website.Taboola said it detected the breach at around 7:25 AM East Coast time […]
Recent Posts
This Week In Security: Android’s Security Woes
We’re at the end of another busy week in the security world – a week that saw everything from World Cup themed phishing attacks and, of course, more data breaches: at PF Changs, Domino’s Pizza and AT&T. Among the top stories this week were a number of warnings about attack on Google’s Android mobile device platform. FireEye and Google said they dismantled part of a mobile malware operation that stole online banking credentials from Android users via a malicious and stealthy app posing as Google Play. And a German researcher sounded alarms about Android mobile devices shipping from China that come with pre-loaded malicious software. To help make sense of all the Android badness, we invited Zach Lanier. Zach’s been a frequent guest on Security Ledger Podcast. He’s a security researcher at DUO Security and – fittingly- one of the authors of The Android Hacker’s Handbook, published by Wiley. Zach and I talked about the […]
Update: Another IPMI Mishap? Researcher Claims Supermicro Devices Vulnerable
There’s more bad news for companies that rely on the Intelligent Platform Management Interface (IPMI) to manage servers and other hardware in their IT environments. Specifically: researcher Zachary Wikholm over at Cari.net has published evidence of what he says is a head-slapping vulnerability affecting devices that use IPMI Base Management Controllers (BMCs) made by the firm SuperMicro. According to Wikholm, servers equipped with Supermicro BMCs store a password file, PSBlock, in plain text and – making matters worse- leave it open to the world on port 49152. “You can quite literally download the BMC password file from any UPnP enabled Supermicro motherboard running IPMI on a public interface,” he wrote. Baseboard Management Controllers (BMCs) are small, embedded systems attached to a system’s motherboard that manage IPMI communications. Wikholm says that Supermicro has fixed the problem in the latest version of its IPMI firmware. However, companies are often reluctant to flash […]
Code Spaces Probably A ‘Target of Opportunity’
The spectacular collapse this week of Code Spaces, a cloud-based code repository, may have been the result of a an unspectacular “opportunistic” hack, rather than a targeted operation, according to one cloud security expert. The sudden demise of the online application repository has sent shock waves through the tech industry, laying bare what some say are lax practices among many cloud-based application and infrastructure providers. But the attack itself was almost certainly the result of a larger, indiscriminate cyber criminal campaign, said Jeff Schilling, the Chief Security Officer of Firehost, a Texas-based secure cloud provider. “This is something we pretty frequently: companies get held ransom with a DDoS attack, and if that doesn’t work, (the attackers) will resort to doing other things,” Schilling told The Security Ledger. But Code Spaces almost certainly wasn’t the only company the extortionists worked on, Schilling said. Instead, the company was likely caught up in a wide net […]
U.S. looks to create an ‘Internet of Postal Things’ – Computerworld
There’s an interesting article by Patrick Thibodeau over at Computerworld about how the U.S. Postal Service is soliciting ideas about leveraging Internet of Things technologies throughout its (massive) system. The Postal Service published a solicitation for a “supplier who has the expertise and critical knowledge of the Internet of Things,” as well as (big) data analytics. The goal is to harness data from throughout the Postal Service’s massive infrastructure in order to increase efficiency and lower costs. The U.S. Postal Service is one of world’s most extensive and efficient. But it has also been bleeding red ink in recent years. The Services reported a $15.9 billion net loss in fiscal year 2012 – much of it tied to mandated payments to meet future retiree health benefits. Those losses have narrowed in recent years. In May, the USPO reported a net loss of $1.9 billion in the second quarter and increased […]
