250,000 Twitter Accounts Hacked

Story first appeared on USA Today -

Twitter confirmed Friday that it had become the latest victim in a number of high-profile cyber-attacks against media companies, saying that hackers may have gained access to information on 250,000 of its more than 200 million active users.

The social media giant said in a blog posting that earlier this week it detected attempts to gain access to its user data. It shut down one attack moments after it was detected.

But it discovered that the attackers may have stolen user names, email addresses and encrypted passwords belonging to 250,000 users. Twitter reset the pilfered passwords and sent emails advising affected users.

Bob Lord, Twitter's director of information security, said in the blog that the attack "was not the work of amateurs, and we do not believe it was an isolated incident."

"The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked," Lord said. "For that reason, we felt that it was important to publicize this attack while we still gather information, and we are helping government and federal law enforcement in their effort to find and prosecute these attackers to make the Internet safer for all users."

Twitter's security was compromised in November,when the company publicly acknowledged that hackers had accessed passwords of users though it did not detail how many accounts were affected. It said it had detected the hack and fixed the security vulnerability.

One expert said that this week's Twitter hack probably happened after an employee's home or work computer was compromised through vulnerabilities in Java, a commonly used computing language whose weaknesses have been well publicized.

Ashkan Soltani, an independent privacy and security researcher, said such a move would give attackers "a toehold" in Twitter's internal network, potentially allowing them either to sniff out user information as it traveled across the company's system or break into specific areas, such as the authentication servers that process users' passwords.

In a telephone interview Friday, Soltani said that the relatively small number of users affected suggested either that attackers weren't on the network long or that they were only able to compromise a subset of the company's servers.

The Twitter attack comes on the heels of recent hacks into the computer systems of U.S. media and technology companies, including The New York Times and The Wall Street Journal. Both American newspapers reported this week that their computer systems had been infiltrated by China-based hackers, likely to monitor media coverage the Chinese government deems important.

China has been accused of mounting a widespread, aggressive cyber-spying campaign for several years, trying to steal classified information and corporate secrets and to intimidate government critics. The Chinese foreign ministry could not be reached for comment Saturday, but the Chinese government has said those accusations are baseless and that China itself is a victim of cyber-attacks.

"Chinese law forbids hacking and any other actions that damage Internet security," the Chinese Defense Ministry recently said. "The Chinese military has never supported any hacking activities."

Twitter is generally used to broadcast messages to the public, so the hacking might not immediately have yielded any important secrets. But the stolen credentials could be used to eavesdrop on private messages or track which Internet address a user is posting from.

That might be useful, for example, for an authoritarian regime trying to keep tabs on a journalist's movements.

"More realistically, someone could use that as an entry point into another service," Soltani said, noting that since few people bother using different passwords for different services, a password stolen from Twitter might be just as handy for reading a journalist's emails.

Chinese behind computer hacking attacks at 'The New York Times'

Story first appeared on USA Today -

Chinese hackers repeatedly penetrated 'The New York Times' computer systems over the past four months, stealing reporters' passwords and hunting for files on an investigation into the wealth amassed by the family of a top Chinese leader, the newspaper reported.

Security experts hired to investigate and plug the breach found that the attacks used tactics similar to ones used in previous hacking incidents traced to China, the report said. It said the hackers routed the attacks through computers at U.S. universities, installed a strain of malicious software, or malware, associated with Chinese hackers and initiated the attacks from university computers previously used to attack U.S. military contractors.

The attacks, which began in mid-September, coincided with a Times investigation into how the relatives and family of Premier Wen Jiabao built a fortune worth over $2 billion. The report, which was posted online Oct. 25, embarrassed the Communist Party leadership, coming ahead of a fraught transition to new leaders and exposing deep-seated favoritism at a time when many Chinese are upset about a wealth gap.

Over the months of cyber-incursions, the hackers eventually lifted the computer passwords of all Times employees and used them to get into the personal computers of 53 employees.

The report said none of the Times' customer data was compromised and that information about the investigation into the Wen family remained protected.

"Computer security experts found no evidence that sensitive e-mails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied," the report quoted executive editor Jill Abramson as saying.

The Chinese Defense Ministry asked for questions to be submitted in writing but initially declined comment. The Times, in its report, quoted the Defense Ministry as saying that Chinese law prohibits hacking and other acts that damage Internet security and that accusing it of "cyber-attacks without solid proof is unprofessional and baseless."

China has been accused by the U.S., other foreign governments and computer security experts of mounting a widespread, aggressive cyber-spying campaign for several years, trying to steal classified information and corporate secrets and to intimidate critics. Foreign reporters and news media, including The Associated Press, have been among the targets of attacks intended to uncover the identities of sources and to stanch critical reports about the Chinese government.

"Attacks on journalists based in China are increasingly aggressive, disruptive and sophisticated," said Greg Walton, a cyber-security researcher who has tracked Chinese hacking campaigns. China's cyber-spying efforts have excelled in part because of the government's "willingness to ignore international norms relating to civil society and media organizations," he said.

The Times reported that executives became concerned just before the publication of the Wen investigation after learning that Chinese officials had warned of unspecified consequences. Soon after the Oct. 25 publication, AT&T, which monitors the Times' computer networks, notified the company about activity consistent with a hacking attack, the report said.

After months of investigation by the computer security firm Mandiant, experts are still unsure how the hackers initially infiltrated the Times' computer systems

Boeing Hires Hackers to Secure the Fort

Story first appeared in the Los Angeles Times.

Most weekdays a pair of college buddies ride their bikes to a computer center and try to hack into computer security systems belonging to Boeing Co. Rather than having them arrested, Boeing is paying them to do it — a situation that the car-loving, video-gaming friends have pronounced "awesome."

For two years, the young engineers have worked side by side in a secluded unit where they design and thoroughly test ironclad security systems for the largest aerospace company in the world. Boeing's systems need to be capable of staving off hackers and keeping safe some of the nation's most prized intellectual property.

Like many of their colleagues in surrounding cubicles, the friends spend much of their days devising, revising and analyzing complicated security programs that they then use their well-honed skills to attempt to crack.

The pair from Cal Poly Pomona were hired after they aced a cyber-security competition held by Boeing in which the aerospace giant urged students to consider careers in cyber security and, of course, scouted for fresh talent.

As computer threats become more coordinated and complex, Boeing and other defense contractors are bolstering their cyber-security staffs. Increasingly they are turning to unlikely characters, students who had distinguished themselves more on simulated cyber battlefields than in classrooms. As long as there are computers, there will be somebody trying to attack them.

The damage from hackers to consumers is well known, but the potential for corporate sabotage is far greater, and the need for cyber sleuths like those at Boeing is huge and growing.

Corporate computers serve thousands of employees engaging in different tasks and require layer upon layer of sophisticated security protection.

Those workers need access to the Internet. Although that access enables employees to get the information they need to do their jobs, it also opens a door for hackers to sneak through.

It's not just monolithic corporations at risk. Even small businesses are liable for lost or stolen data. Visa recently stated that 95% of credit card thefts originate at small businesses. Such liability has driven demand for cyber-security expertise.

A generation ago, the brightest engineers in the aerospace industry were typically recruited from Ivy League universities and other prestigious institutions. Now defense contractors are broadening the hiring pool as they hunt for savvy young computer whizzes at local colleges.

Raytheon Co.'s president of intelligence information systems businesses said last year at a conference that her company's most impressive cyber-security hires have come from outside of traditional recruiting outlets.

One recruit was a man who didn't have a college education and didn't graduate from high school. He had a GED and worked at a pharmaceutical plant stuffing pills into bottles.

At night, he participated in online hacker competitions and outperformed others. That person would have not gotten through the normal Raytheon recruiting process.


The Boeing cyber unit is a 3,000-square-foot room with cream-colored walls and floor-to-ceiling windows on a far wall that lets the afternoon sun stream in on row after row of slate-gray cubicles. The work space is a mini-fort of sorts, with 6-foot walls on four sides and small video cameras mounted near the entrance that enable team members to see who is coming their way. It resembles the chaos of a college dorm room. Inside, a tangle of computer wires lies on the floor and papers are strewn about on desks, along with a half-eaten burrito or two.

The techs there enjoy a world full of colorful terms to describe lurking computer threats.

They try to stop "Trojan horses," which enable a hacker to gain access to computers when people click on dangerous links.

They try to squash "worms" that replicate, spread and corrupt computer files.

And they fight "logic bombs" that hide in computers and delete files at a specific time.

Cyber-security professionals have identified tens of thousands of threats aimed at Microsoft Windows programs over the years. If Windows vulnerabilities are found on Boeing's security system, the hackers are responsible for fixing it.


With cyber security risks, if one employee makes a mistake — forgetting to download a security update or clicking a suspicious link — hackers may get all the access they need to cause trouble.

For example, an employee may receive an email with an attachment that appears to be an Excel spreadsheet but in reality is malicious software. Once opened, the file can embed a virus that will record and send back key strokes or other data, such as credit card numbers.

Boeing's cyber-security workers need to know how to counter that attack so even if the virus is launched it will not infect the system. They determine whether the newest, most harmful viruses — which when activated may damage or delete files, cause erratic system behavior, display messages or even erase data — would work on the system.

Boeing's cyber-security team can spend weeks prodding the system on a platform they designed called "cyber range in a box" that simulates the Internet without actually going live on it. They comb through the security system, seeing whether there are new ways to inject harmful code that would change the database content or dump information like credit card numbers or passwords to a hacker.

In this controlled environment, the team can apply what they learn in real-world situations.

Once they find security lapses within the systems, they plug them.


For more organic SEO and web optimization related news, visit the SEO Done Right blog.
For healthcare and medical related news, visit the Healthcare and Medical blog.
For national and worldwide related business news, visit the Peak News Room blog.
For local and Michigan business related news, visit the Michigan Business News blog.
For law related news, visit the Nation of Law blog.
For real estate and home related news, visit the  Commercial and Residential Real Estate blog.
For technology and electronics related news, visit the Electronics America blog.

Investors Don’t Know Companies Were Hacked

First appeared in Reuters

At least a half-dozen major U.S. companies whose computers have been infiltrated by cyber criminals or international spies have not admitted to the incidents despite new guidance from securities regulators urging such disclosures.

Top U.S. cybersecurity officials believe corporate hacking is widespread, and the Securities and Exchange Commission issued a lengthy "guidance" document on October 13 outlining how and when publicly traded companies should report hacking incidents and cybersecurity risk.

But with one full quarter having elapsed since the SEC request, some major companies that are known to have had significant digital security breaches have said nothing about the incidents in their regulatory filings.

Defense contractor Lockheed Martin Corp, for example, said last May that it had fended off a "significant and tenacious" cyber attack on its networks. But Lockheed's most recent 10-Q quarterly filing, like its filing for the period that included the attack, does not even list hacking as a generic risk, let alone state that it has been targeted.

A Reuters review of more than 2,000 filings since the SEC guidance found some companies, including Internet infrastructure company VeriSign Inc and credit card and debit card transaction processor VeriFone Systems Inc, revealed significant new information about hacking incidents.

Yet the vast majority of companies addressing the issue only used new boilerplate language to describe a general risk. Some hacking victims did not even do that.

"It's completely confusing to me why companies aren't reporting cyber risks" if only to avoid SEC enforcement or private lawsuits, said Jacob Olcott, former counsel for the Senate Commerce committee. The chair of that committee, John D. Rockefeller, urged the SEC to act last year.

Stewart Baker, a corporate attorney and former assistant secretary of the Department of Homeland Security, said the SEC guidance was detailed enough that companies that know they have been hacked will "have to work pretty hard not to disclose something about the scope and risk of the intrusion."

Otherwise, "this is an opportunity for enforcement that practically hands the case to the SEC on a platter," Baker said.

Lockheed spokesman Chris Williams said hacking was covered under the company's most recent annual securities filing, which has as one of many risk factors "security threats, including threats to our information technology infrastructure, attempts to gain access to our proprietary or classified information, threats to physical security of our facilities and employees, and terrorist acts."

Williams said the May attack had "no material effect on our business."

Mantech International Corp, CACI International Inc and other defense and technology firms that have been reported by security researchers as hacking victims were likewise silent in their most recent filings. Neither Mantech nor CACI responded to interview requests.

"It's common knowledge" that most large defense contractors have been penetrated, said Olcott.

Sikorsky Aircraft, mindful of a strict New Hampshire law warning individuals at risk of identity theft, wrote to that state's attorney general in August that hackers had gotten into its system and could have accessed Social Security numbers of 55 employees who lived in the state.

Sikorsky said the employee data likely was not the hackers' target, which suggests that they might have been after designs or other trade secrets. But Sikorsky parent United Technologies Corp did not mention the May intrusion in subsequent SEC filings.

"Like other companies, our businesses are subject to (information technology) security attacks at times. We monitor systems and cooperate closely with the government when appropriate," said United Technologies spokesman John Moran.

DEARTH OF CONFESSIONS

Melissa Hathaway, a former intelligence official who led U.S. President Barack Obama's initial cybersecurity policy review and helped push the SEC to enact a disclosure policy, said she was "surprised" at the dearth of new confessions.

"The SEC division of corporate finance has an obligation to ask these companies why they didn't disclose," she said. "We need to have transparency on the state of the situation, and we need to have a national conversation regarding the near-term impact of economic espionage and the long-term health of the nation."

The SEC declined to comment. The agency's guidance officially clarifies previous policy instead of establishing a new rule, a process that takes longer and requires a vote of the commissioners. A person close to the agency said it expects fuller disclosures in annual 10-K filings that will begin appearing in volume this month.

Cybersecurity has been an increasing concern in Washington, and Obama asked during his State of the Union speech for action on legislative proposals. Security experts believe hackers are frequently targeting valuable digital information including strategic plans, blueprints and secret formulas.

But security experts in and out of government have complained for years that most companies don't disclose even very successful hacking attacks, because they never find out about them or simply don't want to spook investors, customers or business partners.

The U.S. National Counterintelligence Executive, in a landmark November report that openly accused China of sponsoring military and economic cyber espionage, said that it is hard for companies to estimate the impact of losses that might not be apparent for years.

One Pentagon contractor that did go into some detail recently about the threat was Northrop Grumman Corp, which warned: "Cybersecurity attacks in particular are evolving and include, but are not limited to, malicious software, attempts to gain unauthorized access to data, and other electronic security breaches that could lead to disruptions in mission critical systems, unauthorized release of confidential or otherwise protected information and corruption of data. These events could damage our reputation and lead to financial losses from remedial actions, loss of business or potential liability."

A few technology companies gave even more specific warnings, including Juniper Networks Inc, which makes gear for routing Internet traffic, and chip-maker Intel Corp. Intel had been one of the few to disclose a successful breach in the past, along with Google Inc, which has complained of attacks originating in China.

In a November filing, Intel repeated that hackers had gotten inside and warned that "the theft or unauthorized use or publication of our trade secrets and other confidential business information as a result of such an incident could adversely affect our competitive position and reduce marketplace acceptance of our products."

Some companies asserted that they had not been hacked, or at least averred that they had not been subject to a "material" or "catastrophic" intrusion.

Others confessed to breaches for the first time, including VeriSign and VeriFone Systems, which said it had experienced "security breaches or fraudulent activities related to unauthorized access to sensitive customer information."

The company did not respond to requests for elaboration. Point-of-sale terminals including VeriFone's models are popular targets for criminal hackers, who can tamper with them in order to record passwords and card numbers.

VeriFone has been reported as a supplier of machines to Michaels Stores Inc, a retail chain of hobbyist stores that had to replace more than 7,000 terminals last year after discovering tampering in 20 states.

Two other companies said they disclosed breaches because of the SEC guidance. Tumi Holdings, the luggage maker that is pursuing an initial public offering, said in a stock prospectus that security systems in some of its retail stores had been compromised in the past.

In an interview, Tumi Chief Financial Officer Michael Mardy said there had been no theft of a database or other massive breach. Instead, he said there had been occasions where store employees had conspired with outsiders on a small scale, for example by giving refunds to people who had not made purchases.

"We felt it was necessary to list as a risk factor because it actually is a risk factor," Mardy said.

University of Phoenix parent Apollo Group Inc, which in the past had noted attempted breaches, for the first time said some attempts had succeeded.

"We are facing an increasing number of threats to our computer systems of unauthorized access, computer hackers, computer viruses, malicious code, organized cyber attacks and other system disruptions and security breaches, and from time to time we experience such disruptions and breaches," it wrote in a 10-Q.

Apollo spokesman Rick Castellano declined to say how extensive the breaches had been. "Cybersecurity is an area of growing area of concern for all companies", Castellano said. "We devote significant resources to manage any potential threat."

Zappos Was Hacked, 24 Million Customers Affected

First appeared in Forbes

Twenty-four million Zappos customers are getting an unpleasant Sunday-evening surprise

The Amazon-owned e-commerce firm has revealed that it was the target of a cyber-attack that gained access to its internal network, including the accounts of 24 million of its users. Though the company says that no complete credit card numbers were revealed in the breach, the intruders may have accessed customers’ names, e-mail addresses, phone numbers, addresses, the last four digits of their credit card numbers, and encrypted passwords. Zappos says it’s taken the precaution of resetting the passwords of all its customers and directing them to set a new password upon visiting the site.

“We were recently the victim of a cyber-attack by a criminal who gained access to parts of our internal network and systems through one of our servers in Kentucky,” the chief executive wrote to Zappos employees in an email posted to the site, declining to offer more information about the breach. ”We are cooperating with law enforcement to undergo an exhaustive investigation.”

Even after choosing a new Zappos password, users should be careful to also change their passwords on any site where they’ve used a similar or identical password, in case Zappos’ intruders are able to decrypt the scrambled passwords they’ve stolen. Zappos is also warning affected customers to watch out for phishing emails that will use their stolen email addresses to spoof official Zappos emails and ask for account credentials or financial details.

The chief executive wrote in his all-hands email that every employee at Zappos’ Henderson, Nevada headquarters will be assisting in the customer response to the breach, and that the company will only be responding to emails rather than phone calls in its effort to answer the massive number of queries that it expects to receive.  ”We’ve spent over 12 years building our reputation, brand, and trust with our customers. It’s painful to see us take so many steps back due to a single incident,” he wrote in the email. “I suppose the one saving grace is that the database that stores our customers’ critical credit card and other payment data was not affected or accessed.”

Zappos customers can change their passwords.