DDoS Attack and Flight Plan modified?

I understand DDoS Attack but, I feel bad and insecure that (if it is true that) the hackers were able to modify the flight plans

From the article:

On Sunday someone was able to infiltrate the computer system of the Polish airline LOT and successfully cancel 10 of the carrier’s flights. A dozen other flights were reportedly delayed, according to Reuters. 

“Initially, it seems that flight’s plan couldn’t be generated which may indicate that key nodes in the back office were compromised,” Santamarta said Monday. “On the other hand the inability to perform or validate data loading on aircraft (including flight plans), using the standard procedures, should make us think of another attack vector, possibly against the ground communication devices.”

“What if the incident was just a training action or reconnaissance operation before a more massive cyber-attack on a much busier airport like Charles de Gaulle in Paris or JFK in New York?” Nikishin said. “Regardless of the reason and the threat actors, we can see how our life depends on computers and how vulnerable to cyber-threats national critical infrastructure objects have become.” 

For More info

https://threatpost.com/polish-planes-grounded-after-airline-hit-with-ddos-attack/113412

Apple's Keychain hacked

Nothing is unbreakable so, we better have plans on what to do and how to detect/suspect if our accounts are compromised.

After all we are responsible for securing our stuff

From the article

Six university researchers have revealed deadly zero-day flaws in Apple’s iOS and OS X, claiming it is possible to crack Apple’s password-storing keychain, break app sandboxes, and bypass its App Store security checks.

The team was able to upload malware to the Apple app store, passing the vetting process without triggering alerts. That malware, when installed on a victim’s device, raided the keychain to steal passwords for services including iCloud and the Mail app, and all those stored within Google Chrome

The sad part is, Apple was notified about this 6 months ago and still haven’t fixed it – the only fast moving response came from Google’s Chromium security team who removed keychain integration for Chrome, noting that it could likely not be solved at the application level.

For more details

http://www.darknet.org.uk/2015/06/apples-password-storing-keychain-cracked-on-ios-os-x/

600 million Samsung devices could be vulnerable

Security - What is it ?, who needs it?

From the article:

NowSecure estimates that 600 million devices could be vulnerable, including the Samsung Galaxy S5 on Verizon and the S4 Mini on AT&T. Newer devices are also still affected, despite patches pushed out by Samsung. 

The Swift keyboard updates (generally language pack updates) are sent over HTTP, and therefore an attacker with network access is able to access the update and inject a malicious app or tamper with other resources on the phone, giving him access to email, contacts, images and other personal data stored on the phone. A more sophisticated actor could also eavesdrop on phone calls or steal text messages from the device.

(More bad news)

“To date, we’re not seeing devices patched,” Hoog said. “Samsung said the Galaxy 6 running on Android 5 (Lollipop) were not vulnerable. On a pure whim, we spent $1,000 on new devices last week in order to verify and we were surprised to see the vulnerability still there. Even though it’s been patched since March by Samsung, it has not made it to new devices.” 

For more details:

https://threatpost.com/samsungs-swift-keyboard-update-mechanism-exposes-600m-devices/113348

User credentials stored in plaintext in GmbH Nova-Wind Turbine - Can cause a loss of power for all attached systems

Lazy programmer + Bad Tester (if there was any testing at all)


From the article:

Researcher Maxim Rupp discovered the vulnerability in the Nova-Wind Turbine HMI and reported it to the vendor. However, the vendor has been unresponsive

The vulnerability results from the fact that the software stores user credentials in plain text.

“Successful exploitation of this vulnerability allows the ID to be retrieved from the browser and will allow the default ID to be changed. This exploit can cause a loss of power for all attached systems,” an advisory from ICS-CERT says. 

For more details:
https://threatpost.com/plaintext-credentials-threaten-rle-wind-turbine-hmi/113354

Cloud based Password Manager - Really do people trust the Cloud so much, Anyway they were breached

I am not against cloud.
But, I won't trust  (at least, for now) the cloud t to the point of saving my passwords in the cloud .
Looks like they had multi-factor authentication. (At least, they have it NOW)

They claim to have strong encryption but, TRUST without VERIFY is not RELIABLE.



From the article

Password manager LastPass disclosed today that its network was breached and advised users to change their master passwords and enable multifactor authentication.

Tod Beardsley, security engineering manager at Rapid7, pointed out that since the attackers don’t seem to have access to the passwords encrypted with the master, the stolen account email addresses may pose a more immediate risk. 

For more info:

https://threatpost.com/lastpass-network-breached-calls-for-master-password-reset/113324

Duqu v2 - Using stolen certs, what's even more scary is the attackers might have more stolen certs

Attackers are getting smarter. A attack like this can be detected but, validating it is hard as they are

1. Using stolen certs
2. Use different certs at different times

From the Article.
The way that the certificates are used by the Duqu attackers is somewhat unusual. Rather than using one certificate for multiple modules or drivers, the group seems to have access to a sizable cache of stolen certificates and use each one just once

Another interesting observation is that besides these Duqu drivers we haven’t uncovered any other malware signed with the same certificates. That rules out the possibility that the certificates have been leaked and are being used by multiple groups. It also seems to indicate the Duqu attackers are the only ones who have access to these certificates, which strengthens the theory they hacked the hardware manufacturers in order to get these certificates,

Duqu attackers are also careful enough not to use same digital certificate twice
For more info:https://threatpost.com/duqu-2-0-attackers-used-stolen-foxconn-certificate-to-sign-driver/113315

You know the history of Internet - Do you know the history of Internet (In)Security?

Here is a two part series from Washington Post.
It is a wonderful read.


Part-1
http://www.washingtonpost.com/sf/business/2015/05/30/net-of-insecurity-part-1/


Part-2
http://www.washingtonpost.com/sf/business/2015/05/31/net-of-insecurity-part-2/