Banks Hacked- News gets more and more interesting

Apparently it is 7 banks now

Some had their records deleted




The link below has more information:-


http://www.cnet.com/news/jpmorgan-hackers-altered-deleted-bank-records-says-report/

DLP function now available for SharePoint (Office 365)

We know it is available for Exchange now it is extended to SharePoint

From the Article

Microsoft has extended the data loss prevention features in Office 365 so that they are available not only for its email tools but also for data in SharePoint Online and OneDrive for Business.

Administrators will be able to search for content across SharePoint Online and OneDrive for Business, zeroing in on 51 predefined sensitive information types, like credit card numbers, passport data, and Social Security information. If they identify policy breaches, they'll be able to export a report and take the appropriate action. DLP tasks are managed from Office 365's eDiscovery Center console.

Follow this link for additional details:

http://www.infoworld.com/d/cloud-computing/microsoft-rolls-out-dlp-sharepoint-online-and-onedrive-business-249318

New member to the list of credit card hacked companies - it is UPS now

News might be new but

It started infiltration started in January and attacks in March

And...........

We only know now

Customers’ credit and debit card information at 51 franchises in 24 states may have been compromised.


Follow this link for additional details:

http://time.com/3151681/ups-hack/

How to steal encryption keys - Just by touching the computer !!!

I did not know that we are born with embedded hacking tools (I am excluding the Brain here).

From the Article

There are flaws and weaknesses in human flesh and bones that make it easier than it should be to force someone to offer up the key to decrypt something.

This research is a side-channel attack. The metal parts of a laptop, such as the shielding around USB ports, and heat sink fins, are notionally all at a common ground level. However, this level undergoes tiny fluctuations due to the electric fields within the laptop. These variations can be measured, and this can be used to leak information about encryption keys.

the researchers also experimented with using a smartphone connected to Ethernet shielding via its headphone port, and found that this was sufficient to perform some attacks.

Robust protection is hard to do, because 

1. The side-channel is largely a feature of the hardware. 
2. Faraday cages can protect against electromagnetic side channels, 
3. insulation can protect against this kind of "touching metal parts" attack, 
4. optical fibres can protect against measuring fluctuations in Ethernet connections

but all these drive up costs and are of limited practicality.

Follow this link for additional details:

http://arstechnica.com/security/2014/08/stealing-encryption-keys-through-the-power-of-touch/

Hacking Traffic Lights Is Apparently Really Easy

It is not the headline that bothered me.

What shocked me is what makes it easy

The Michigan team identified three main weaknesses in traffic control systems in the U.S.: 

1. use of un-encrypted wireless communication signals 
2. default usernames and passwords, 
3. use of a traffic controller—the machine that interprets sensor data and controls lights and walk signs, etc.—that is vulnerable to known hacks.

Follow this link for additional details:

http://time.com/3146147/hacking-traffic-lights-is-apparently-really-easy/

NUKE REGULATOR HACKED BY SUSPECTED FOREIGN POWERS

Not once but, THRICE.

The methods adopted by the hackers is really interesting

1. Malware in the cloud
2. Email from legitimate account

From the Article

Nuclear Regulatory Commission computers within the past three years were successfully hacked by foreigners twice and also by an unidentifiable individual,

One incident involved emails sent to about 215 NRC employees in "a logon-credential harvesting attempt,"

A dozen NRC personnel took the bait and clicked the link. 

hackers also attacked commission employees with targeted spearphishing emails that linked to malicious software. A URL embedded in the emails connected to "a cloud-based Microsoft Skydrive storage site," which housed the malware,

In another case, intruders broke into the personal email account of an NRC employee and sent malware to 16 other personnel in the employee's contact list. A PDF attachment in the email contained a JavaScript security vulnerability. One of the employees who received the message became infected by opening the attachment, McIntyre said. 

Follow this link for additional details:

http://www.nextgov.com/cybersecurity/2014/08/exclusive-nuke-regulator-hacked-suspected-foreign-powers/91643/

70 Percent of World's Critical Utilities Breached

78 percent of the senior security officials responded that a successful attack is at least somewhat likely within the next 24 months



The link below has more information:-

http://www.darkreading.com/attacks-breaches/infographic-70-percent-of-worlds-critical-utilities-breached/a/d-id/1298006