Hackers stole credit card numbers belonging to as many as 1.5 million MasterCard and Visa customers, Global Payments, Inc. confirmed on Sunday. The international credit card processor was blocked by Visa after it reported the possibility of a major security breach on Friday. The company did not indicate how the hackers gained access to its system or who might be responsible for the attack. “Based on the forensic analysis to date, network monitoring and additional security measures, the company believes that this incident is contained,” the firm told The Wall Street Journal while noting that cardholder names, addresses and Social Security numbers were not compromised. The company did say that the credit card numbers were downloaded during the attack rather than just being accessed, however, indicating that the perpetrators may intend to use the information to create counterfeit credit cards. Affected Visa and MasterCard customers have not yet been notified that their account information was stolen.
The world’s two largest credit card processors have notified U.S. banks of a potential security breach that may affect more than 10 million cardholders, Reuters reported on Friday. MasterCard and Visa have said that the issue was the result of a third-party vendor and not their own internal systems. MasterCard said it has taken the proper steps by alerting law enforcement officials and hiring an independent data-security organization to review the possible breach. “MasterCard is concerned whenever there is any possibility that cardholders could be inconvenienced and we continue to both monitor this event and take steps to safeguard account information,” the company said in a statement. “If cardholders have any concerns about their individual accounts, they should contact their issuing financial institution.” Visa made sure to emphasize that its customers are not responsible for any potential fraudulent charges. More →
Using nothing more than a few common tools, hackers can reportedly recover credit card numbers and other personal information from used Xbox 360 consoles even after they have been restored to factory settings. Researchers at Drexel University say they have successfully recovered sensitive personal data from a used Xbox console, and they claim Microsoft is doing a disservice to users by not taking precautions to secure their data. “Microsoft does a great job of protecting their proprietary information,” researcher Ashley Podhradsky told Kotaku in an interview. “But they don’t do a great job of protecting the user’s data.” In order to avoid potential data theft, Podhradsky recommends users remove the hard drives from their consoles and wipe them while connected to a PC using special software. The Drexel researcher warns that not taking this precaution could have serious consequences. “A lot of [modders and hackers] already know how to do all this,” she said. “Anyone can freely download a lot of this software, essentially pick up a discarded game console, and have someone’s identity.”
UPDATE: Microsoft contacted BGR via email with a statement regarding Kotaku’s report, which can be read below in its entirety. More →
Executive assistant director of the FBI Shawn Henry, who after more than two decades is preparing to leave the bureau, said in an interview with The Wall Street Journal that computer criminals are too talented and current defensive measures are too weak to stop them. “We’re not winning,” he said, claiming that the current public and private approach to fighting off hackers is “unsustainable.” Congress is currently considering two competing bills that are designed to strengthen critical U.S. infrastructures such as power plants and nuclear reactors. Henry believes that companies must make major changes in the way they use computer networks to avoid further damage to national security and the economy, however. He said too many companies don’t recognize the financial and legal risks they are taking by operating vulnerable networks. “I don’t see how we ever come out of this without changes in technology or changes in behavior, because with the status quo, it’s an unsustainable model,” Henry said. “Unsustainable in that you never get ahead, never become secure, never have a reasonable expectation of privacy or security.” More →
A new study suggests that more than half of all Internet traffic is generated by non-human sources such as hacking software, scrapers and automated spam mechanisms. The majority of this non-human traffic, according to cloud service provider Incapsula, is potentially malicious. The study is based on data collected from 1,000 websites that utilize Incapsula’s services, and it determined that just 49% of Web traffic is human browsing. 20% is benign non-human search engine traffic, but 31% of all Internet traffic is tied to malicious activities. 19% is from ” ‘spies’ collecting competitive intelligence,” 5% is from automated hacking tools seeking out vulnerabilities, 5% is from scrapers and 2% is from content spammers. “Few people realize how much of their traffic is non-human, and that much of it is potentially harmful,” Incapsula co-founder Marc Gaffan told ZDNet. Incapsula, coincidentally, offers services aimed at securing small and medium businesses. More →
Hacker group “Anonymous Operations” has confirmed that the custom Linux-based operating system released under its name earlier this week is not a platform it developed. “The Anon OS is fake,” the group posted on Twitter Wednesday evening. “It is wrapped in trojans.” The desktop operating system was released earlier this week by individuals claiming ties with Anonymous. It is based on popular Linux distribution Ubuntu, and it ships with a number of hacking tools pre-installed. According to Anonymous, it also ships with a variety of malware. The team behind Anonymous-OS responded to the group’s claims, denying that its platform contains any malicious software. “The #anonops on their twitter account say ‘That Anonymous-OS is wrapped in trojans,’ ” the group wrote on its Tumblr blog. “Please people… in our world, in Linux and opensource world, there is not virus. If any user believe that Anonymous-OS ‘is wrapped in trojans’ or ‘backdoored OS by any Law enforcement Company or Hacker’ please don’t download it! But don’t mislead the world that Linux is dangerous and has trojans!” Anonymous-OS has been downloaded more than 25,000 times.
Notorious hacker group “Anonymous Operations” on Wednesday released the first version of its own desktop operating system. Dubbed Anonymous-OS, the computer platform is built on top of the open-source Linux-based Ubuntu 11.10 operating system, and it also utilizes the open-source Mate desktop environment, The Hacker News reports. It is unclear exactly who is behind the operating system, which comes with a number of tools pre-installed that are apparently Anonymous-approved. Included are Anonymous HOIC, John the Ripper, SQL Poison and more. Version 0.1 of the hacker group’s Anonymous-OS is free and available immediately for download, though readers should obviously exercise caution.
UPDATE: The Anonymous-OS Tumblr blog states that the group’s operating system is “created for educational purposes, to checking the security of web pages,” and the page suggests that users should not “use any tool to destroy any web page.”
Hackers associated with the group “Anonymous” have published Symantec’s Norton AntiVirus source code on The Pirate Bay. The source code was stolen in 2006 and after alleged attempts to extort money from Symantec failed, the hactivist group released it late Thursday evening. The file is 1.07GB in size and includes the source code to a number of products within the software suite, such as the consumer version, the corporate edition, and other files for Windows, Unix and NetWare, according to a report from ZDNet. In addition to the source code, the torrent includes a note calling for the release of the LulzSec hackers who were arrested on Tuesday — with the exception of Sabu, the group’s leader who reportedly worked with the FBI to build cases against other members of the group. Symantec has previously said that the breach will “not affect any current Norton product,” claiming the “current version of Norton Utilities has been completely rebuilt and shares no common code with Norton Utilities 2006. The code that has been posted for the 2006 version poses no security threat to users of the current version of Norton Utilities.” More →
The laughs are reportedly over for five top members of the hacker group LulzSec who were arrested on Tuesday and charged as part of a conspiracy case filed in New York federal court. FoxNews.com reports that the arrests were part of a multinational sting across the United Kingdom, Ireland and the United States on Tuesday morning, and LulzSec leader Hector Xavier Monsegur, who operated online under the alias “Sabu,” provided the Federal Bureau of Investigation with information leading to the arrests. According to the report, Monsegur has been working with the FBI for months. “This is devastating to the organization,” an FBI official told FoxNews.com. “We’re chopping off the head of LulzSec.” Read on for more. More →
Hackers targeted NASA computers, successfully gained access to employee credentials, and took control of systems at NASA’s Jet Propulsion Laboratory, CNN reported on Friday. Paul K. Martin, the agency’s inspector general, cited one case in a report issued this week in which intruders from China-based IP addresses gained “full system access” to change or delete sensitive files and user accounts for “mission-critical” systems at the Jet Propulsion Laboratory. “In other words, the attackers had full functional control over these networks,” Martin said. In an earlier attack, hackers stole credentials of roughly 150 NASA employees. The agency reported that it was targeted with 47 “advanced persistent threats” in 2011, 13 of which successfully compromised NASA’s computers. Read on for more. More →
Interpol on Tuesday announced that 25 suspected members of the hacker group “Anonymous” have been arrested in a raid across Europe and South America. The suspected members ranged in age from 17 to 40 and are accused of planning coordinated cyber-attacks against various government institutions, such as Colombia’s defense ministry and presidential Web sites, Chile’s Endesa electricity company and national library and other targets. The arrests were the result of an ongoing investigation by local and federal police agencies, which searched 40 locations in 15 cities and seized 250 pieces of technology equipment since mid-February. “This operation shows that crime in the virtual world does have real consequences for those involved, and that the Internet cannot be seen as a safe haven for criminal activity, no matter where it originates or where it is targeted,” Acting INTERPOL Executive Director of Police Services Bernd Rossbach said. Read on for Interpol’s press release.
Members from the notorious hacktivist collective “Anonymous Operations” have reportedly claimed responsibility for hacking two more government websites following the takedown of the Central Intelligence Agency’s website last week. The Associated Press on Friday reported that Anonymous had breached the United States Federal Trade Commission’s consumer protection business center website as well as a National Consumer Protection Week website. Both sites were temporarily replaced by a “violent German-language video” focused on the Anti-Counterfeiting Trade Agreement. ACTA, which has been signed by a number of countries including the U.S. and Canada, aims to put forth international legal guidelines for fighting piracy. Neither affected agency has confirmed the attacks, but both the FTC business center website and the National Consumer Protection Week website were offline at the time of this writing. More →
Hackers from the notorious group “Anonymous Operations” claim to have taken down the United States Central Intelligence Agency’s website shortly after 3:00 p.m. EST on Friday. “CIA TANGO DOWN: cia.gov,” a member of Anonymous posted to one of the group’s Twitter accounts. Anonymous’s motivation for this most recent cyberattack on the CIA is unclear, but this high-profile hit could be one of the group’s most significant attacks yet. As of the time of this writing, cia.gov was still offline. More →