France Weather Forecast Website Hacked

An Albanian hacker going with the handle of Amar^SHG hacked and defaced the official website of Météo-France (Weather Forecast France) last Monday 23rd May.

The hacker left a deface page along with a message on the home page of Weather Forecast France website which revealed that the reason for targeting the website was to state his anti-war sentiments. The deface page also included a Gif file showing a kissing scene between Landon Carter and Jamie Sullivan from the movie “A Walk to Remember.” It seems like the hacker is more into spreading love rather than hate. 

According to the deface message:

“If the world could be perfect…. In a grown and smart society, I still see madness and horror such as war. What’s the point ? Human stays human, the world is still burning… You’re only a small part of the population, you always see your problems first, you’re not happy with what your country is offering you. But I understand you: you are human. As long as there’re minds in this world, it will never be perfect. The solution IMO is to accept the sadness because when we are not perfect, we are forced to live with. Best we can do is this current society, if you have troubles in your life, you’ll know: you are living, you’ll never be perfect… Sick world, but hope.”

Link to the targeted site along with its zone-h mirror as a proof of hack are available below:

http://meteofrance.fr
http://zone-h.com/mirror/id/26304958
Also See: Anonymous Hacks UN Climate Change Site Against Police Attack on Cop21 March

This is not the first time Amar^SHG has hacked a high-profile website in France. In fact, in March 2016 he defaced the official website of Canal Plus (Canal+), a French premium cable television channel and left a similar anti-war message.

At the time of publishing this article, both targeted websites were working online and available to the public.

 

A hacker posted racist meme with B.Obama

A racist Internet meme shared on an official's personal Facebook page was the result of hacking, Members of the Delta County Republican Central Committee say.

Last week, a photo that compared President Barack Obama to the 1950s movie chimpanzee Bonzo appeared on Delta County Committee Chairwoman Linda Sorenson's Facebook page. Committee Vice Chairman Vic Ullrey told The Grand Junction Daily Sentinel (http://bit.ly/1Z8Dn9y) that Sorenson did not post the image and that her account was accessed by someone else.

"This whole thing is a hoax. Someone got into the Facebook somehow," Ullrey said. "It was hacked, and somebody got into it, definitely."

Ullrey said Sorenson is not racist and it is unclear why Sorenson was targeted. But he thinks it politically motivated.

"(Hackers posted the image) just to damage the Republican Party, no doubt. . Just to make us look bad," he said.

Sorenson in an interview last week after the image was posted said she didn't care if people were offended by it. She has not commented on the issue since.

Sorenson has been chairwoman of the central committee for about four years. The organization is a collection of two members from each county precinct, and it works to coordinate the Delta County Republican Party before general elections

Anonymous Leaks data of Kenyan Oil Corporation

World Hacker Team (WHT), a smaller division of the Anonymous hacker collective, has posted a link online containing the database dump of a site connected to the National Oil Corporation of Kenya.

The data dump does not hold sensitive details and appears to be part of a survey management CMS, which was running somewhere on the company's official website. The World Hacker Team also posted a screenshot of the hacked backend as proof of their attack.

The database dump is made up of two main tables. The first is a table containing details about National Oil Corporation employees with access to the CMS. It holds usernames, email addresses and emails, along with the user's rank. Five admins are included.

The second table appears to hold the same information, but on 218 users. All the data in the second table is from National Oil Corporation employees.

The data dump is part of the second stage of the #OpAfrica campaign, during which the hackers said they would be targeting Kenyan organizations, along with other countries such as Burundi, Togo, Burkina Faso, Central African Republic, Ethiopia, Somalia, and Algeria.

Previously, Anonymous hackers also leaked 1TB of documents from Kenya's Ministry of Foreign Affairs.

This is no devastating data breach like we saw in the past from Anonymous, but some people are probably going to see an increase in spam in the following months. The lesson here is that #OpAfrica hasn't stopped and that the World Hacker Team will try to deliver on its promise made at the end of last month and leak details from services and agencies from other African countries.

Read more: http://news.softpedia.com/news/anonymous-leaks-employee-details-from-national-oil-corporation-of-kenya-504671.shtml#ixzz4ADijz9sy

A power grid attack is a nightmare scenario

Stores are closed. Cell service is failing. Broadband Internet is gone.
Hospitals are operating on generators, but rapidly running out of fuel.
Garbage is rotting in the streets, and clean water is scarce as people boil water stored in bathtubs to stop the spread of bacteria.And escape?

There is none, because planes can’t fly, trains can’t run, and gas stations can’t pump fuel.
This is the “nightmare scenario” that lawmakers have been warning you about.
The threat of an attack on the nation’s power grid is all too real for the network security professionals who labor every day to keep the country safe.
“In order to restore civilized society, the power has got to be back on,” said Scott Aaronson, who oversees the Electricity Subsector Coordinating Council (ESCC), an industry-government emergency response program.
While cybersecurity experts and industry executives describe such warnings as alarmist, intelligence officials say people underestimate how destructive a power outage can be.
The most damaging kind of attack, specialists say, would be carefully coordinated to strike multiple power stations.
If hackers were to knock out 100 strategically chosen generators in the Northeast, for example, the damaged power grid would quickly overload, causing a cascade of secondary outages across multiple states. While some areas could recover quickly, others might be without power for weeks.
The scenario isn’t completely hypothetical. Lawmakers and government officials got a preview in 2003, when a blackout spread from the coastal Northeast into the Midwest and Canada.
“If you think of how crippled our region is when we lose power for just a couple of days, the implications of a deliberate widespread attack on the power grid for the East Coast, say, would cause devastation,” said Sen. Susan Collins (R-Maine).
Researchers have run the numbers on an East Coast blackout, with sobering results.
A prolonged outage across 15 states and Washington, D.C., according to the University of Cambridge and insurer Lloyd’s of London, would leave 93 million people in darkness, cost the economy hundreds of millions of dollars and cause a surge in fatalities at hospitals.
The geopolitical fallout could be even worse.
“If [a major cyberattack] happens, that’s a major act of war, bombs are starting to fall,” said Cris Thomas, a well-known hacker who is now a strategist at security firm Tenable.
A former senior intelligence official who spoke to The Hill echoed that assessment.
The specter of a catastrophic attack on the electrical grid looms large for utilities and the federal government. They all agree that a “cyber Pearl Harbor” would be a deliberate attack, most likely from a foreign adversary.
“It’s an act of war, not an act of God,” Aaronson said.
One of the most fearful aspects of a cyberattack is that they can be difficult to spot, even when they are happening.
At first, power providers may only notice a cascade of overloaded transmission lines failing in rapid succession — something that happened during the 2003 blackout, which was caused by an ordinary software bug.
A major attack would trigger a series of actions laid out in an ESCC playbook, and even for regional blackouts, energy companies would begin communicating instantly.
After a recent blackout at Washington, D.C.’s biggest electricity provider, “Immediately, I called a guy at Pepco and just said, ‘Hey, what’s going on?’ ” recalled Tom Fanning, who heads the country’s fourth largest utility, Southern Company, during an industry conference in March.
One of the things the industry has done to prepare for attacks is to set aside “clean” replacement equipment, like transformers, that could be deployed in an emergency. Transformers can be the size of school buses, but industry officials say they can be moved quickly and easily.
The energy sector for years has also had a mutual assistance program that kicks in during major power disruptions. Providers in unaffected areas send crews to places that have been crippled by a big storm, accelerating the work to restore power.
The assistance program could prove difficult to carry out during a cyberattack, however.
“If I’m sitting in Columbus, Ohio, and I know there’s a storm in Maryland, I’m not worried about sending my resources to Maryland,” said Stan Partlow, chief security officer at American Electric Power. “We’re pretty confident when we let those crews go that we’re not in trouble. On the cyber side, if I’ve sent my resources somewhere else and I’m next on the list…”
If the power grid were attacked, government workers would be scrambling at a command center in Arlington, Va.
The National Cybersecurity and Communications Integration Center (NCCIC) is part of the Department of Homeland Security. In the last six years, it has emerged as a hub for all the cyber information the government collects and analyzes.
Inside the complex, government employees and representatives from critical infrastructure industries monitor cyber activity around the clock. The NCCIC floor is lined with wall-sized screens and filled with rows of computer monitors.
The electricity industry’s main nonprofit regulatory body, the North American Electric Reliability Corporation (NERC), has a representative on the NCCIC floor every day.
If large swaths of the power grid went down, the government would tap the NERC representative to serve as a go-between to the industry as it sought to identify malicious software as quickly as possible.
After identifying the software, the government could help develop tools to boot out the hackers and eradicate lingering security flaws.
The NCCIC can also deploy “fly away teams” to utilities during a cyberattack. Those units can collect samples of malware causing outages and help mitigate network damage.
Over at the FBI, agents have been trained to assist with cyber investigations. If an attack occurred, their job would be to figure out the culprit.
“That’s really where they make their bones in this space,” said Austin Berglas, a former head of the FBI’s New York Cyber Branch and a lead investigator into last fall’s data breach at JPMorgan Chase.
Given all the preparations, it would seem that the U.S. has a rapid response plan ready to go in the event of any power grid hack.
But according to numerous cybersecurity experts, companies are mostly basing their preparations on the few case studies they’ve seen, creating the potential for gaps.
“I’ve spoken to CEOs and utilities about this problem,” Homeland Security Secretary Jeh Johnson said at a congressional hearing in March. “There’s clearly more to do.”
Last December, electric companies got their first look at what a blackout caused by hackers might look like.
In a coordinated assault, suspected Russian hackers penetrated Ukraine’s power grid, knocking out electricity for 225,000 people. The hackers flooded the customer service center with calls, causing technical difficulties and slowing the response.
“That isn’t the last we’re going to see of that,” National Security Agency Director Adm. Michael Rogers said recently. “And that worries me.”
Hackers already target the energy sector more than any other part of U.S. critical infrastructure, according to the most recent government report. There are more reported cyber incidents in the energy industry than in healthcare, finance, transportation, water and communications combined — and those are just the intrusion attempts that get noticed and reported.
Probing the power grid for digital vulnerabilities — which China, Russia and Iran do routinely — is now considered a standard part of intelligence gathering.
But those countries are careful not to disrupt economic and diplomatic relations with the U.S. No such constraints exist for rogue nations like North Korea and terrorist groups like the Islamic State in Iraq and Syria (ISIS).
“I believe that right now in Raqqa they're working hard on trying to orchestrate cyberattacks [on the power grid], just as they are working hard on trying to develop weapons to be used,” said Sen. John McCain (R-Ariz.), who chairs the Armed Services Committee, referring to the Syrian city ISIS has claimed as its home base.
The grid is like a single, sprawling machine made up of thousands of discrete operating units — a soft target, but a diffuse one, with redundancies built in. Turning the lights off would require the ability to strategically and simultaneously active many pieces of malware in separate locations.
“Right now the people who could do it, won’t — nation-states — and the people who want to, can’t,” Aaronson said.

A group of russian-affiliated hackers targetted a major Finnish media group.

Hacktivists from a notorious russian group Pawn Stormalso known as apt28, Sednit  and Sofacyhave attempted a cyber attack against employees of Finland's Sanoma corporation to hack into their data communications.

Another target of the same operation was Veli-Pekka Kivimäki, a Finnish activist of organisation Bellingcat, an international group of civic journalists investigating the Ukraine conflict.

Experts from a cyber security firm Trend Micro have monitored activities of Pawn Storm for about two years alreafy.

Feike Hacquebord,  Trend Micro’s Senior Threat Researcher, told a finnish magazine Yle that  the group registered a web address that differed by just one character from the address of Sanoma's genuine webmail server. He says  says the attack most likely occurred last August, and that the fake corporate webmail server operated for a few weeks before it was shut down.

CEO responsible for cyber security in Sanoma Kai Taka-Aho confirmed the attack and said that the company took it very seriously.

"In late April, we were informed by the National Cyber Security Centre Finland (NCSC-FI) of a cyber-espionage campaign aimed at targets including Sanoma. Other media outlets were also involved," he says.

Taka-Aho added that an immediate investigation was started upon the accident but "So far we have not found any evidence that the attackers succeeded or that we even received any phony messages. However we cannot completely rule this out".

He adds that Sanoma has since replaced its email system with a more secure one – something he says it would have done in any case.

According to the reports of another cyber securitycorporation Fire Eye

Pawn Storm hackers pose a serious threat for governments, political organisations and activists. Usually the hacktivists employ spear-fishing, malware and mass e-mail fishing technologies. Often the methods are combined to reach their destructive objectives.

Hacker Tries To Sell 427 Milllion Stolen MySpace Passwords For $2,800

There’s an oft-repeated adage in the world of cybersecurity: There are two types of companies, those that have been hacked, and those that don’t yet know they have been hacked.
MySpace, the social media behemoth that was, is apparently in the second category. The same hacker who was selling the data of more than 164 million LinkedIn users last week now claims to have 360 million emails and passwords of MySpace users, which would be one of the largest leaks of passwords ever. And it looks like the data is being circulated in the underground by other hackers as well.
It’s unclear when the data was stolen from MySpace, but both the hacker, who’s known as Peace, and one of the operators of LeakedSource, a paid hacked data search engine that also claims to have the credentials, said it’s from a past, unreported, breach.
Neither Peace nor LeakedSource provided a sample of the hacked data. But Motherboard gave LeakedSource the email addresses of three staffers and two friends who had an account on the site to verify that the data was real. In all five cases, LeakedSource was able to send back their password.
The database contains 427,484,128 passwords, but there are only 360,213,024 million emails, according to LeakedSource, which announced the leak on Friday in a blog post. Each record in the hacked dataset contains “an email address, a username, one password and in some cases a second password,” according to the site.
Of the 360 million, 111,341,258 accounts had a username attached to it and 68,493,651 had a secondary password (some did not have a primary password),” wrote LeakedSource, which provides subscribers, who pay between $2 a day to $265 a year, with access to what the site claims is a collection of more than 1.6 billion hacked or leaked records.
LeakedSource wrote that the data was provided by someone who goes by the alias Tessa88, but in an interview with Motherboard, an operator for the site said they were unaware of the real origins of the data breach, such as who originally breached MySpace, nor who has had the data “this whole time” or when the company was hacked. But this data was bound to leak eventually, they said.
“It's the nature of information. ‘Three can keep a secret, if two of them are dead,’” the operator told me in an online chat. “Once data gets traded a few times, eventually it will make its way to somebody who is not trustworthy to keep it a secret, and then it will spread like branches of a tree.”
MySpace did not respond to multiple requests for comment.

The passwords were originally “hashed” with the SHA1 algorithm, which is known to be weak and easy to crack, LeakedSource wrote. What’s worse, the company didn’t “salt” the passwords in the hashing process. Salting means adding a series of random bytes to the end of passwords before hashing them to make them harder to be cracked.
That’s why LeakedSource’s operator told me they expect to crack 98 or 99 percent of them by the end of the month, though the operator declined to say how many have been already cracked.
While the social network, which was one of the largest site on the internet more than 10 years ago, is now just a shell of its former self, this is still a significant hack. The site, which recently boasted about crossing the threshold of one billion registered users, still had a reported 50 million unique visitors per month as of last year.

Hacker terrorizes a US. hospital

Kansas Heart Hospital was the victim of a ransomware attack recently, but the hacker didn’t honor his end of the deal after being paid.
The attack on the Wichita facility occurred May 18, although few details about the incident have been released.

“I’m not at liberty because it’s an ongoing investigation, to say the actual exact amount [paid],” Hospital President Dr. Greg Duick says. “A small amount was made.”
Networkworld.com reports that the hacker then failed to restore full access to the files and asked for a second ransom, which the hospital refused to pay.
Duick praises hospital officials for executing a preplanned response to the attack. “I think [the response] helped in minimizing the amount of damage the encrypted agent could do,” Duick says.
Duick also stresses that patient information was never jeopardized and routine operations were not affected.
Campus Safety has previously reported on a variety of ransomware attacks and the different ways institutions have responded to them, but we have not reported on a situation where the hacker didn’t restore access to files after a payment.
Multiple reports have predicted the rise of ransomware attacks and pointed to cybersecurity vulnerabilities in hospitals

North Korean hackers hit a fourth bank in Philippines

It's now clear the global banking system has been under sustained attack from a sophisticated group -- dubbed "Lazarus" -- that has been linked to North Korea, according to a report from cybersecurity firm Symantec.

In at least four cases, computer hackers have been able to gain a dangerous level of access to SWIFT, the worldwide interbank communication network that settles transactions.
In early February, hackers broke into Bangladesh's central bank and stole $101 million. Their methods appear to have been deployed in similar heists last year targeting commercial banks in Ecuador and Vietnam.

Symantec revealed evidence on Thursday that suggests hackers used the same technique to slip into a bank in the Philippines in October. Symantec (SYMC) did not name the bank.
Hackers infected desktop computers at the bank, said Eric Chien, technical director of Symantec Security Response. But researchers still aren't sure if they succeeded in stealing any money.
Symantec researchers closely examined the computer virus used to attack the bank in Philippines. They found that its complex code shared distinct properties -- like specific instructions written in the same words -- as malicious code used to attack Bangladesh Bank.
These particular computer code weapons have been traced to a group that researchers worldwide have nicknamed "Lazarus."
It's unclear who these attackers are -- but there are clues.
The "Lazarus" group has been linked to a string of attacks on U.S. and South Korean government, finance and media websites since 2009. Cybersecurity firm Novetta carefully documented how "Lazarus" hacked Sony Pictures in 2014, stealing data and destroying computers at the Hollywood movie studio.
The U.S. government has publicly blamed that hack on the government of North Korea.
Symantec is now the second major cybersecurity company to link this string of bank hacks to the infamous Sony hack. Two weeks ago, British defense contractor BAE Systems did the same.
There is now widespread industry concern that it's too easy for hackers to attack the global financial system. This week, SWIFT CEO Gottfried Leibbrandt acknowledged that hackers are in a position to bring down banks.
On Friday, the Brussels-based organization announced new measures designed to help banks keep hackers out of their local computer networks.
SWIFT said that its network and core messaging services have not been compromised by the attacks.
A major hack of the banking industry carries potentially disastrous consequences.
Last week, MasterCard CEO Ajay Banga expressed worries about the financial sector's point of weakness: smaller banks.
Major banks spend millions of dollars protecting their computer networks. But all banks are connected to facilitate international trade. That means hackers can simply enter smaller banks to fraudulently pull money out of bigger banks.
That's how these bank hackers drew $101 million out of the Bangladesh Bank's account at the New York Federal Reserve.
"These days, basically every bank in the world is equidistant to the bad guy," said cybersecurity expert Jeremiah Grossman. "The risk of them getting captured is very low, and their reward very high."

Has the Iran-Saudi cyberwar already started?

Numerous Iranian media outlets reported May 25 that the website The Statistical Center of Iran was hacked and temporarily put out of use. News agencies wrote that the hackers were “outside of Iran” but little else was known about them. Some websites speculated that either the Islamic State (IS) or Iran’s regional rival Saudi Arabia conducted the attack. The low-level attack, which was followed by two attacks on Saudi Arabian statistical websites May 26, raised the question in Iranian media whether Saudi-Iranian cyber wars have begun.

 

In an articled headlined “The announcement of a cyberwar by Saudi Arabia against Iran?” Tabnak News agency wrote, “While many websites assumed this website was hacked by [IS] … it appears it is a Saudi hacker group.” Tabnak rejected the idea of IS involvement because the hackers referred to themselves as “Da۳s,” as in “Daesh,” an acronym the terrorist group does not use for itself. A Twitter account associated with Da۳s hackers followed a few well-known Saudi accounts, and Tabnak concluded that a Saudi group had conducted the attack with government backing. In any case, the screenshots provided of the hacked website appear to show that the hackers either wanted Iran to know that they were Saudi or that they intended to make it appear that they were.
An article in the Iran newspaper run by the Hassan Rouhani administration, perhaps in an attempt to downplay the speculation and tensions, reported that a source in the Statistical Center of Iran denied that its website was hacked at all. The official called the problems with the site “a natural issue with no relation to [IS] or other individuals.” The official added, “We should not open this small issue so wide that it creates rumors in the country.” The official also urged Iranians to not fan the flames of rumors.
Tasnim News Agency reported May 26 that two Saudi statistical websites were hacked just one day after Iran’s statistics center was hacked. According to the article, no one had taken responsibility for the hacking, but some social media users speculated that the attacks on the Saudi statistical websites were revenge attacks for the hacking of Iranian statistical websites. In a special report May 25 headlined “Saudi Arabia’s cyberwar against Iran, what is Iran’s cyber army’s response?” Tasnim wrote that the hacker group Da۳s also put an image of former Iraqi President Saddam Hussein on Iran’s statistical website, concluding that the hackers therefore are likely linked to Baathists or takfiri groups. Tasnim reported that Gen. Gholam Reza Jalali, who heads a military unit in charge of combating sabotage, had warned that Saudi Arabia intended to conduct cyberattacks against Iran, though few paid attention to his warnings. Jalali said cyberattacks will be the prime threat to Iran’s security this year.
Tasnim wrote that the attack on Iran’s statistical center can be considered the “first bullet in the beginning of a cyberwar.” However, this may not have been the first bullet. According to US officials, Iran was behind the cyberattack on Saudi Aramco in 2012. In 2015, Saudi Arabia’s Oil Ministry website was hacked by a group claiming to be Iranians.
Iran itself has been the victim of cyberattacks. The United States was behind an attack on Iran’s nuclear facility in Natanz, using a computer worm called Stuxnet, unique for its ability to cause physical damage.

Read more: http://www.al-monitor.com/pulse/originals/2016/05/iran-saudi-cyber-attacks-war-websites.html#ixzz49rUVELxL

Cyber security costs a lot for taxpayers

GREEN BAY (WLUK) - If you have a computer, chances are you've spent a few dollars to protect yourself against online viruses.
Your local government is also spending your taxpayer dollars to protect against cyber threats and thieves. That money can amount to tens of thousands of dollars to millions of dollars to fend off cyber thieves. And implementing all that cyber security doesn't even guarantee full protection.
Many attacks originate from Russia and China. And they're attacking computers here in the United States. The computer protection company Norse says on average worldwide there are 30,000 attacks--per second.

"So state governments, local governments, anyone that provides a service in Wisconsin who has records on you could potentially be in the cross-hairs," said
Byron Franz, an FBI special agent in cyber security. His mission: to protect Wisconsin companies from cyber attacks.
"Protecting companies against trade secret theft, economic espionage, stealing of Wisconsin business secrets principly to China, Russia," said Franz.
Franz educates business owners, government entities and their employees about how to stay ahead of the cyber thieves.
Hackers stealing business and government secrets is estimated, by the FBI, to cost the U-S up to $400-billion a year. And those lost business secrets cost some 2-million jobs.
Whether you run a business, own a home, or oversee a local government, Franz says you need protection.
"Ask yourself is your I-T fortress safe? And if you say 'yes' you're dilusional," said Franz.
FOX 11 Investigates caught up with August Neverman--the man in charge of internet technology for Brown County, the largest county in Northeast Wisconsin.
"We were regularly seeing 20,000 attacks a day," said Neverman. "And I'd even say to be more specific, events, things that looked like attacks."
Neverman joined Brown County's operation two year ago, and has spent time and taxpayer dollars upgrading its cyber security. He says the cyber attacks or suspicious things that get blocked by its anti-virus protection and firewalls now average about 10,000 a day. And to fend off these assaults costs money. Big money.
"It's safely just over one million dollars and unfortunately I expect over time that we'll end up investing more in it. And I don't mean just the county, I mean everyone because of these number of attacks," said Neverman.
Brown County has more than 2,000 computers, laptops, tablets and cell phones that its employees use. And they all need multiple layers of protection against cyber thieves.

Ethical Hacking. Opinion:

Some of the world's largest companies—Yahoo! Inc., Twitter Inc. and General Motors Co., among others—participate in bug bounty programs. Companies in these programs pay rewards to “white hat” or “ethical” hackers for finding cybersecurity vulnerabilities in their networks.
Bloomberg BNA Privacy & Data Security News Senior Legal Editor Daniel R. Stoller posed a series of questions to Marten Mickos, chief executive officer of HackerOne Inc. and former senior vice president and general manager for Hewlett-Packard Co., on why companies should join bug bounty programs and whether hackers will help businesses shore up their cybersecurity. 

Bloomberg BNA:

Do companies become part of the HackerOne bug bounty program platform by application or invitation?

Marten Mickos:

Companies come to HackerOne in most cases because they understand the benefits of working with hackers to improve software security so they contact us to sign up. HackerOne has created a global network of hackers and companies who work together to find and resolve software vulnerabilities.
Because of this community we also see customers arrive by invitation from either a hacker who has found a vulnerability and would like to report it using the HackerOne service, or they are invited by a customer or business partner of theirs. We also conduct outreach to invite others to join. Each new customer on HackerOne poses a unique challenge for our talented hackers and this helps us attract the best hackers and foster our community.

Bloomberg BNA:

Do you think allowing white hat or ethical hackers to exploit network vulnerabilities is the best way for companies to both detect and prevent future cyberattacks?

Mickos:

Inviting white hat or ethical hackers to hunt for bugs is a very powerful solution to a very common and complex problem. Every software system has vulnerabilities and every industry is struggling with security. Even if you’ve bought all the right products or followed all the best practices there are still no guarantees that your systems are secure. By inviting friendly hackers to look for vulnerabilities you will find out what you missed.
Most of our customers find a security vulnerability within 24 hours of launching on HackerOne. This is why organizations, including the U.S. Department of Defense, General Motors, Google Inc., Yahoo, Microsoft Corp. and Uber Technologies Inc., work with hackers as part of their security strategy.

Insiders are today’s biggest security threat

Colossal data breaches have grabbed the nation’s headlines for the past couple of years. Each incident prompts solemn corporate pledges to do everything possible that would prevent its future reoccurrence.
However, the cycle of alarm, dismay and reassurance, along with the hasty measures that typically follow, are now almost ritual. The response to violations of data formerly considered secure has morphed from shock to shrug. Attacks on institutional and corporate databases have become the new normal. And a generation of workers accustomed to information sharing has grown numb to its negative consequences.

Most of the high-profile attacks on corporate data centers and institutional networks have originated outside of the victimized organizations — in many cases from halfway around the world. But the network openings that allow outside cyber attackers to burrow in, infect databases and potentially take down an organization’s file servers, overwhelmingly originate with trusted insiders.
In some cases, those insiders are driven by malicious intent — the desire to enrich themselves through the sale of sensitive data or to retaliate for a perceived slight or mistreatment. There are also cases where a company’s third-party contractors, vendors or temporary workers — essentially privileged users — have been responsible for their client’s network breaches, either through malice or by accident.
However, according to a worldwide survey of Information Security Forum (ISF) members, the vast majority of those network openings were created innocently through accidental or inadvertent behavior by insiders without any intention of harming their employer. In a number of cases, that vulnerability was, ironically, the result of a trusted employee doing a seemingly run-of-the-mill task like taking files home to work on in their own spare time.
When it comes to sensitive health-care data, according to the U.S. Department of Health and Human Services Office for Civil Rights, the Top 5 breaches for the first few months of 2016 didn’t even involve malicious IT hacking. Instead, theft, loss, improper disposal and unauthorized email access or disclosure were behind the largest incidents in 2016.

There are three types of risky insider behavior, each requiring a different approach:
Malicious: Malicious insider behavior combines a motive to harm with a decision to act inappropriately. For example, keeping and turning over sensitive proprietary information to a competitor after being terminated.
Negligent: Negligent behavior can occur when people look for ways to avoid policies they feel impede their work. While most have a general awareness of security risks and recognize the importance of compliance, their workarounds can be risky.
Accidental: ISF members report that completely inadvertent breaches are more common than malicious ones. According to Verizon’s Data Breaches Incident report, accidents accounted for almost 30 percent of the information security incidents in 2015.

US. Army's 'hacker university'

Located just southwest of Augusta, Georgia is Fort Gordon, an Army installation that brings together most of the service's cyber warriors under one roof. In 2013, the Army chose the site as the home base of its Cyber Command after the unit was established in 2010.
Also home to a 604,000 square foot operations center for the National Security Agency, Gordon is where cyber warriors are taught their craft at what the Army calls its Cyber Center of Excellence. But before they get to the military's "hacker university," enlisted soldiers need to score high technical scores on the military entrance exam, and sign on for five years of service, instead of the normal four-year tour.

Due to the classified nature of their work, cyber training is often conducted in secure compartmented information facilities (SCIFs) where cell phones and other outside recording devices are not allowed, and all soldiers will have to obtain a Top Secret clearance prior to being assigned to their unit.
Soldiers go through a lengthy period of training after basic training: Six months spent at the Navy's Center for Information Dominance in Pensacola, Florida followed by six months at Fort Gordon.
Army officers go through their own training program at the Georgia base, called Cyber Basic Officer Leader Course. The course takes nearly nine months to complete and is the longest officer training program in the Army.
Enlisted soldiers train with members of all military branches over six months at the Navy's Cyber Analysis Course, according to Bloomberg. Since students can come from a variety of skill sets and backgrounds, the first two-thirds of classroom time focuses on basic programming, mathematics, and how networks and operating systems function. But later on they learn the steps to research and infiltrate targets, defend networks, and even hack a simulated network with Metasploit, a common tool hackers have used since its release in 2004.
Meanwhile, officers receive similar training, though their position merits other coursework in leading operations as opposed to carrying them out. Though a cyber officer can likely step in and be more than capable, given the certifications they obtain, to include Cisco's Certified Network Associate (CCNA) and the independent Certified Information Systems Security Professional (CISSP) credential.
“They are really valuably trained after that [schooling]," Stadtlander said.
So valuable in fact that the Army is seeing a challenge in retaining its talent from heavyweights in Silicon Valley.

Kenyan Banks on Alert Over Cyber Attacks

The Central Bank of Kenya (CBK) has received credible information that the bank and other government facilities could be the target of an imminent cyber-attack.

CBK is warning its employees to be ready and vigilant to stop such an event that has seen three central banks infiltrated by hackers this year.

"In light of this risk, we advise all staff to be cautious when opening e-mails and accessing the Internet. Do not open e-mails from unknown sources," reads a notice at the CBK offices.

A cyber-attack saw Sh8.1 billion ($81 million) stolen from Bangladesh's central bank and BBC News reported that an unnamed commercial bank also came under attack targeting its money.

Swift, which oversees the financial messaging network that underpins global money transfers, said the second attack showed that the Bangladesh theft was not an isolated incident but "part of a wider and highly adaptive campaign targeting banks."

Hacktivists have also gone after the websites of the Central Bank of Cyprus, which briefly came under attack, days after a hacking collective said it conducted a similar attack on the Greek central bank's site.

German intelligence could support govt after hacker attack

German home secretary Thomas de Maiziere (CDU) has offered the government the support of domestic intelligence service (BfV) following a large-scale hacker attack, handelsblatt.com reports. Because there is evidence that the attack was launched by a foreign intelligence service, the BfV is responsible for counterintelligence.

Ministers will still have to vote on his offer. Some members of the parliament have reservations about including the intelligence service, with opposition in particular worried that the BfV will read MPs’ emails without authorisation. The leader of the parliamentary Left Party, Petra Pau, does not understand de Maiziere’s motion; according to her, it is self-evident that the BfV should inform the government of any findings regarding the attack.

Hackers Attack Deadmau5′ SoundCloud

What do you do when you’ve successfully hacked into the official SoundCloud account of one of the world’s most prominent electronic music producers and performers? You upload tracks by the kind of bubblegum pop artist that producer is famously against.

As Mixmag reports, a hacker collective by the name OurMine managed to infiltrate Deadmau5’s official SoundCloud account yesterday, threatening to leak the producer’s personal information and uploading a handful of Selena Gomez tracks to his page.
It’s the kind of troll that Deadmau5 himself would come up with if he was a member of a mysterious hacker collective and not the rather frustrated individual at the receiving end of a cybercrime attack. Of course, the producer took it all in stride.

Despite OurMine threatening via Twitter to leak Deadma5’s phone numbers, addresses, credit card information, and even nude photos to the public, the producer just reminded the hacker group that they’ve committed a felony and most of the stolen data is irrelevant.
The producer insisted the phone number they threatened to leak hasn’t been used in years, he’s already sold the condo at the address they acquired, and the sensitive financial information apparently amounts to his accountant’s office address.
Deadmau5, real name Joel Zimmerman, actually congratulated the hackers on a job well done and told fans that the situation has been resolved pending an audit of his web presence. He’s already launched a new SoundCloud page.

Cool. You hacked my soundcloud. Neat shit dude.

— dead mow cinco (@deadmau5) May 23, 2016

If anyone should be pissed, it's the fans who use that site to listen to music. But it ain't my fuckin site. So fuck off.

— dead mow cinco (@deadmau5) May 23, 2016

Hack deez nuts. Anyway. Good enough excuse as any to finally get https://t.co/Z4p2EAIkUZ

— dead mow cinco (@deadmau5) May 23, 2016

Well you managed to upgrade an annoyance to a felony. GG no re. https://t.co/9GC17aeXln

— dead mow cinco (@deadmau5) May 23, 2016

@deadmau5 lol, are you waiting for me to leak your nudes? and i can pay with your credit cards :D

— OurMine Team (@_OurMine_) May 23, 2016

Clinton broke rules with secret server

Former Secretary of State Hillary Clinton did break her department’s rules by setting up her own secret email server, the inspector general concluded in a report sent to Congress on Wednesday that says she failed to report hacking attempts and waved off warnings that she should switch to a more official email account.

Inspector General Steve Linick, appointed by President Obama, said he couldn’t find any evidence that Mrs. Clinton received approval for her odd email arrangement, and when lower-level staffers pressed the issue, saying she was skirting open-records laws, they were ordered “never to speak of the secretary’s personal email system again.”
In one instance in 2011, Mrs. Clinton’s tech guru thought the server was being hacked and shut it down for a few minutes. Months later, Mrs. Clinton feared yet another hack attack was underway — yet never reported the incident to the department, in another breach of department rules.
“Notification is required when a user suspects compromise of, among other things, a personally owned device containing personally identifiable information,” the investigators wrote. “However, OIG found no evidence that the Secretary or her staff reported these incidents to computer security personnel or anyone else within the Department.”
The report was transmitted to some members of Congress but has not been officially released. The Washington Times and other press outlets obtained a copy Wednesday.
Mrs. Clinton refused to cooperate with the probe, as did a number of her top aides from her time at the department, leaving investigators with a number of questions they weren’t able to nail down.

Anonymous target Rick Scott

Nothing screams for attention louder than an anonymous post made by a group that calls itself Anonymous.
The Anonymous group posted a video message on Facebook blaming Gov. Rick Scott the billions of gallons of water from Lake Okeechobee flooding into the Atlantic Ocean and Gulf of Mexico.
“As the rainy season is fast approaching, we direct the polluted waters be redirected into the state Capitol’s front doors and remove Rick Scott as the governor. The residents of Florida and citizens of the world will no longer be the subject of his greed and weakness for his self worth.”

The video also blames Scott for a corrupt state judicial system that allowed the Palm Beach Gardens police officer who shot Corey Jones to go free.
The message, delivered by what looks to be the love child of a villain from the movie "Scream" and a "V for Vendetta" character, vaguely threatens Scott that the Anonymous group won’t forget the alleged atrocities he committed.
CBS 12 reports the same group alerted protesters to the home address of Palm Beach County State Attorney Dave Aronberg, which is listed as confidential in property appraiser’s records.
Political Fix will gladly interview someone about the claims against Scott. As far as we know, the U.S. Army Corps of Engineers uses the Caloosahatchee and St. Lucie rivers to relieve flooding from Lake Okeechobee because its a system they developed roughly a century ago.
U.S. Sugar usually catches heat for polluting the shallow Lake O with runoff from its sugar cane fields around the massive body of water, but the company — with albeit deep pockets — contends the pollution comes from headwaters around metropolitan Orlando.
Lastly, pushing the Lake O floodwaters on the doorstep of Tallahassee would only pollute the state’s already endangered freshwater springs.
Alas, efforts to reach someone from Anonymous were unsuccessful because they’re anonymous.

Anonymous disturb the stock market

A relatively unknown division of the Anonymous hacker collective that goes by the name of Anonymous Analytics has been sabotaging companies on the stock market by revealing flaws in their financial statements, with catastrophic results.

The group, which was founded in 2011, is comprised of former Anonymous hackers who decided that hacking into companies, dumping data, or launching DDoS attacks is not enough.

Anonymous Analytics are the stock market's vigilantes

Instead, they decided to use their skills as market analysts and black hat hackers to scour the Internet for clues, sometimes with less-than-ethical techniques, and then compile financial reports on the companies they find cheating on the stock market.

Until now, the group has published reports on eleven companies. The list includes mostly US and Chinese corporations, among which the most recognizable names are Qihoo 360 and Western Union.

Its most resounding success was the report on REXLot, a Chinese-based lottery machine service. Anonymous Analytics revealed that REXLot inflated its revenue and the amount of cash on its balance sheet, based on the amount of interest earned.

Anonymus Analytics sends REXLot stock into a downward spiral

The group published its findings on June 24, 2015, and REXLot stock price plummeted from 0.485 Hong Kong dollar per share to 0.12, before trading was suspended.

REXLot rejoined the market on April 18, this year, but even after submitting a 53-page report, the company stock fell again by 50 percent.

After reading REXLot's report, the group tweeted, "After 10 months, REXLot publishes a confused clarification announcement. We read it and endless laughs were had. We will respond shortly." And they did, a day after. Another day after that, the group published a second report on the company and modified its rating from "sell" to "strong sell."

A week later, news outlets reported that REXLot did not have enough cash to make due bond payments, which meant the company had to sell assets to repay bonds, proving the group right, and also showing its power and influence in the financial world.

For an Anonymous sub-division, the group has caused more financial damages to companies around the globe than any fourteen-year-old teen with a rented DDoS stresser, which would make them more qualified to get involved into #OpIcarus more than anyone else.

Below is Anonymous Analytics' latest report on REXLot, released on April 20, 2016.

See the documents...