Foreign hackers targeted US water plant in apparent malicious cyber attack ... - Washington Post (blog)

Foreign hackers caused a pump at an Illinois water plant to fail last week, according to a preliminary state report. Experts said the cyber-attack, if confirmed, would be the first known to have damaged one of the systems that supply Americans with water, electricity and other essentials of modern life.

Companies and government agencies that rely on the Internet have for years been routine targets of hackers, but most incidents have resulted from attempts to steal information or interrupt the functioning of Web sites. The incident in Springfield, Ill., would mark a departure because it apparently caused physical destruction.

Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard.

News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify.

The report, which Weiss read to The Washington Post, describes how a series of minor glitches with a water pump gradually escalated to the point where the pump motor was being turned on and off frequently. It soon burned out, according to the report.

The report blamed the damage on the actions of somebody using a computer registered to an Internet address in Russia. “It is believed that hackers had acquired unauthorized access to the software company’s database” and used this information to penetrate the control system for the water pump.

Experts cautioned that it is difficult to trace the origin of a cyber-attack, and that false addresses often are used to confuse investigations. Yet they also agreed that the incident was a major new development in cyber-security.

“This is a big deal,” said Weiss. “It was tracked to Russia. It has been in the system for at least two to three months. It has caused damage. We don’t know how many other utilities are currently compromised.”

Dave Marcus, director of security research for McAfee Labs, said that the computers that control critical systems in the United States are vulnerable to attacks that come through the Internet, and few operators of these systems know how to detect or defeat these threats. “So many are ill-prepared for cyber-attacks,” Marcus said.

The Illinois report said that hackers broke into a software company’s database and retrieved user names and passwords of control systems that run water plant computer equipment. Using that data, they were able to hack into the plant in Illinois, Weiss said.

Senior U.S. officials have recently raised warnings about the risk of destructive cyber-attacks on critical infrastructure. One of the few documented cases of such an attack resulted from a virus, Stuxnet, that caused centrifuges in an Iranian uranium enrichment facility to spin out of control last year. Many computer security experts have speculated that Stuxnet was created by Israel — perhaps with U.S. help — as a way to check Iran’s nuclear program.

More cybersecurity coverage

- Proactive steps against cyberattacks

- Pentagon: Offensive cyber attacks fair game

- Cyberspying report names China, Russia

- In cyberspace, growing calls for clarity on what U.S. can do to deter against attacks

View the original article here

The state of cyber security - Join Sophos and the NCSA in Washington DC

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

I would like to invite all of our readers to an event October 27th, The State of Cyber Security, in Washington DC hosted by the National Cyber Security Alliance and Sophos.

I am proud to be speaking at the event along with Michael Kaiser, executive director of the National Cyber Security Alliance and Rob Strayer, director of the National Security Preparedness Group from the Bipartisan Policy Center.

At the event we will host a cocktail reception followed by a panel presenting the latest information on what threats we are facing and how the public and private sectors can work together to make the online world a safer place.

For those of you in the United States you may have heard that October is National Cyber Security Awareness Month (NCSAM).

The goal of NCSAM is to educate the public about the risks they face online and provide practical advice on how to stay safe online all year round.

The NCSA provide a website with videos, tips and information for consumers and small businesses called StaySafeOnline.org to help further this goal.

One of the primary themes this year is a campaign called "Stop, Think, Connect", which has helpful videos on topics from how to be a safe surfer, to how to be a safe gamer online.

We hope you can join us next Thursday and help to get the word out to our friends, neighbors and co-workers about being safe online.

If you aren't able to attend you can follow the event on Twitter by searching for #NCSAM11.

Follow @chetwisniewski

View the original article here

BART leak highlights hacker ethics split - Washington Post (blog)

Hackers differ on the ethics of attacks (CBS News - CBS News) Just a couple of days after the hacktivist collective Anonymous organized a protest in San Francisco over the city rapid-transit system’s decision to shut down cellphone service, an unassociated hacker posted the names and e-mail addresses of transit officers online.

The San Francisco Weekly reported it had spoken with a French girl using the screen name “Lamaline_5mg” who claimed credit for the attack. She said it was very easy for her to get the information, and that she posted it because she was upset with BART’s decision to turn off cellphone networks in response to a planned protest.

At least one prominent Anonymous member has said through the Twitter account AnonyOps that he or she does not support posting private information online.

Reaction to this latest cyberattack and the “OpFacebook” attack announced for Nov. 5 have further shown the inherent problem Anonymous faces as a loose collective.

Despite the hacker’s own words in the San Francisco Weekly article, several reports attributed the latest attack to Anonymous, because of the group’s recent actions against BART and the fact that some members spread the word about the information on their Twitter feeds.

Anonymous prides itself on the fact that anyone can use its name, but the group also has to fight a public relations war to make sure that central goals — exposing corruption, illegal government activity and corporate missteps — don’t get overshadowed by splashy attacks that seem to have little to do with the public good.

In an open letter AnonyOps posted on his or her Twitter account, a member of the group summed it up this way:

People participate in many activities in the name of Anonymous. They hack websites, leak information, participate in distributed denial of service attacks, protest in the streets, and spread information. None of this is done at the direction of leadership. All of it is voluntary. Anonymous doesn't DO anything; people do things Anonymously.

Related stories:

Blog Post: BART spokesman says cellphone shutdown was his idea

Facebook ‘operation’ shows off Anonymous’s cracks

Anonymous says it will take down Facebook on Nov. 5

???initialComments:true! pubdate:08/18/2011 16:19 EDT! commentPeriod:3! commentEndDate:8/21/11 4:19 EDT! currentDate:8/21/11 6:24 EDT! allowComments:false! displayComments:false!

View the original article here

Hackers hit Washington Post, expose 1.2 million accounts - Christian Science Monitor

An unknown group of hackers hit the jobs section of the Washington Post website last week, making away with the personal information of more than 1.2 million users. In a FAQ posted this afternoon, reps for the Post sought to play down the extent of the hack, assuring users that the worst that they will probably weather is a series of spam emails, which should obviously be ignored (the spam emails, not the FAQ).

Skip to next paragraph

"[Y]ou should be aware that you may receive some unsolicited e-mail (spam) as a result of this incident," Post exec Beth Diaz wrote in a letter to users. "As a general matter, you should always avoid opening suspicious or unsolicited e-mail, never respond to or click any links in spam, and avoid providing personal or financial information in an e-mail – especially credit card information, bank account information, passwords, and ID numbers."

Still, this isn't particularly great news for the Post, or for other newspapers, which typically require online readers to fork over a small amount of personal information – usually an email address and name, and sometimes more – before registering on the site. Readers like to trust that that personal information will be kept safe, not left exposed to marauding groups of hackers, whomever those marauding groups of hackers may be.

Speaking of which: Is it possible, as Kyle Wagner coyly hints over at Gizmodo, that the Washington Post attack could be the work of Anonymous or any of the other members of the AntiSec campaign? Horizons readers will remember that Anonymous has been very active in recent weeks, hitting the online home of the Arizona Police Department, among other targets.

Answer: Sure, it's possible that Anonymous is behind the attack. It fits the bill for AntiSec, which has typically targeted large governmental and media outposts. But then again, no one has yet claimed credit for the attack, and claiming credit is something that Anonymous likes to do. Stay tuned for more.

View the original article here

Hackers break into Washington Post jobs site

(Reuters) - Hackers broke into the Washington Post Co's jobs website in two incidents last month, affecting more than a million user IDs and emails, the company said on its website.

The company said about 1.27 million users' IDs and email addresses were affected but no passwords or other personal information was accessed.

The company said the jobs accounts of users whose email addresses were accessed remained secure.

This latest breach comes amid a spate of hack attacks against high profile targets including Sony Corp and Citigroup.

Washington Post said it quickly identified the attack and took action to shut it down. It is pursuing the matter with law enforcement and conducting an audit of the security of its jobs site.

(Reporting by Abhishek Takle in Bangalore; Editing by)

View the original article here

Hackers hit Washington Post, expose 1.2 million accounts

An unknown group of hackers hit the jobs section of the Washington Post website last week, making away with the personal information of more than 1.2 million users. In a FAQ posted this afternoon, reps for the Post sought to play down the extent of the hack, assuring users that the worst that they will probably weather is a series of spam emails, which should obviously be ignored (the spam emails, not the FAQ).

Skip to next paragraph

"[Y]ou should be aware that you may receive some unsolicited e-mail (spam) as a result of this incident," Post exec Beth Diaz wrote in a letter to users. "As a general matter, you should always avoid opening suspicious or unsolicited e-mail, never respond to or click any links in spam, and avoid providing personal or financial information in an e-mail – especially credit card information, bank account information, passwords, and ID numbers."

Still, this isn't particularly great news for the Post, or for other newspapers, which typically require online readers to fork over a small amount of personal information – usually an email address and name, and sometimes more – before registering on the site. Readers like to trust that that personal information will be kept safe, not left exposed to marauding groups of hackers, whomever those marauding groups of hackers may be.

Speaking of which: Is it possible, as Kyle Wagner coyly hints over at Gizmodo, that the Washington Post attack could be the work of Anonymous or any of the other members of the AntiSec campaign? Horizons readers will remember that Anonymous has been very active in recent weeks, hitting the online home of the Arizona Police Department, among other targets.

Answer: Sure, it's possible that Anonymous is behind the attack. It fits the bill for AntiSec, which has typically targeted large governmental and media outposts. But then again, no one has yet claimed credit for the attack, and claiming credit is something that Anonymous likes to do. Stay tuned for more.

View the original article here

Anarchistic hackers keeping the pressure on - Washington Times

The anarchistic hacker group LulzSec formed, attacked websites around the world and announced its breakup all within two months — demonstrating the speed with which cybersecurity threats develop in the Internet age.

Since emerging in May, LulzSec has:

• Decrypted and published the login names, passwords and other personal information of members of the FBI’s private sector partnership organization Infraguard.

• Broken into NATO’s online electronic bookstore.

• Posted confidential documents from a half-dozen foreign governments.

• Briefly taken offline the websites of the CIA and Britain's Serious Organized Crime Agency.

Last week, the group — apparently less than a dozen strong — posted hundreds of internal documents stolen from the Arizona State Police computer network, including the home addresses of several officers and their families.

Cybersecurity experts tell The Washington Times that copycat groups already are emerging all over the world, that the hacker tools they use are widely available and that LulzSec’s nihilistic mindset will continue spreading.

“It’s the idea behind it that will be picked up,” said David Marcus, director of security research for McAfee Labs, noting that LulzSec lookalikes already have been founded in Brazil and Spain. “It’s hard to fight an idea.”

The group has used the slogan, “Laughing at your security since 2011,” and derives its name from “security” and the Internet term “lulz,” which means “loads of laughs.” LulzSec also has 280,000 followers on Twitter.

The group’s objective has been “basically to laugh at you and embarrass you about your poor security,” Mr. Marcus said. “They’re very hard to categorize.”

“We like crushing things; we like inside info,” wrote a member using the name Espeon about the group’s philosophy during an internet chat with a security executive whose firm LulzSec had hacked. The group later published a purported transcript of the exchange.

LulzSec last week issued a statement saying it was disbanding out of “boredom.”

Mr. Marcus said the group “crossed a line” in posting the home addresses and phone numbers of Arizona Department of Public Safety officers and their families. “That’s not funny, that’s not ‘lulzy,’ ” he said. “If you want to protest, protest. But that is putting people in danger.”

Many of the group’s attacks have used relatively simple methods, including SQL injection, in which hackers exploit very widespread and easily discoverable software security flaws to take control of websites’ databases.

Story Continues ?

View Entire Story © Copyright 2011 The Washington Times, LLC. Click here for reprint permission.

View the original article here

LulzSec hacker group inspires copycats - Washington Times

The anarchistic hacker group LulzSec formed, attacked websites around the world and announced its breakup all within two months — demonstrating the speed with which cybersecurity threats develop in the Internet age.

Since emerging in May, LulzSec has:

• Decrypted and published the login names, passwords and other personal information of members of the FBI’s private sector partnership organization Infraguard.

• Broken into NATO’s online electronic bookstore.

• Posted confidential documents from a half-dozen foreign governments.

• Briefly taken offline the websites of the CIA and of Britain’s Serious Organized Crime Agency.

This week, the group — apparently less than a dozen strong — posted hundreds of internal documents stolen from the Arizona State Police computer network, including the home addresses of several officers and their families.

Cybersecurity experts tell The Washington Times that copycat groups already are emerging all over the world, that the hacker tools they use are widely available and that LulzSec’s nihilistic mindset will continue spreading.

“It’s the idea behind it that will be picked up,” said David Marcus, director of security research for McAfee Labs, noting that LulzSec lookalikes already had been founded in Brazil and Spain. “It’s hard to fight an idea.”

The group has used the slogan, “Laughing at your security since 2011,” and derives its name from “security” and the Internet term “lulz,” which means “loads of laughs.” LulzSec also has 280,000 followers on Twitter.

The group’s objective has been “basically to laugh at you and embarrass you about your poor security,” Mr. Marcus said. “They’re very hard to categorize.”

“We like crushing things; we like inside info,” wrote a member using the name Espeon about the group’s philosophy during an Internet chat with a security executive whose firm LulzSec had hacked. The group later published a purported transcript of the exchange.

Over the weekend, LulzSec issued a statement saying it was disbanding out of “boredom.”

Mr. Marcus said the group “crossed a line” in posting the home addresses and phone numbers of Arizona Department of Public Safety officers and their families. “That’s not funny, that’s not ‘lulzy,’ ” he said. “If you want to protest, protest. But that is putting people in danger.”

Many of the group’s attacks have used relatively simple methods, including SQL injection, in which hackers exploit very widespread and easily discoverable software security flaws to take control of websites’ databases.

Story Continues ?

View Entire Story © Copyright 2011 The Washington Times, LLC. Click here for reprint permission.

View the original article here