Students under arrest after hacking into computer system to change grades

Friday 3:45 p.m. – Update

Court records outline details of three students accused of changing grades in an elaborate case. 

With a total of 58 charges between the three students, Roy Sun received 13 counts of charges, Mitsutoshi Shirasaki received 20 and Sujay Sharma received 13. 

The charges were a combination of Class C and D felonies and Class A misdemeanors.

It is alleged that Shirasaki's girlfriend Xiaonan Jing, an undergraduate in the College of Science, may have been involved in the case. Jing's grades were also changed as one of her classes, a Japanese class from Fall 2012, from an A to an A+, by Shirasaki, according to court records. 

The students are of accused breaking into a number of classrooms and computer labs from October 2009 to March 2013, but they also purchased locks from Wal-Mart and practiced picking them.

Court documents indicate, the students took turns practicing picking locks, standing as lookouts, breaking into the computer labs, placing keyloggers into keyboards and cutting wires in keyboards. They then are accused of accessing keystroke information from the keyboards and use this to enter professors' login information into computer systems. 

In March of 2013, Sun and Shirasaki exchanged telephone calls expressing the possibility of the police tracing the crimes back to them and the need to get rid of evidence, which is believed they did around Tippecanoe County. Sun was also concerned the Sharma had too much information and "coudn't keep his mouth shut." 

Sun graduated in 2010 with a Bachelor's of Science in Electrical Engineering and is currently at Boston University as a graduate student.  

A number of professors were involved in the grade changes from several colleges in the University: Liberal Arts, Engineering and Science. 

--

Three students have been involved in hacking into a professor’s computer and changing the grades they had received, which has resulted in two arrests and a lengthy investigation.

Two current engineering students, Sujay Sharma and Mitsutoshi Shirasaki, have been arrested by the Purdue University Police Department (PUPD) on a lengthy list of charges from burglary, to computer tampering, to forgery. Former student, Roy Sun, is also involved in the case. Sun is now a graduate student at Boston University. He is currently in his home country of Japan and his future has yet to be determined.

The case arose in January when a Purdue professor alerted Information Technology at Purdue (ITaP) that his University account password had been changed, along with the security question he had set. This is when he also noticed that grades had been changed from previous semesters.

The three students somehow switched the keyboards in an ITaP computer lab that a professor used received information from there to change the grades. The exact methods the student used to hack into the system and change the grades is still under investigation.

Grade changes were as subtle as A to A+ and as drastic as D’s to A’s, yet the motives behind these actions are unclear.

John Cox, police chief for PUPD, said the police have been working with ITaP, the FBI, Boston University Police Department and the case prosecutor Pat Harrington to investigate the situation since January. Cox said that this case was the first of this magnitude.

“This was no outside attack,” Cox said. “This was (done by) some students who were very smart and used their knowledge and wisdom to do something they shouldn’t have.”

Cox said there has been an internal audit to check for “anomalies” to make sure this was an isolated event over the last few years.

“There are thousands of grade changes every year in the system,” Cox said. “To see there were 30-something grades that were changed that’s unfortunate, you don’t want one grade changed like that ... It was the biggest case like that, that we’ve ever seen so far.”

Sharma and Shirasaki are no longer enrolled at Purdue and their grades have been changed back to reflect what each student had originally received. They also face local and state charges for the grade changes.

According to Jeff Stefancic, associate dean for the Office of Rights and Responsibilities, the University is still looking at Roy’s status as he is no longer a Purdue student.

“We can examine a student’s graduation status and potentially revoke a degree that was granted if the situation warrants it. That’s currently under our administrative review right now,” Stefancic said.

Cox said that ITaP is working to increase security and make it more challenging to get into the system, but that work is done every day by ITaP, not in response to this case.

“It gets a little tougher when you start having things like iPads and laptops floating around out there ... working wirelessly. We’ve done an awful lot with ITaP and ITaP has done a really nice job of working with that,” Cox said.

View the original article here

Anatomy of a change - Google announces it will double its SSL key sizes

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Google just announced that its HTTPS web pages will be ditching 1024-bit RSA keys in favour of 2048 bits.

"Pah," I hear you say. "I have one or two questions about that - three questions, in fact."

How is this newsworthy when many other web properties have already made the switch to 2048 bits? (Kim "Big Fella" Dotcom's mega.com.nz, for example.)Why switch if 1024 bits is much bigger than the largest RSA key yet known to have been cracked, at 768 bits?Why the fuss about 1024 bits anyway, if just 128 bits is considered more than enough for other encryption algorithms, such as AES?

Let's start at the end: why thousands of bits of RSA key but only hundreds for AES?

An n-bit symmetric key gives 2n different possible keys to choose from; if we assume there is no algorithmic shortcut, we have to try all 2n of them to be certain of cracking the key. For obvious reasons, this is called a brute force attack.

A cryptographic attack that requires an equivalent effort to brute-forcing n bits of symmetric cipher key is said to have a security strength of n.

According to the US National Institute of Standards and Technology (NIST), security strengths of 112 and above are considered OK until the end of 2030. Security strengths below 112 are already considered deprecated, a word that means "used with disapproval."

From the end of 2013, they'll move from "deprecated" to "disallowed", at least if you follow NIST's playbook. So, you have until the end of the year to get all your cryptosystems up to a security strength of 112 or more.

AES uses keys of 128, 192 or 256 bits in length, so AES implicitly meets this condition.

But RSA encryption is a public/private key cipher, meaning you have one key to lock and another key to unlock.

You make the locking key public, so that anyone can encrypt messages and send them to you; you keep the corresponding unlocking key private, rather obviously, so that only you can decrypt them.

Technically and algorithmically, a 128-bit RSA key isn't anything like a 128-bit AES key. It's actually a 128-bit number n that is constructed by multiplying together p and q, two randomly-chosen 64-bit prime prime numbers. To crack such a key requires you to factorise n back into p and q.

This sort of factorisation is computationally complex, but it doesn't take 2128 tries to guarantee a result.

? Straight off the bat, we know that the largest possible factor of n is vn, and v(2128) is 264. So that cuts the maximum number of tries to 264. And neither factor can be even, since then it wouldn't be a prime factor, which instantly halves the maximum number of tries to 263. Clearly, the cost of factoring n-bit prime products is well below 2n.

If fact, an 128-bit RSA key would be absurdly weak by modern standards. In practice, a 1024-bit RSA key is only considered equivalent to an 80-bit symmetric key, and thus has a security strength of 80.

So the fuss about 1024-bit RSA keys is that they too, like AES or similar keys below 112 bits, will become "disallowed" at the end of the year.

Now we come to the second question: why the jump from 1024 to 2048 bit keys?

In 2014, symmetric keys will need to go from a minimum of 80 bits to a minimum of 112 bits; in 2031, they'll go from 112 to 128 bits. Those are key-size increases of 40% and about 15% respectively.

But in 2014, RSA key sizes are required to grow by 100% (1024 to 2048 bits), and in 2031 by 50% (2048 to 3072 bits). Why the discrepancy in the scale-up?

The reason is that the complexity of a brute-force attack against a symmetric key grows exponentially with the number of key bits, so each additional key bit multiplies the strength by a constant factor of 2.

But each additional key bit in an RSA key multiplies the strength by an ever-decreasing amount, so you need a bigger jump in key size for the same increase in resilience to brute force attack.

And finally, the first question: is this a big deal only because Google has announced it?

It shouldn't be a big deal for anyone to make an announcement like this. Inded, it should be expected and unexceptional, as Google itself explains.

In theory, you should easily be able to change website certificates as a matter of routine, not least because they expire and need refreshing anyway. Everyone's software should automatically adapt.

But SSL certificates don't usually stand alone, or else anyone could mint a certificate that claimed to be from sophos.com, or microsoft.com, or anywhere they liked.

So SSL certificates are themselves generally signed by other people who vouch for you - firstly by one or more intermediaries (which might be security teams in your own company) and finally by a root certifier. This creates a so-called "chain of trust," topped out by a root certificate that is automatically trusted by software on your computer, such as your browser or the operating system itself.

The list of root certificates is often rather long - perhaps alarmingly long when you think about the power and authority it conveys.

Of course, root certificates themselves aren't immune from expiry, or from compromise, or from needing key-size updates. So software that uses its own list of trusted roots must provide a way to update that list, for changes neccesitated both by routine (e.g. expiry) and emergency (e.g. a hack of the certificate authority's network).

Note that Google will be changing its root certificate size to 2048 bits as well, so that all the certificates in its chain of trust are 2048 bits.

So Google is warning all of us, in good time, in case any of us have software (or, more challengingly, firmware burned into devices like games consoles, phones, and printers) that rely on hard-wired lists of root certificates.

If you have software that relies inflexibly on hard-wired SSL trust lists, take this as a good time to change the way your code works.

As Google points out, firmly but fairly, in its FAQ:

The only way to do this correctly is to build software that understands that Roots can change, and can adapt to that.

Google does have some self-interest here, as it doesn't want potential customers being put off by certificate warnings as as result of this change. On the other hand, those certificate warnings shouldn't really happen, so Google is acting in the interest of the whole ecosystem by highlighting these issues.

The takeaways?

Build SSL certificate flexibility into your software.Switch to 2048-bit RSA keys before the end of 2013.

For the greater good of all!

Follow @duckblog

Tags: AES, brute force, certificate, key bits, nist, private key, public key, RSA, security strength, SSL, symmetric key

View the original article here

Anatomy of an exploit - Linksys router remote password change hole

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A security researcher from San Jose in California has published a how-to guide detailing a number of vulnerabilities in various Linksys routers.

Phil Purviance, who goes by the handle of SUPER.EVR (EVR stands for Exploitation Vulnerability Research), reported the holes privately on 05 March 2013:

Hello Cisco PSIRT, I would like to report several vulnerabilities in Linksys network equipment. A public advisory regarding these issues may be released 30 days after sending this report.

And Purviance certainly lived up to his threat, publicly releasing the gory details on 05 April 2013 on his blog.

I don't want to get sidetracked into a discussion about the disclosure process here - whether 30 days was long enough, whether it was fair to expect a reply after emailing Cisco, which no longer owns the Linksys brand, or whether explicitly documenting the holes was wise.

You'll have to make your own mind up on those issues, because the purpose of this article to zoom in on one of the holes to see what we can learn from it.

The vulnerability we'll be looking at is:

Linksys EA2700 Password Change Insufficient Authentication and CSRF Vulnerability

Imagine that you are trying to penetrate a network inside a building that is monitored by security guards, offers no remote computer access, and is surrounded by an electric fence and motion detectors.

You're not going to get inside, but now imagine yourself holding up a placard outside one of the office windows saying, "Kindly enable remote login on port 5128 and change the password to b4nana," and waiting a while.

Imagine if it worked!

That's a simile for one of the bugs that Purviance found.

It gets the tag CSRF, for Cross Site Request Forgery, because it lets you embed, in an external web page (that's the placard outside the window), a URL that refers to a configuration script that will run on your router (that's the list of instructions on the placard).

So the Cross Site Request isn't a demand from an angry web server, but rather a web page that deliberately takes you to site B via site A.

In this case, visiting an otherwise innocent-looking external site can cause your browser to initiate internal actions on your router.

And if the router assumes that you are authorised simply on the basis that you are issuing the request from inside the network, an external attacker can easily use you as his "inside proxy" to violate security.

The unprotected configuration page found by Purviance permitted just the sort of silent reconfiguration jokingly shown on our placard: enabling external router admin (something you should never be tempted to do by choice), changing the password, and more.

So much for the metaphorical electric fence, the security guards and the motion detectors.

Of course, for this attack to work, the criminal needs to know what internal URL to embed in his external web page, which means he needs to know the internal name or IP number of your router:

That's so that when your browser processes the dodgy URL, the malicious reconfiguration request goes to the right web page on the right router, and produces the right HTTP request, as in the example above.

In Purviance's example, as above, he chose 192.168.1.1, which is a good guess for many networks.

? Private IP address ranges for your home or business network run from 10.0.0.0 to 10.255.255.255, from 172.16.0.0 to 172.31.255.255, and from 192.168.0.0 to 192.168.255.255. Advocates of security through obscurity suggest choosing randomly from the available private spaces, and as long as you don't rely on this as a security measure in its own right, you might as well do just that.

By the way, the problem of internal command-and-control URLs embedded into external websites (the Cross Site Request part) is why many web services require you to enter your password again to authorise key operations, even if you are already logged in.

That not only does prevents curious (or malevolent) colleagues from making long-term changes to your configuration if you inadvertently leave your screen unlocked, but also makes attempted alterations caused by CSRF more obvious.

Requiring re-authentication not only makes the CSRF fail, but also draws your attention to the attempt because an unexpected password dialog pops up.

So, the lessons to learn from this bug are:

Don't gripe at websites that ask for your credentials again when performing configuration or security-related tasks. The inconvenience is a small price to pay for the additional safety.Keep your eye open for firmware updates for your routers and other network hardware. Security patches don't just apply to desktop operating systems and applications.When writing web services that are worth password-protecting, don't just protect access to the URL of the relevant starting page. Make sure that the individual URLs that accept and process commands (whether by GET or POST requests) are all authenticated, too.Logout from web services when you aren't using them. Don't needlessly leave yourself in the position that accidental or unexpected clicks can have unintended side-effects.

? Yes, the last point above includes logging out routinely from Facebook, Twitter and your webmail, too. It's much more convenient to stay logged in all day, but much less safe, and very much less secure.

As for closing this hole if you have a Linksys EA2700 router, Dan Goodin of Ars Technica reports that:

A statement issued by officials from Belkin, which recently acquired the Linksys brand, said the vulnerabilities documented by Purviance had been fixed in the Linksys Smart Wi-Fi Firmware that was released in June.

And according to Linksys, the June 2012 firmware release was itself superseded in July, October and November last year:

Purviance didn't make it clear, in his vulnerability disclosure, which firmware version he used during his research.

But if you aren't on the latest firmware version, you probably ought to grab it anyway.

After all, this isn't the first time we've written about vulnerabilities in, and the external misuse of, SoHo routers.

And if you're really keen, you can use the hacking-by-numbers tool Metasploit to do a penetration test against your own router, as exploit modules for Purviance's holes are already available online.

Follow @duckblog

View the original article here

Samsung Smart TV security hole allows hackers to watch you, change channels or plug in malware

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Did your Samsung Smart TV just switch channel?

Don't blame the dog for stepping on the remote control - there's a remote possibility it could be hackers who've hijacked your smart TV.

Researchers with Malta-based security consultancy and bug seller ReVuln have found a vulnerability in an unspecified model of a Samsung LED 3D TV that they exploited to get root access to the TV and any attached USB drives.

In a video titled "The TV is Watching You", ReVuln shows a Samsung TV screen with which the researchers systematically fiddle.

Here's what the researchers found they could access:

TV settings and channel listsSecureStorage accounts Widgets and their configurationsHistory of USB moviesIDFirmwareWhole partitionsUSB drives attached to the TV

By exploiting the vulnerability, ReVuln also found that they could retrieve the drive image, mount it locally, and check for sensitive documents or material that should remain private, such as usernames, passwords, financial documents, or any other type of material typically kept on USB drives.

If the victim uses a remote controller, ReVuln also found that they could get its configuration and thereby control the TV remotely.

ReVuln also found they could install malware remotely to gain complete root access to the TV, co-founder Luigi Auriemma told IDG News Service:

"If the attacker has full control of the TV...then he can do everything like stealing accounts to the worst scenario of using the integrated webcam and microphone to 'watch' the victim."

The vulnerability extends beyond one specific model tested in the firm's lab, he said:

"The vulnerability affects multiple models and generations of the devices produced by this vendor, so not just a specific model as tested in our lab at ReVuln."

ReVuln is a recent entrant into the market for buying and selling bug and vulnerability information and mostly focuses on vulnerabilities in SCADA and ICS software that run utilities, industrial systems and the like.

Auriemma has played around with TVs before. In April, he stumbled on a vulnerability in all current versions of Samsung TVs and Blu-Ray systems that would allow an attacker to gain remote access.

At the time, he said that the vulnerabilities could be found in all Samsung devices with support for remote controllers.

One hopes that the researchers have acted responsibly and informed Samsung of the vulnerabilities in their consumer devices, and that an over-the-internet firmware update to plug the security holes will be forthcoming.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

Malware attack strikes, posing as Skype password change notification

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If Skype users didn't have enough to worry about this week security-wise (with a worm spreading across the system), there's now another threat to warn about.

Emails have been spammed out by cybercriminals, posing as messages from Skype, claiming that you have changed your password on the service.

Here's an example of one such email (click on it for a larger version):

If you look carefully, you may spot that the spammers made a clumsy spelling mistake:

Password successfully changed
Your new Skype password has been set.

You can now view your attached call history and inscturtions how to change your account settings.
If the changes described above are accurate, no further action is needed. If anything doesn't look right, follow the link below to make changes: Restore password
Talk soon,
The people at Skype

Perhaps surprisingly, the links really do point to the genuine Skype website at skype.com.

However, a file (Skype_Password_insctructions.zip) is attached to the email, and if you make the mistake of unzipping and executing its contents (Skype_Password_inscructions.pdf.exe) you run the risk of infecting your Windows computer.

The malware, which is detected by Sophos products as Troj/Backdr-HN, opens a backdoor onto your computer, giving remote hackers access to your system.

The danger is, of course, that users worried by the recent worm will be frightened that their Skype password has been changed without their consent, and open the attachment - and thus infect their PC.

As always, be on the lookout for unsolicited suspicious emails and always be wary of opening attachments which arrive out of the blue. In this case, the file is using the well-known "double extension trick" to dupe the unwary into believing that they might be clicking on a PDF rather than executable code.

Follow @gcluley

Thanks to SophosLabs researcher Julie Yeates for her assistance with this article.

Lock image from Shutterstock.

View the original article here

Invited to change your Twitter profile's header image? Beware, it could be drug spam

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Inventive spammers are up to their old tricks again, desperate to do whatever it takes to get you to click on a link to their websites.

The latest campaign we have seen involves messages which, to all intents and purposes, look like they have come from Twitter.

Certainly, without close inspection, there's nothing much to be suspicious about in regards to the email (although maybe they would have been more convincing if they had managed to reference your Twitter name if you have one).

Subject: Because you have more to show

We have something for you...

New Twitter profiles

Make your profile beautiful with a header image. Browse your new photo reel. Check out what other people are doing with their profiles.

The emails invite you to update your Twitter profile, to include the new format profile images that the micro-blogging site is attempting to push onto a slightly underwhelmed userbase.

But in this case the emails don't come from Twitter at all. Because if you click on the links you are actually taken to a "Canadian pharmacy" website claiming to sell sexual enhancement drugs.

My guess is that the emails have been stolen lock-stock-and-barrel from a genuine Twitter communication, and just the links have been changed.

You should always be careful to check where a link is taking you, especially when contained in an unsolicited email, before you click on it.

In this case, it could just have easily linked to a bogus Twitter login page - asking you to enter your username and password - or a website hosting malicious code designed to infect your computer.

Follow @gcluley

View the original article here

Facebook hackers pwn baseball team pages, claim NY Yankees captain is having sex change

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A host of Facebook accounts belonging to US baseball teams were hacked yesterday, and defaced with messages in dubious taste, including one which claimed that New York Yankees captain Derek Jeter was undergoing a sex change.

"We regret to inform our fans that Derek Jeter will miss the rest of the season with sexual reassignment surgery. He promises to come back stronger than ever in 2013 as Minnie Mantlez"

Other clubs affected included the Miami Marlins, San Diego Padres, Chicago White Sox, Washington Nationals, Chicago Cubs and San Francisco Giants.

Here is a selection of the messages that were posted:

Clearly an unauthorised party had managed to gain admin access to the Facebook pages in order to post the messages - and the first thought is that it would be a very strange coincidence to have the Facebook pages of so many clubs compromised at the same time.

However, it turns out that the clubs run the Facebook pages in conjunction with MLB Advanced Media.

One possible scenario is that an MLB Advanced Media employee was sloppy with their password (maybe they weren't using a hard-to-guess password, or maybe they were using a password that they had also been using elsewhere on the net), allowing a hacker to gain access and post the inappropriate content.

A spokesperson for the baseball league told the Wall Street Journal that they were working with Facebook and law enforcement to see if they could identify what had happened, and who might have been responsible:

"For a brief moment today, a few MLB Club Facebook accounts were hacked and inappropriate material was briefly on display from those Clubs' pages on Facebook. MLB Advanced Media oversees these Facebook pages on behalf of the Clubs and regrets this occurrence. We are working with Facebook, Major League Baseball Security and, where appropriate, legal authorities to determine the circumstances surrounding this situation."

I guess everyone should be grateful that the hacker didn't exploit their access to the baseball clubs' Facebook pages by posting something more malicious - such as links to malware-infected pages - that could have impacted thousands of sports fans.

This isn't, of course, the first time that Facebook fan pages have been hacked and unauthorised posts made. There have been a wide variety of victims in the past, ranging from Viagra manufacturer Pfizer, Nicolas Sarkozy, and last year the rapper Soulja Boy who blamed a hacker for a series of racist and homophobic rants.

Perhaps the most embarrassing incident of this nature was when Facebook's own CEO, Mark Zuckerberg, had his official fan page hacked via an API bug.

Make sure that you keep informed about the latest security and privacy issues on Facebook. Join the Sophos page on Facebook, where over 190,000 people regularly share information on threats and discuss the latest security news.

Follow @gcluley

Baseball player image from Shutterstock.

Tags: baseball, Chicago Cubs, Chicago White Sox, Derek Jeter, Facebook, hacking, Miami Marlins, MLB, New York Yankees, San Diego Padres, San Francisco Giants, Washington Nationals

View the original article here

NVIDIA and Android Forums hacked, users advised to change passwords

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Graphics technology firm NVIDIA has temporarily closed its online developer forum, after it fell victim to hackers who may have gained access to members' hashed passwords.

A notice on the NVIDIA Developer Zone website has reminded users of the importance of ensuring that you do not use the same passwords on multiple websites.

NVIDIA suspended operations today of the NVIDIA Developer Zone (developer.nvidia.com). We did this in response to attacks on the site by unauthorized third parties who may have gained access to hashed passwords.

We are investigating this matter and working around the clock to ensure that secure operations can be restored.

As a precautionary measure, we strongly recommend that you change any identical passwords that you may be using elsewhere.

Password re-use is a big problem - with an alarming number of people using the same password on multiple sites.

The consequences of that lax attitude to security is that if you get hacked in one place, your other online accounts could also be accessed. For instance, if you used the same password on NVIDIA as you did on your web email account - it would be child's play for hackers to gain access to your personal communications and steal other information about you.

Earlier this week, an online community popular with fans of Android smartphones also suffered at the hands of hackers. Phandroid's AndroidForums.com was breached using "a known exploit", and data including usernames, hashed passwords and so forth were accessed.

Before reading this - please take a moment to change your password on androidforums.com. This can be done while logged in through your UserCP, or using the "forgot your password?" page if logged out.

I have some unfortunate news to pass along. Yesterday I was informed by our sever/developer team that the server hosting androidforums.com was compromised and the website's database was accessed. While the breach is most likely harmless there are important and potential pitfalls, and we want to provide as much helpful information to our users as possible (without getting too technical).

The trust of our users is extremely important and several staff members worked through the afternoon, evening, night, and morning to ensure we're doing everything possible to regain complete security.

Android Forums has over a million registered members. I'm one of them - so I was less than pleased to find myself having to change my password just in case it had been compromised.

The administrators of Android Forums said that they believed the hack was done with the intention of collecting email addresses to spam at a later date. So if you receive unexpected email messages, perhaps related to Android, think very carefully before clicking on their attachments or any embedded links.

Other sites to have been hit by hackers stealing information about users in recent weeks include Yahoo Voices, Formspring, Last.fm, eHarmony and LinkedIn.

You don't have to be a soothsayer to accurately predict that other websites are going to have their users' information accessed in the near future. Make sure you are following password best practice now - using different passwords for different sites, and ensuring that they are hard to guess and crack.

Follow @gcluley

View the original article here