About these ads

Archive

Posts Tagged ‘FireEye’

1-15 November 2013 Cyber Attacks Timeline

November 25, 2013 Leave a comment

It’s time for the summary of the main cyber attacks occurred in the first half of November and reported on the news.

These fifteen days have been particularly troubled from an information security perspective, having left to the records several remarkable breaches: LoyaltyBuild, affecting potentially 1.12 million individuals, CorporateCarOnline.com (850,000 individuals), MacRumors (850,000 individuals) and, last but not least, vBulletin (860,000 users affected). A damage report which appears really devastating.

But even hacktivists have been particularly active: several operations have been carried on by the Anonymous all over the world (Italy, UK, Singapore, Japan, Philippines and Ukraine). One in particular (by Indonesian hacktivists against Australian targets) has apparently created a fracture inside the collective.

Last but not least, the chronicles report the latest hack of the Syrian Electronic Army against VICE and a new wave of attacks of Pakistani hackers against Indian targets.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).1-15 November 2013 Cyber Attacks Timeline

Read more…

About these ads

The Psychosis of Targeted Attacks

August 24, 2012 Leave a comment

Apparently the “Psychosis of Targeted Attacks” is plaguing not only the end users but even the security researchers, leading to dangerous collisions and clamorous retractions.

Yesterday the security firm FireEye published a blog post about the well-known Gauss targeted attacks, concluding that there was some sort of relationship between the Gauss and Flame malware actors based on observing C&C communication going to the Flame C&C IP address.

Unfortunately they did not realize they were observing the activities of a sinkhole operated by Kaspersky in which the sinkhole process had been organized to monitor both the Flame and Gauss C&C infrastructure.

Kaspersky Chief Security Expert Alexander Gostev explains the reasons of the misleading conclusions:

After discovering Gauss we started the process of working with several organizations to investigate the C2 servers with sinkholes. Given Flame’s connection with Gauss, the sinkhole process was being organized to monitor both the Flame and Gauss’ C2 infrastructures. It’s important to note that the Gauss C2 infrastructure is completely different than Flame’s. The Gauss C2s were shut down in July by its operators and the servers have been in a dormant state by the operators since then. However, we wanted to monitor any activity on both C2 infrastructures.

During the process of initiating the investigation into Gauss C2s and creating sinkholes we notified trusted members of the security and anti-malware community about the sinkhole IP and operation so that they were aware of any activity. FireEye’s post about the Gauss C2 samples connecting to the same servers as Flame are actually our sinkholes they’re looking at.

With some easy Googling and checking on WhoIs, researchers could have verified all of this.

Since the investigation and sinkhole operation are still in progress we do not have any more information to provide at this time.

Follow

Get every new post delivered to your Inbox.

Join 2,705 other followers