::Trend Micro Threat Resource Center::

30 August 2015

Deaths linked to Ashley Madison Hack


The data breach at Ashley Madison has escalated (with juicy data dumps!), and is feared to have driven two more people to suicide, following a Texas resident taking his own life last week.

Previously covered here and here

26 August 2015

Malaysia takes the lead as the most cyber-savvy Asian nation while Indonesia is on the bottom rung

While 93% of online users in Asia worry about cyber security, 3 out of 5 consumers are unable to answer basic cyber security questions correctly, according to the ESET Asia Cyber Savviness Report 2015.


The survey also underlines that the region still has a long way to go in understanding online security and protecting themselves.

Polling 1,800 respondents from across Hong Kong, India, Indonesia, Malaysia, Singapore, and Thailand, the survey aimed to gain insights into the attitudes, knowledge and user behaviours across Asia when it comes to cyber security.

Despite the fact that Asia-Pacific region has the highest number of internet users in the world, the results of the study show that users in this region don’t know how to stay safe online. Moreover, a large  share of those  polled  commit basic mistakes like using passwords containing easy to access personal information, such as their date of birth or surname, storing passwords and credit card details online, and connecting to unsecured public wi-fi networks.

ESET’s study ranked Malaysia as the most ‘cyber-savvy‘nation in Asia-Pacific, ahead of Singapore, India, Thailand, Hong Kong, and Indonesia in that order. Cyber-savviness is based on factors such as the ability to understand activities likely to make them vulnerable online, risky behaviours while surfing the web, and the steps users take to protect themselves online.

Surprisingly, the results showed that consumers in countries with higher cyber savviness didn’t necessarily take all the right precautions, nor were they fully aware of the cyber security risks that common online activities pose. For example, users in India and Indonesia, take the highest number of precautions despite having the lowest levels of cyber security awareness. On the other hand, countries like Malaysia, Singapore and Thailand, which ranked amongst the top in ESET’s awareness survey came in near the bottom when it came to protecting themselves.

“We need to bust some myths about online security,” said Parvinder Walia, Sales Director APAC at ESET. “The ESET Asia Cyber Savviness Report 2015 found that users in Asia-Pacific tend to take unnecessary risks when they’re online, partly due to a lack of awareness. Users have the dangerous misconception that their personal accounts and activities are not likely to be a target for hackers or might be trading security for convenience. This has to change.”

“Information today is available at the touch of a button and the Internet is simplifying our day-to-day lives. Being aware and taking simple precautions will mean that users can stay protected online and feel confident as they take advantage of all that the Internet has to offer,” added Walia.

More education needed to boost cyber security awareness 
The study quizzed respondents about common safety risks online in order to find out how much they actually know about cyber security. Across the region, while 68 percent of online users said that they are aware of online security issues, they were unable to answer questions regarding cyber security practices.

In the Asia-Pacific region, the lack of formal education is a huge issue as 4 in 10 online users said they gained most of their information about online security through unofficial sources such as doing their own online research or from their families and acquaintances.

On an encouraging note, over 78 percent of the surveyed respondents that didn’t have any formal training about cyber security, said they were keen to learn more.

21 August 2015

Ashley Madison 2.0 - Hackers Leak 20GB Data Dump, Including CEO's Emails

The group of hackers behind the breach of Ashley Madison, the popular cheater's dating service, have released a second, even much bigger 'cheat sheet' exposing sensitive materials that include sensitive corporate information.


Two days ago, the hackers released nearly 10GB of its customers' personal data online, which included 36 million emails and hashed passwords, 9.6 Million Credit Card Transactions records and their associated usernames.

Nearly 20GB of Ashley Madison Internal Data LEAKED
This time, the Impact Team leaked nearly 20GB worth of what appears to be internal data – not customers' data – from the adultery website on the dark Web
.
The leaked data appears to include the source code for the site, as well as a massive amount of e-mail from Ashley Madison parent company's Avid Life Media CEO Noel Biderman.
According to the researcher, who analysed the leaked data, the TL;DR of the leak is:

  • The leak contains lots of Source Code
  • 73 different git repositories are present
  • Ashley Madison used gitlab internally
  • The 13GB compressed file appears to contain Ashley Madison CEO's emails seems corrupted
  • The leak contains plain text or poorly hashed (md5) db credentials

Personal Emails of Avid Life Media CEO Noel Biderman Exposed
The trove of information was dumped with a taunting message to the adultery website's founder posted on the same dark web hosting the earlier data dump. The message reads:

"Hey Noel, you can admit it's real now." – presumably directed at CEO Noel Biderman, who has refused to recognize the data is all legitimate.


Dave Kennedy, the founder of cyber security company TrustedSec LLC, has analysed the second data dump and confirmed that it contained nearly 1GB of Biderman's emails.

"The dump appears to contain all of the business/corporate e-mails, the source code for all of [Avid Life Media's] websites, mobile applications, and more," TrustedSec wrote in its official blog post published yesterday.

This is really interesting; having the complete source code to these websites means that hackers now are capable of finding new security holes in Avid Life's websites, and further compromise them more.

However, we have yet to wait for a response to this new release from Avid Life Media officials. If they do, this post will be updated accordingly.

11 August 2015

A New Company Called Alphabet Now Owns Google

Well, this was a very unexpected move by Google.


Google Co-Founder Larry Page announced a restructuring of the whole company, revealing the creation of the umbrella "Alphabet" corporation.

But, don’t worry… Google isn’t dead! Rather, Google will become part of Alphabet.

Why Google Rebrands As ‘Alphabet’
Over time, Google, the Mountain View company has become a lot more than just a Search Engine.

Google created and acquired a large number of other popular Internet services, including Android, YouTube and Gmail, that makes too much difficult for a single company to manage all of them effectively.

According to Google Founders, it’s time, when different projects require different leaders, different company cultures, and different types of resources.

"Our model is to have a strong CEO, who runs each business, with Sergey and me in service to them as needed," Page wrote.

So the founders decided to create an all new parental brand that will manage both Google as well as its other far-flung projects — called ‘Alphabet’, going to be the biggest tech company most people have never heard of.

As a part of the new structure, Alphabet will manage Google and all of its other products, including:

  • Google
  • Calico, an anti-aging biotech Research Division
  • Nest, Google's Smart-Home project
  • Sidewalk, a company, focused on Smart Cities
  • Fiber, Company for High-speed Internet services
  • Investment arms, such as Google Capital and Google Ventures
  • R&D unit, such as Google X, developing Self-driving cars and Drones.
  • Alphabet Inc. will replace Google Inc. as the publicly traded company on the Nasdaq Stock Exchange, and shareholders will get one Alphabet share for every Google share they previously owned.

G is for 'Google' and 'Sundar Pichai 'is New CEO
Google’s senior vice president Sundar Pichai (Pichai Sundararajan), currently senior vice president of products, will be the new CEO of the Search Engine.


Google is now a more coherent company than it was previous. Google will now include the company's core businesses, including:

  • Search Engine
  • Advertising, Adwords, and Adsense
  • Google Maps
  • YouTube, the Video Service
  • Android, Mobile operating system
  • Chrome operating system
  • related technical infrastructure.

And the current CEO Larry Page will become Alphabet’s CEO. Co-founder Sergey Brin will be its president, and Eric Schmidt will be the executive chairman of Alphabet.

"It is clear to us and our board that it is time for Sundar to be CEO of Google," Larry Page wrote in the open letter announcing the creation of Alphabet.

"Google itself is also making all sorts of new products and I know Sundar will always be focused on innovation—continuing to stretch boundaries. I know he deeply cares that we can continue to make 
big strides on our core mission to organize the world's information."

The 43-year-old Sundar Pichai rose quickly at Google, from working with the Chrome team to lead both the team as well as Android as senior vice president of Products.

The Launch of Alphabet Inc. will not affect you at all, but Good news… the company’s shares jumped 6 percent after hours, adding tens of billions of dollars to its value.